Percona provides the mongodb_exporter for monitoring MongoDB. It can feed a Prometheus time-series database by exporting sharding, replication, and storage engine metrics. So basically, it’s the way we monitor MongoDB through Percona Monitoring and Management.
You can download or build mongodb_exporter from the Github repository. It also comes with the pmm-client package, and it’s based on the latest available mongodb_exporter version.
A simple connection method to MongoDB from mongodb_exporter is described in the mongodb_exporter documentation. But the SSL/TLS connection is a bit tricky due to the option changes between versions of MongoDB and mongodb_exporter.
Reference:
https://docs.mongodb.com/manual/reference/connection-string/#tls-options
https://github.com/percona/mongodb_exporter/releases/tag/v0.10.0
This blog post will show how to configure MongoDB Exporter with SSL/TLS options.
For SSL connection mongodb_exporter and MongoDB, here’s a list of SSL options.
|
1 |
# ./mongodb_exporter --mongodb.uri=mongodb://mongodb_exporter:Admin123@localhost:27017 --mongodb.tls --mongodb.tls-ca /etc/mongodb/rootCA.pem --mongodb.tls-cert /etc/mongodb/mongodb.pem<br>INFO[0000] Starting mongodb_exporter (version=0.9.0, branch=v0.9.0, revision=a11b3b515ee219ef9bce6af7f41d3ff47cc71720) source="mongodb_exporter.go:108"<br>INFO[0000] Build context (go=go1.12.9, [email protected], date=20190830-18:19:56) source="mongodb_exporter.go:109"<br>INFO[0000] Starting HTTP server for http://:9216/metrics ... source="server.go:140" |
MongoDB server logs:
|
1 |
I ACCESS [conn1164] Successfully authenticated as principal mongodb_exporter on admin from client 127.0.0.1:40772 |
Now lets test SSL connection with mongodb_exporter v0.10.0 using the same options.
|
1 |
# ./mongodb_exporter --mongodb.uri=mongodb://mongodb_exporter:Admin123@localhost:27017 --mongodb.tls --mongodb.tls-ca /etc/mongodb/rootCA.pem --mongodb.tls-cert /etc/mongodb/mongodb.pem<br>mongodb_exporter: error: unknown long flag '--mongodb.tls', try --help |
As we can see, mongodb_exporter v0.10.0 is not able to identify given options in the document. An error occurred due to changes in the mongodb_exporter v.0.10.0 version.
Reference: https://github.com/percona/mongodb_exporter/releases/tag/v0.10.0
Depending on the MongoDB version and the support for SSL/TSL, we will use the following options in mongodb.uri:
|
SSL Option
|
TLS Option
|
|---|---|
| sslclientcertificatekeyfile | tlscertificatekeyfile |
| sslclientcertificatekeypassword | tlscertificatekeyfilepassword |
| sslinsecure | tlsinsecure |
| sslcertificateauthorityfile | tlscafile |
We should refer to MongoDB documentation for additional URI options. We will not see these options under mongodb_exporter –help since they are part of mongodb.uri
|
1 |
# ./mongodb_exporter --mongodb.uri="mongodb://mongodb_exporter:Admin123@localhost:27017/admin?tls=true&tlsCertificateKeyFile=/etc/mongodb/mongodb.pem&tlsAllowInvalidCertificates=true&tlsCAFile=/etc/mongodb/rootCA.pem"<br>INFO[0000] Starting mongodb_exporter (version=0.10.0, branch=v0.10.0, revision=bf683745093a9210ebacbeb235bb792e21d17389) source="mongodb_exporter.go:94"<br>INFO[0000] Build context (go=go1.12.9, [email protected], date=20190918-13:37:48) source="mongodb_exporter.go:95"<br>INFO[0000] Starting HTTP server for http://:9216/metrics ... source="server.go:140" |
MongoDB logs:
|
1 |
I NETWORK [listener] connection accepted from 127.0.0.1:52146 #1564 (1 connection now open)<br>I NETWORK [conn1564] received client metadata from 127.0.0.1:52146 conn1564: { driver: { name: "mongo-go-driver", version: "v1.1.1" }, os: { type: "linux", architecture: "amd64" }, platform: "go1.12.9" }<br>I NETWORK [listener] connection accepted from 127.0.0.1:52148 #1565 (2 connections now open)<br>I NETWORK [conn1565] received client metadata from 127.0.0.1:52148 conn1565: { driver: { name: "mongo-go-driver", version: "v1.1.1" }, os: { type: "linux", architecture: "amd64" }, platform: "go1.12.9", application: { name: "mongodb_exporter" } }<br>I ACCESS [conn1565] Successfully authenticated as principal mongodb_exporter on admin from client 127.0.0.1:52148 |
|
1 |
# ./mongodb_exporter --mongodb.uri="mongodb://mongodb_exporter:Admin123@localhost:27017/admin?ssl=true&sslclientcertificatekeyfile=/etc/mongodb/mongodb.pem&sslinsecure=true&sslcertificateauthorityfile=/etc/mongodb/rootCA.pem"<br>INFO[0000] Starting mongodb_exporter (version=0.10.0, branch=v0.10.0, revision=bf683745093a9210ebacbeb235bb792e21d17389) source="mongodb_exporter.go:94"<br>INFO[0000] Build context (go=go1.12.9, [email protected], date=20190918-13:37:48) source="mongodb_exporter.go:95"<br>INFO[0000] Starting HTTP server for http://:9216/metrics ... source="server.go:140" |
MongoDB logs:
|
1 |
I NETWORK [listener] connection accepted from 127.0.0.1:51650 #1544 (1 connection now open)<br>I NETWORK [conn1544] received client metadata from 127.0.0.1:51650 conn1544: { driver: { name: "mongo-go-driver", version: "v1.1.1" }, os: { type: "linux", architecture: "amd64" }, platform: "go1.12.9" }<br>I NETWORK [listener] connection accepted from 127.0.0.1:51652 #1545 (2 connections now open)<br>I NETWORK [conn1545] received client metadata from 127.0.0.1:51652 conn1545: { driver: { name: "mongo-go-driver", version: "v1.1.1" }, os: { type: "linux", architecture: "amd64" }, platform: "go1.12.9", application: { name: "mongodb_exporter" } }<br>I ACCESS [conn1545] Successfully authenticated as principal mongodb_exporter on admin from client 127.0.0.1:51652 |
As I mentioned, while the SSL/TLS connection can be a little tricky, I am hopeful that this post helps you properly configure MongoDB Exporter!
Resources
RELATED POSTS
