> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # MongoDB Agent Settings This page describes possible settings for the MongoDB Agent. These values are set after first launching Cloud Manager and not through manual editing of these files. **Warning:** If you edit authentication or TLS (Transport Layer Security) settings through Settings or Deployments in the Cloud Manager interface, those changes overwrite any manual changes in this configuration file. ## Configuration File & Settings Locations ### Windows The location of the MongoDB Agent configuration file is `C:\MMSData\Automation\automation-agent.config`. **Note:** The MongoDB Agent configuration file is named `automation-agent.config` as a way to enable easier upgrades for those using legacy agents. You can configure additional [Monitoring settings](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#std-label-mongodb-agent-monitoring-settings) and [Backup settings](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#std-label-mongodb-agent-backup-settings) through the Cloud Manager Console. ## MongoDB Agent Settings The following settings are required. All other settings are set to default values. *Type*: string *Required*. Specifies the ID of your Cloud Manager project. To locate this value: In MongoDB Cloud Manager, go to the Agents page for your project. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Agents under the Database heading. The [Agents](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fdeployment%2Fagents%2Fall) page displays. Select the appropriate operating system under Downloads & Settings. To copy this value directly, in the Install Agent Instructions box, click . This setting is usually set when the MongoDB Agent is installed and is required to bind the server to a project. ```ini mmsGroupId=8zvbo2s2asigxvmpnkq5yexf ``` *Type*: string *Required*. Specifies the Cloud Manager agent API (Application Programming Interface) key of your Cloud Manager project. You can use an Agent API key that you have already generated for the project. Otherwise, you can generate a new Agent API key. A project can have more than one Agent API key, and any of the project's agents can use any of the keys. For more information, see [Manage Agent API Keys.](https://www.mongodb.com/docs/cloud-manager/tutorial/manage-agent-api-key.md) To generate an Agent API key, go to the Agent API Keys tab. To navigate to the tab: In MongoDB Cloud Manager, go to the Agents page for your project. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Agents under the Database heading. The [Agents](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fdeployment%2Fagents%2Fall) page displays. Click the Agent API Keys tab. **Important:** When you generate an Agent API Key, Cloud Manager displays it **one time only**. You must copy this key. Treat it like a password; store it in a secure place. Cloud Manager never displays the full key again. This setting is usually set when the MongoDB Agent is installed and is required to bind the server to a project. **Note:** To enable the MongoDB Agent to request the Agent API Key from a shell command, set the [`mmsApiKeyExec`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-mmsApiKeyExec) option in the configuration file rather than setting the [`mmsApiKey`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-mmsApiKey) option. ```ini mmsApiKey=8zvbo2s2asigxvmpnkq5yexf ``` *Type*: string Specifies the URL of the Cloud Manager. **Important:** This value is set by default and should not be modified. ```ini mmsBaseUrl=https://api-agents.mongodb.com ``` ### Logging Settings *Type*: string Specifies the path to which Cloud Manager should write the MongoDB Agent's log. The default path depends on your platform. The MongoDB Agent uses the default filename `automation-agent.log` whether or not the deployment uses Automation. **Important:** Automatic rotation of your MongoDB Agent logs only occurs when an update to the log file is made. To manually rotate your MongoDB Agent logs, see [Manually Rotate the MongoDB Agent Logs](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#std-label-manually-rotate-agent-logs) for more information. | Platform | Default Path | | --- | --- | | Linux | `/var/log/mongodb-mms-automation/automation-agent.log` | | Windows | `C:\MMSAutomation\log\mongodb-mms-automation\automation-agent.log` | ```ini logFile=/path/to/mongodb-mms-automation/automation-agent.log ``` *Type*: string Specifies the level of logging granularity. Choose from the following severity levels, from most to least amount of information: - `DEBUG` - `INFO` - `WARN` - `ERROR` - `FATAL` By default, [`logLevel`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-logLevel) is `INFO`. ```ini logLevel=ROUTINE ``` Each level includes the log items included in the succeeding levels. **Example:** - If you choose `DEBUG`, the MongoDB Agent logs all messages, including `INFO`, `WARN`, `ERROR` and `FATAL`. - If you choose `FATAL`, the MongoDB Agent only logs `FATAL` messages. *Type*: integer Specifies the maximum number of rotated log files to retain. By default, the value of [`maxLogFiles`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-maxLogFiles) is set to `10`. You can change the value to retain a different number of rotated log files. ```ini maxLogFiles=15 ``` *Type*: float Specifies the number of hours after which the logs are rotated. **Note: Manually Rotate the MongoDB Agent Logs** On UNIX- and Linux-based systems you can manually rotate the MongoDB Agent logs. Issue a `kill` command with the `SIGUSR1` signal for the Agent process: ```sh kill -SIGUSR1 ``` On Windows-based systems, you can manually restart the MongoDB Agent with a Service restart: 1. Click the Start menu. 2. Search for `services`. 3. Find the MongoDB Agent. 4. Right-click on the Agent and click Restart. This rotates the MongoDB Agent logs. *Type*: integer Specifies the maximum size, in bytes, of a log file before the logs are rotated. If unspecified, the MongoDB Agent does not rotate logs based on file size. By default, the value of [`maxLogFileSize`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-maxLogFileSize) is set to `268435456` bytes. You can change the value to assign a different maximum size for a log file. ```ini maxLogFileSize=536870912 ``` *Type*: integer Specifies the maximum number of rotated log files to keep uncompressed. MongoDB Agent automatically compresses any additional retained log files up to the [`maxLogFiles`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-maxLogFiles) value. By default, the value of [`maxUncompressedLogFiles`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-maxUncompressedLogFiles) is set to `2`. You can change the value to compress a different number of rotated log files. ```ini maxUncompressedLogFiles=10 ``` ### Connection Settings *Type*: integer Specifies the number of seconds to wait before a connection times out. By default, connections time out after 40 seconds. However, The MongoDB Agent may frequently time out of connections for one or more of the following reasons: - High network latency - High server load - Large TLS (Transport Layer Security) keys - Lack of TLS (Transport Layer Security) accelerator - Insufficient CPU speed MongoDB recommends gradually increasing the value of the [`dialTimeoutSeconds`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-dialTimeoutSeconds) MongoDB Agent configuration setting to prevent frequent premature connection timeouts. ```ini dialTimeoutSeconds=40 ``` **Note:** Increasing this value also increases the time required to deploy configuration changes to the MongoDB Agent. Experiment with small, incremental increases until you determine the optimum value for your deployment. *Type*: integer Specifies the number of seconds the MongoDB Agent waits before it stops trying to establish a connection to a MongoDB process. By default, the MongoDB Agent abandons attempts to establish a connection after 10 seconds. ```ini serverSelectionTimeoutSeconds=10 ``` ### HTTP Proxy Settings *Type*: string Specifies the URL (Uniform Resource Locator) of an HTTP (Hypertext Transfer Protocol) proxy server the MongoDB Agent can use. ```ini httpProxy=http://proxy.example.com:8080 ``` ### Configuration Backup Settings *Type*: string Specifies the path to the Cloud Manager [configuration](https://www.mongodb.com/docs/cloud-manager/reference/api/automation-config/automation-config-parameters.md#std-label-automation-configuration-sample-entity) backup file. This file describes the desired state of the deployment. If you don't specify the [`mmsConfigBackup`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-mmsConfigBackup) setting, the MongoDB Agent writes the `mongodb-mms-automation-cluster-backup.json` file to a temporary folder on the operating system. If you set [`enableLocalConfigurationServer`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-enableLocalConfigurationServer) to `true`, the MongoDB Agent doesn't write the [`mmsConfigBackup`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-mmsConfigBackup) file. ```ini mmsConfigBackup=/path/to/mms-cluster-config-backup.json ``` ### Cloud Manager TLS (Transport Layer Security) Settings Specify the settings that the MongoDB Agent uses when communicating with Cloud Manager using TLS (Transport Layer Security). *Type*: string Specifies the *absolute* path that contains the