- Create or Import a MongoDB Deployment >
- Add Existing MongoDB Processes to Ops Manager
Add Existing MongoDB Processes to Ops Manager¶
On this page
Ops Manager provides a wizard for adding your existing MongoDB deployments to monitoring and management. The wizard prompts you to install an Automation if none exists, and then prompts you to identify the cluster, the replica set, or the standalone to add. You can choose to add the deployment to Monitoring or to both Monitoring and Automation.
Considerations¶
Unique Names¶
Deployments must have unique names within the projects.
Important
Replica set, sharded cluster, and shard names within the same project must be unique. Failure to have unique names for the deployments will result in broken backup snapshots.
MongoDB Configuration Options¶
Automation does not support all MongoDB options. To review which options are supported, see MongoDB Settings that Automation Supports.
TLS¶
If you enable TLS, the FQDN for the host serving a MongoDB process must match the SAN for the TLS certificate on that host.
Caution
Though you can use one TLS certificate with many SANs or a wildcard TLS certificate on each host, you should not. You should follow RFC 2818, section 3.1: keep the scope of TLS certificates as narrow as possible. This prevents man-in-the-middle attacks.
Preferred Hostnames¶
Set up a preferred hostname if you:
- Require a specific hostname, FQDN, IPv4 address or IPv6 address to access the MongoDB process, or
- Must specify the hostname to use for hosts with multiple aliases.
To learn more, see the Preferred Hostnames setting in General Settings.
Restore a Previously Removed Host¶
If you have not completely removed a host from Ops Manager and want to restore that host, you can reimport the deleted MongoDB process.
If you have completely removed a host from Ops Manager, you need to
undelete that host first. To search for a deleted host, you
must have the Global Owner
role.
To locate and undelete a previously deleted host:
- Navigate to the Deployment view.
- From the More menu, click Deleted Hosts.
- Select the trash icon to undelete the host.
After the host has been undeleted, you can import existing process procedure.
Note
If your host does not appear in the Deleted Hosts list, you should be able to reimport the process immediately.
Managing Windows MongoDB Services¶
If you are adding an existing MongoDB process that runs as a Windows Service to Automation, Automation:
- Stops and disables the existing service
- Creates and starts a new service
Authentication¶
If the Ops Manager project has MongoDB authentication settings enabled for its deployments, the MongoDB deployment to import must support the project’s authentication mechanism.
When Adding a Deployment to Be Monitored but not Managed¶
If your MongoDB deployment requires authentication, you must provide the necessary credentials for monitoring when adding the deployment to Ops Manager.
If the deployment does not use Automation, but did use Backup, Monitoring, or both, you can find those credentials where the credentials were before updating to the MongoDB Agent.
If the deployment does not use Automation, but will use Backup, Monitoring, or both, you must add the credentials you granted those functions to Ops Manager:
For Monitoring:
Navigate to Deployment arrow right icon <deployment> arrow right icon arrow right icon Monitoring Settings.
Click Credentials.
Add the appropriate credentials:
- SCRAM-SHA
- LDAP
- Kerberos
- X.509
Setting Value Monitoring Username Enter the Monitoring username. Monitoring Password Enter the password for Monitoring Username. Setting Value Monitoring LDAP Username Enter the LDAP username. Monitoring LDAP Password Enter the password for Monitoring’s LDAP Username. Monitoring LDAP Group DN Enter the Distinguished Name for the Monitoring’s LDAP Group.
Note
Provide the Monitoring’s LDAP Group DN only if you use LDAP Authorization. Each Monitoring should have and use its own LDAP Group DN.
The required values depend upon whether you are connecting to a Linux-served KDC or Windows Active Directory Server.
- Linux KDC
- Windows Active Directory
Setting Value Monitoring Kerberos Principal Kerberos Principal. Monitoring Keytab Path Absolute file Ppath to the Monitoring’s Keytab. Monitoring LDAP Group DN Enter the Distinguished Name for the Monitoring’s LDAP Group.
The LDAP Group DN is then created as a role in MongoDB to grant the Monitoring the appropriate privileges.
Note
You only need to provide the LDAP Group DN if you use LDAP Authorization.
Setting Value Monitoring Username Active Directory user name. Monitoring Password Active Directory password. Domain NetBIOS name of a domain in Active Directory Domain Services. Must be in all capital letters. Setting Value Monitoring Username Enter the LDAPv3 distinguished name derived from the Monitoring’s PEM Key file. Monitoring PEM Key file Provide the path and filename for the Monitoring’s PEM Key file on the server on the line for the appropriate operating system. Monitoring PEM Key Password Provide the password to the PEM Key file if it was encrypted. Monitoring LDAP Group DN Enter the Distinguished Name for the Monitoring’s LDAP Group.
