You were redirected from a different version of the documentation. Click here to go back.

Monitoring Agent Configuration

Legacy Monitoring Agent has been removed

This Agent has been updated from your self-managed legacy Monitoring Agent to the MongoDB Agent.

This page describes possible settings for Monitoring Agent. These values are set after first launching Cloud Manager and not through manual editing of these files.


Do not edit these settings for a Monitoring Agent that is managed by an Automation Agent. If you do, the Automation Agent can overwrite any changes you make. If you are not using the Automation Agent, you must edit these settings manually.

Configuration File Location on Each Platform

The location of the Monitoring Agent configuration file depends on your platform:

Platform Installation Method Config File Path
RHEL, CentOS, Amazon Linux and Ubuntu package manager /etc/mongodb-mms/monitoring-agent.config
macOS or other Linux distributions tar <install-directory>/monitoring-agent.config
Windows msi C:\MMSData\Monitoring\monitoring-agent.config


Cloud Manager provides default values for many of the Monitoring Agent Configuration settings.


You must set the mmsApiKey value.

Connection Settings

For the Monitoring Agent to communicate with the Cloud Manager servers, these connection settings are required:


Type: string

Specifies the ID of your Cloud Manager project. The project ID is displayed in the Project Settings page (Settings > Project Settings).



Type: string

Specifies the Cloud Manager agent API key of your Cloud Manager project.

You can use an Agent API key that you have already generated for the project. Otherwise, you can generate a new Agent API key. A project can have more than one Agent API key, and any of the project’s agents can use any of the keys. For more information, see Manage Agent API Keys.

To generate an Agent API key, go to the Agent API Keys tab. To navigate to the tab, from the Deployment view, click the Agents tab and then the Agent API Keys tab.


When you generate an Agent API Key, Cloud Manager displays it one time only. You must copy this key. Treat it like a password; store it in a secure place. Cloud Manager never displays the full key again.

This setting is usually set when the Monitoring Agent is installed and it is required.


Type: string

Specifies the URL of the Cloud Manager.


Logging Settings


Type: string

Specifies the absolute path to the log file. If this is not specified, the log writes to standard error (stderr) on UNIX- and Linux-based systems and to the Event Log on Windows systems.


Type: integer

Specifies the maximum size, in bytes, of a log file before the logs are rotated. If unspecified, the Monitoring Agent does not rotate logs based on file size. This is optional.


Type: float

Specifies the number of hours after which the log file is rotated. This is optional and cond supported on UNIX- and Linux-based systems.


You can manually rotate the Monitoring Agent logs. Issue a user signal 1 kill command for the Monitoring Agent process:

kill -SIGUSR1 <monitoringAgentID>

This rotates the Monitoring Agent log file.

HTTP Proxy Settings


Type: string

Specifies the URL of an HTTP proxy server the Monitoring Agent can use.


MongoDB Kerberos Settings

Specify these settings if the Monitoring Agent authenticates to hosts using Kerberos. To configure Kerberos, see Configure the Monitoring Agent for Kerberos.


Type: string

Specifies the Kerberos principal the Monitoring Agent uses.


Type: string

Specifies the absolute path to Kerberos principal’s keytab file.


Type: string

Specifies the absolute path to an non-system-standard location for the Kerberos configuration file.


Type: string

Specifies the service name with the gssapiServiceName option.

By default, MongoDB uses mongodb as its service name.


Cloud Manager creates a Kerberos Credential (Ticket) Cache for each agent automatically when Kerberos is enabled. If you want to override the location of the Kerberos Credential Cache, you must set the KRB5CCNAME environment variable to the desired file name and path before running the agent.

MongoDB TLS Settings

Specify these settings when the Monitoring Agent connects to MongoDB deployments using TLS. See Configure Monitoring Agent for SSL for more information.


Type: boolean

Specifies whether or not to encrypt all connections to MongoDB deployments using TLS.


Setting this to true overrides any per-host TLS settings configured in the Cloud Manager interface.


Type: string

Specifies the absolute path to the private key, client certificate, and optional intermediate certificates in PEM format. The Monitoring Agent uses the client certificate to connect to any configured MongoDB deployment that uses TLS and requires a client certificate (run with the --tlsCAFile option).


If you want to connect to a MongoDB deployment that uses both TLS and certificate validation using the mongo shell:

mongo --tls --tlsCertificateKeyFile /path/to/client.pem --tlsCAFile /path/to/ca.pem

You must set these options in your Monitoring Agent configuration file:


Type: string

Specifies the password needed to decrypt the private key in the sslClientCertificate file. This setting is required when the client certificate PEM file is encrypted.


Type: string

Specifies the absolute path that contains the trusted CA certificates in PEM format. These certificates verify the server certificate returned from any MongoDB deployments running with TLS.


Type: boolean

Specifies whether the Monitoring Agent should validate the TLS certificates presented by the MongoDB databases.


By default, the sslRequireValidServerCertificates setting is true, and a valid trusted certificate is required to connect to MongoDB instances using SSL.

When the Monitoring is managed by the Automation, this setting cannot be set to false. However, you can set sslRequireValidServerCertificates to false if you install and configure the Monitoring manually. When sslRequireValidServerCertificates is false, you do not need to set the sslTrustedServerCertificates setting because Cloud Manager will not verify the certificates.


Setting sslRequireValidServerCertificates to false makes connections between the Monitoring and MongoDB databases susceptible to man-in-the-middle attacks. Setting sslRequireValidServerCertificates to false is recommended only for testing and not for production.

Cloud Manager Server TLS Settings

Specify the settings the Monitoring Agent uses when communicating with Cloud Manager using TLS.


Type: string

Specifies the absolute path that contains the trusted CA certificates in PEM format. The Monitoring Agent uses this certificate to verify that the agent is communicating with the designated Cloud Manager instance.

By default, the Monitoring Agent uses the trusted root CAs installed on the system.

If the agent cannot find the trusted root CAs, configure these settings manually.


Deprecated Settings

MongoDB Authentication Settings

If all monitored MongoDB deployments use the same MONGODB-CR credentials, you may use these settings. Setting the username and password in the configuration file overrides any configuration in the Cloud Manager.

See Required Access for Monitoring Agent for information on the privileges needed for this user.


Type: string

Specifies the MongoDB username that the Monitoring Agent uses to connect.


This value overrides all other usernames configured for the Monitoring Agent.


Type: string

Specifies the password for the globalAuthUsername user.


This value overrides all other passwords configured for the Monitoring Agent.