Operations¶

How the instance is secured, how to manage Vector, and how to back up, update and get help.

Security model¶

Loopback only. Ingest (8687), the API (8686) and metrics (9598) listen on 127.0.0.1. Ingest accepts HTTPS only.
Authentication. HTTPS ingest needs the user vector and the first-boot password.
Per-instance secrets. First boot creates the TLS key and the password on the instance. They are not in the image.
File permissions. The password file, private key and configuration are owned by root, group vector, mode 0640. The ubuntu user cannot read them; administrators with sudo can. The certificate is readable by everyone so local clients can verify it.
Dedicated user. Vector runs as the vector system user and can write only to /var/lib/vector/data and /var/lib/vector/out.
SSH. Password login and root login are disabled. Use Session Manager, or SSH with a key pair from your administrative network only.
No AWS permissions needed for the default pipeline. Attach an IAM role only when you add an AWS sink, scoped to that sink's resources.

Services¶

Unit	What it does
`sushi-vector-firstboot.service`	Creates the TLS material, password, directories and config. Runs before Vector.
`vector.service`	Vector itself. Validates the config before it starts.

systemctl status vector
sudo systemctl restart vector

Health and metrics¶

curl http://127.0.0.1:8686/health
curl -s http://127.0.0.1:9598/metrics | head

Logs¶

sudo journalctl -u vector -n 100 --no-pager

Disk use¶

A new output file starts each day in /var/lib/vector/out/. The image does not delete old files, so set your own retention and watch free disk space:

df -h /
sudo du -sh /var/lib/vector/*

Backups¶

Back up /var/lib/vector/ and /etc/vector/ together. That includes the password file, so the next instance can keep the same certificate and password. Stop Vector first if you need a consistent copy of the buffer:

sudo systemctl stop vector
sudo tar -czf /var/backups/vector-backup.tar.gz /var/lib/vector /etc/vector
sudo systemctl start vector

When you restore, put regular files at the expected paths. First boot refuses identity and config files that are symbolic links or hard links.

Updates¶

Ubuntu security updates install automatically through unattended upgrades.
Vector stays on the version in the image. New versions ship as new image versions.

A new image version does not update a running instance. To move to it, launch the new version, copy the config, TLS files, password file, buffer and output across, then point your clients at the new instance. Try the move on a test instance first.

Support¶

Software Sushi provides packaging and setup guidance for this image. Email info@softwaresushi.com with your instance ID and a description of the problem. Do not send passwords, private keys or log data that contains secrets. This offer does not include Vector project support.