Note
You only need to provide the Monitoring’s LDAP Group DN if you use LDAP Authorization.
For Backup:
Navigate to Backup arrow right icon <backup-deployment> arrow right icon arrow right icon Edit Credentials.
Click Credentials.
Add the appropriate credentials:
- SCRAM-SHA
- LDAP
- Kerberos
- X.509
Setting Value Backup Username Enter the Backup username. Backup Password Enter the password for Backup Username. Setting Value Backup LDAP Username Enter the LDAP username. Backup LDAP Password Enter the password for Backup’s LDAP Username. Backup LDAP Group DN Enter the Distinguished Name for the Backup’s LDAP Group.
Note
Provide the Backup’s LDAP Group DN only if you use LDAP Authorization. Each Backup should have and use its own LDAP Group DN.
The required values depend upon whether you are connecting to a Linux-served KDC or Windows Active Directory Server.
- Linux KDC
- Windows Active Directory
Setting Value Monitoring Kerberos Principal Kerberos Principal. Monitoring Keytab Path Absolute file Ppath to the Backup’s Keytab. Monitoring LDAP Group DN Enter the Distinguished Name for the Backup’s LDAP Group.
The LDAP Group DN is then created as a role in MongoDB to grant the Backup the appropriate privileges.
Note
You only need to provide the LDAP Group DN if you use LDAP Authorization.
Setting Value Backup Username Active Directory user name. Backup Password Active Directory password. Domain NetBIOS name of a domain in Active Directory Domain Services. Must be in all capital letters. Setting Value Backup Username Enter the LDAPv3 distinguished name derived from the Backup’s PEM Key file. Backup PEM Key file Provide the path and filename for the Backup’s PEM Key file on the server on the line for the appropriate operating system. Backup PEM Key Password Provide the password to the PEM Key file if it was encrypted. Backup LDAP Group DN Enter the Distinguished Name for the Backup’s LDAP Group.
Note
You only need to provide Backup’s LDAP Group DN if you use LDAP Authorization.
When Adding a Deployment to be Managed¶
If the deployment uses Automation, Ops Manager uses the credentials from the legacy Automation Agent. You can delete the credentials from the legacy Backup, and Monitoring Agents. The MongoDB Agent uses those credentials for its Automation, Backup, and Monitoring functions.
If the deployment will use Automation but did not prior to being imported, you need to:
Add the MongoDB Agent user to your databases.
Add the MongoDB Agent user to Ops Manager:
- Navigate to Deployment arrow right icon Security arrow right icon Edit Settings arrow right icon Edit Credentials.
- Continue through the modal until you see the Configure Ops Manager Agents page
Add the appropriate credentials:
- SCRAM-SHA
- LDAP
- Kerberos
- X.509
Setting Value MongoDB Agent Username Enter the MongoDB Agent username. MongoDB Agent Password Enter the password for MongoDB Agent Username. Setting Value MongoDB Agent LDAP Username Enter the LDAP username. MongoDB Agent LDAP Password Enter the password for MongoDB Agent’s LDAP Username. MongoDB Agent LDAP Group DN Enter the Distinguished Name for the MongoDB Agent’s LDAP Group.
Note
Provide the MongoDB Agent’s LDAP Group DN only if you use LDAP Authorization. Each MongoDB Agent should have and use its own LDAP Group DN.
The required values depend upon whether you are connecting to a Linux-served KDC or Windows Active Directory Server.
- Linux KDC
- Windows Active Directory
Setting Value Monitoring Kerberos Principal Kerberos Principal. Monitoring Keytab Path Absolute file Ppath to the MongoDB Agent’s Keytab. Monitoring LDAP Group DN Enter the Distinguished Name for the MongoDB Agent’s LDAP Group.
The LDAP Group DN is then created as a role in MongoDB to grant the MongoDB Agent the appropriate privileges.
Note
You only need to provide the LDAP Group DN if you use LDAP Authorization.
Setting Value MongoDB Agent Username Active Directory user name. MongoDB Agent Password Active Directory password. Domain NetBIOS name of a domain in Active Directory Domain Services. Must be in all capital letters. Setting Value MongoDB Agent Username Enter the LDAPv3 distinguished name derived from the MongoDB Agent’s PEM Key file. MongoDB Agent PEM Key file Provide the path and filename for the MongoDB Agent’s PEM Key file on the server on the line for the appropriate operating system. MongoDB Agent PEM Key Password Provide the password to the PEM Key file if it was encrypted. MongoDB Agent LDAP Group DN Enter the Distinguished Name for the MongoDB Agent’s LDAP Group.
