Skip to content

Change telegraf socket file path#2147

Merged
simathih merged 2 commits intoAzure:masterfrom
sajithmuh:sajithmuh-change-socket-file-path
Jan 16, 2026
Merged

Change telegraf socket file path#2147
simathih merged 2 commits intoAzure:masterfrom
sajithmuh:sajithmuh-change-socket-file-path

Conversation

@sajithmuh
Copy link
Copy Markdown
Contributor

@sajithmuh sajithmuh commented Jan 14, 2026

Previously, MetricsExtension (ME) relied on the permissions of /run/azuremonitoragent/ to create and access the InfluxDB Unix socket. During setup, ME would inspect the ownership of this directory and add the azuremetricsext user to the owning group.

However, directory ownership varies across Linux distributions:

  • On some distros, /run/azuremonitoragent/ is owned by syslog
  • On others, it is owned by root

As a result, azuremetricsext was inadvertently added to the root group on certain distros, which is undesirable from a security and correctness standpoint.

What’s Changed

This PR removes the dependency on /run/azuremonitoragent/ permissions and standardizes ME user and socket ownership behavior:

  • Dedicated ME-owned socket location
    • The InfluxDB socket has been moved to an ME-owned directory (/run/azuremetricsext).
    • Service files now reference the socket via %ME_INFLUX_SOCKET_FILE_PATH%, populated during setup.
  • Deterministic user and group setup
    • During ME setup, any pre-existing azuremetricsext user is explicitly removed and recreated.
    • The recreated user is added only to the intended group(s), avoiding accidental membership in privileged groups like root.
  • Removal of permission-based group inference
    • The previous logic that inferred group membership from directory ownership (setup_user_and_group_access) has been removed.
    • Since the socket now lives in an ME-owned directory, additional permission manipulation is no longer required.
  • Improved logging and robustness
    • User, group, and directory setup paths now use structured logging via HUtilObj.
    • Error handling has been tightened to fail early and log actionable messages.

Result:

  • Consistent behavior across Linux distributions
  • No accidental elevation of azuremetricsext privileges
  • Clear ownership and lifecycle of ME runtime artifacts
  • Simplified and more secure setup logic

@sajithmuh sajithmuh requested a review from a team as a code owner January 14, 2026 16:54
@sajithmuh sajithmuh force-pushed the sajithmuh-change-socket-file-path branch from 60d3a35 to 9ee743e Compare January 14, 2026 19:13
Comment thread LAD-AMA-Common/metrics_ext_utils/metrics_ext_handler.py
Comment thread LAD-AMA-Common/metrics_ext_utils/metrics_ext_handler.py Outdated
@simathih simathih merged commit c97b3a7 into Azure:master Jan 16, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants