Telegraf Enterprise & Controller 1.2: Know Your Fleet's Security Exposure, Versions, and Health

Telegraf Controller 1.2 is now available. It adds security advisory scanning (Telegraf Enterprise), agent-level heartbeat metrics and logs, fleet summary visualizations, and an official Telegraf Controller Docker image.

Telegraf Controller is a centralized control plane for managing, configuring, and monitoring your fleet of Telegraf agents. After configuration, the work shifts to maintaining your fleet, and new questions become important:

• What version of Telegraf are agents using?
• Which agents are logging errors?
• Which agents are exposed to the security advisory published this morning?

Telegraf Controller 1.2 addresses these questions directly with enhancements and quality-of-life improvements.

Security advisory scanning (Telegraf Enterprise)

InfluxData publishes security advisories for Telegraf and Telegraf Controller. Controller uses the published advisories to identify what agents are potentially affected by comparing each advisory’s affected version ranges against the Telegraf version each agent reports in its heartbeat.

A new Security page shows fleet-wide exposure by severity and the agents each advisory affects. The Agents page gains an Advisories column and exposure filter. When a security reviewer asks whether the fleet is exposed, the answer is a filtered list of agents and versions, not a manual audit. Air-gapped deployments can manually import the signed advisory file and still leverage the automated agent advisory scan. For more information, see the Security advisories documentation.

Agent-level metrics, errors, and logs

Each heartbeat can now carry runtime statistics and a sample of recent Telegraf logs. The updated agent detail page shows error, warning, and metric counts charted across the last 24 heartbeats. You can also inspect log entries from the latest heartbeat.

When an agent stops delivering data, you can see when the errors started and read the output plugin error behind the gap without shell access to the host. To enable it, add statistics and logs to the heartbeat plugin’s include list. For more information, see the View agent heartbeat data documentation.

Fleet summary visualizations

The Agents page now provides more information about the overall state of your Telegraf fleet:

• Agent status distribution: summary of agent statuses across your fleet
• Fleet health summaries: statistics about fleet health, reporting times, and how many agents are using a recent Telegraf version
• Telegraf version distribution: summary of Telegraf versions used by agents across your fleet
• Last reported histogram: see how recently agents across your fleet have reported

You can confirm the fleet is healthy and on the right version, find agents that have gone quiet or drifted, and fix them before a monitoring gap appears. The same data is available from the fleet summary API. For more information, see the Monitor agents documentation.

Heartbeat service health

The heartbeat service runs as a separate component inside Controller. When it failed quietly (database unreachable, no heartbeat token created yet, a scheduler error), the only symptom was agents drifting to “not reporting” with no explanation. A new indicator in the left navigation and a GET /api/heartbeat/health endpoint report the health of the heartbeat service’s database connection, token cache, and status check scheduler, and provide information about the problem when something is wrong.

Automation and networking improvements

Bootstrap API tokens: Set OWNER_TOKEN and Controller provisions an all-access API token at startup, so a Controller instance brought up by infrastructure-as-code is ready for API calls the moment it starts. See Bootstrap an owner token.

Pre-shared API tokens: Supply your own token value when creating a token and install the same value on several instances, so one credential works across every Controller instance you run. See Use pre-shared tokens.

Real agent IP addresses behind proxies: Agents behind a proxy, NAT gateway, or load balancer can send their real IP address in a Telegraf-Agent-IP header, and Controller shows that address instead of the intermediary’s. See Report the agent IP address from behind a proxy.

Official Telegraf Controller Docker image

Telegraf Controller is now published as an official Docker image, influxdata/telegraf-controller. To start Telegraf Controller in a Docker Container, run:

docker run --detach \
  --name telegraf-controller \
  --publish 8888:8888 \
  --publish 8000:8000 \
  --env TELEGRAF_CONTROLLER_EULA=accept \
  --volume telegraf-controller:/var/lib/telegraf-controller \
  influxdata/telegraf-controller:1.2.0

Once the container is running, open http://localhost:8888 and follow the setup screen to create the owner account. The command accepts the EULA, publishes the web and API port (8888) and the heartbeat port (8000) that agents connect to, and mounts a volume at /var/lib/telegraf-controller so your data survives container restarts and upgrades.

For more information about running Telegraf Controller in Docker, including a full Docker Compose file that runs Controller with a PostgreSQL database, see Telegraf Controller Docker documentation.

What’s free and what requires Telegraf Enterprise

Get started

Telegraf Controller 1.2 gives you one place to secure, troubleshoot, and scale your growing Telegraf fleet. Pull the Docker image or download and install Telegraf Controller for free, or contact us about Telegraf Enterprise.

FAQ