Note
You only need to provide MongoDB Agent’s LDAP Group DN if you use LDAP Authorization.
Automation and Updated Security Settings Upon Import¶
Adding a MongoDB deployment to automation may affect the security settings of the Ops Manager project or the MongoDB deployment or both.
Enables Ops Manager Project Security Setting¶
If the MongoDB deployment requires authentication but the Ops Manager project does not have authentication settings enabled, upon successful addition of the MongoDB deployment to automation, the project’s security settings will have the security settings of the newly imported deployment.
Note
The import process only enables the Ops Manager project’s security setting if the project’s security setting is currently not enabled. If the project’s security setting is currently enabled, the import process does not disable the project’s security setting or change its enabled authentication mechanism.
Imports MongoDB Users and Roles¶
Note
The following applies for situations where at least either the MongoDB deployment requires authentication or the Ops Manager project has authentication settings enabled.
If the MongoDB deployment contains users or user-defined roles, you can choose to import these users and roles for Ops Manager to manage. The imported users and roles are Synced to all managed deployments in the Ops Manager project.
If the Enforce Consistent Set
value for the Ops Manager project is YES
,
users and roles not imported are deleted from the MongoDB deployment.
If the Enforce Consistent Set
value for the Ops Manager project is No
,
non-imported users and roles are not managed by Ops Manager project but remain
in the MongoDB deployment. To manage these users and roles, you must
connect directly to the MongoDB deployment.
If importing users and roles, before you confirm and deploy the changes, you can, from the Authentication & Users and Authentication & Roles screens, remove specific users and roles from being imported by unmanaging these users. For details on unmanaging MongoDB users, see Manage or Unmanage MongoDB Users.
If the imported MongoDB deployment already has mms-backup-agent
and
mms-monitoring-agent
users in its admin
database, the import
procedure overrides the roles of these users with the roles for
mms-backup-agent
and mms-monitoring-agent
users as set in the
Ops Manager project.
Applies to All Deployments in Ops Manager Project¶
The project’s updated security settings, including all users and roles managed as part of the Ops Manager project, apply to all deployments in the project, including the imported MongoDB deployment.
Ops Manager restarts all deployments in the project with the new setting, including the imported MongoDB deployment. All deployments in the project will use the Ops Manager automation keyfile upon restart.
If the existing deployment or deployments in the project require a different security profile from the imported process, create a new project into which you can import the MongoDB deployment.
Examples of Imported Users¶
Note
The following applies for situations where at least either the MongoDB deployment requires authentication or the Ops Manager project has authentication settings enabled.
If you choose to import the MongoDB users and custom roles, once Ops Manager
project manages the MongoDB deployment, regardless of the value of Enforce
Consistent Set
:
Enforce Consistent Set |
Results |
---|---|
Yes or No |
|
If you choose not to import the users, once Ops Manager project manages the MongoDB deployment:
Enforce Consistent Set |
Results |
---|---|
Yes |
|
No |
|
Prerequisites¶
If the Ops Manager project does not have authentication settings enabled, but the MongoDB process requires authentication, add the MongoDB Agent user for the Ops Manager project with the appropriate roles.
- The import process displays the required roles for the user.
- The added user becomes the project’s MongoDB Agent user.
If the Ops Manager project has authentication settings enabled, add the Ops Manager project’s MongoDB Agent user to the MongoDB process.
To find the MongoDB Agent user, click Deployments, then Security, then Users.
To find the password for the Ops Manager project’s MongoDB Agent user, you can use the UI, the API or the configuration backup file:
- Using the UI
Navigate to Deployment, Security, and then Authentication & TLS/SSL
Click Edit Settings.
Click Next until you see the Configure Ops Manager Agents page.
Click Show to the right of the MongoDB Agent Password field.
The MongoDB Agent’s password displays.
- Using the API
Use the Automation Configuration Resource endpoint:
- Using the Ops Manager Configuration Backup file
Open the
mmsConfigBackup
file in your preferred text editor and find theautoPwd
value.
Example
If the Ops Manager project has
Username/Password
mechanism selected for its authentication settings, add the
project’s Ops Manager MongoDB Agents User mms-automation
to the
admin
database in the MongoDB deployment to import.
Important
If you are adding a sharded cluster, you must create this user through the mongos and on every shard. That is, create the user both as a cluster wide user through mongos as well as a shard local user on each shard.