trusted Certificate Authority certificates in `PEM` format. This certificate verifies that the MongoDB Agent is talking to the designated Cloud Manager instance. ```ini httpsCAFile=/path/to/ca.pem ``` **Note:** Add the Certificate Authority for the `downloads.mongodb.com` certificate to this `.pem` file if you: 1. Need your MongoDB Agents to download their MongoDB installers from the Internet, 2. Use TLS to encrypt connections, and 3. Signed your certificates with a private Certificate Authority. (You set the `httpsCAFile` option.) To learn how to download TLS (Transport Layer Security) certificates from another web site, see the [OpenSSL Cookbook entry.](https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html#extracting-remote-certificates) **Important:** When Cloud Manager starts, it caches the Certificate Authority you provided. If you change your Certificate Authority certificate, restart Cloud Manager. *Type*: boolean **Important:** Deprecated. Use [`tlsRequireValidMMSServerCertificates`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-tlsRequireValidMMSServerCertificates) instead. *Type*: boolean Specifies if the MongoDB Agent should validate TLS (Transport Layer Security) certificates presented by Cloud Manager. **Warning:** Setting this option to `false` disables certificate verification and makes connections between the MongoDB Agent and Cloud Manager susceptible to *man-in-the-middle* attacks. Setting this option to `false` is only recommended for testing purposes. ```ini tlsRequireValidMMSServerCertificates=true ``` ### Push Live Migration Settings *Type*: boolean *Optional*. Specifies whether the MongoDB Agent on the [migration host](https://www.mongodb.com/docs/cloud-manager/reference/glossary.md#std-term-migration-host) is configured to run the [Live Migration](https://www.mongodb.com/docs/cloud-manager/tutorial/migrate-to-atlas.md) process from a source Cloud Manager deployment to a target cluster in Atlas. This option defaults to `false`, which prevents using the MongoDB Agent on this host for Live Migration to Atlas. To enable the Live Migration process, [provision a migration host](https://www.mongodb.com/docs/cloud-manager/tutorial/provision-migration-host.md) and set `agentFeatureCloudMigrationEnabled` to `true`. *Type*: string *Optional*. Path to the [oplog](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-oplog) files. If specified, this setting buffers the initial sync [oplog](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-oplog) window to disk. Provision enough storage in the specified directory for the [oplog](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-oplog) buffering. ### Externally Sourced Configuration Settings *Type*: boolean Specifies whether the MongoDB Agent stores MongoDB process configuration files on disk or cached in memory. This option defaults to `false`, which stores the configuration files on disk. Setting this option to `true` caches the configuration in memory. If you set this option to `true`, the MongoDB Agent doesn't write the [`mmsConfigBackup`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-mmsConfigBackup) file. Don't set this option to `true` if your MongoDB databases are running [`FCV`](https://www.mongodb.com/docs/manual/reference/command/setFeatureCompatibilityVersion.md#mongodb-dbcommand-dbcmd.setFeatureCompatibilityVersion) 4.2 or earlier. **Warning:** Setting this option to `true` impacts the availability of your deployment. When this feature is enabled, the MongoDB Agent doesn't store the MongoDB process configuration on disk. If the Cloud Manager app server is unavailable and the MongoDB Agent attempts to restart, then the MongoDB Agent stops running because it doesn't have the necessary configuration information. If a MongoDB process crashes while the MongoDB Agent isn't running, then the MongoDB Agent can't restart the process. ```ini enableLocalConfigurationServer=false ``` **See also:** [Configure How the MongoDB Agent Manages Config Files and Passwords](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-external-configuration.md) *Type*: boolean Flag that indicates whether the MongoDB Agent retains unused MongoDB version binaries that it downloads. By default, [`keepUnusedMongodbVersions`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-keepUnusedMongodbVersions) is false. ```ini keepUnusedMongodbVersions=false ``` *Type*: integer Specifies the port to serve the MongoDB process configuration to when using the local configuration server. To set this option, [`enableLocalConfigurationServer`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-setting-enableLocalConfigurationServer) must be `true`. If unspecified, the MongoDB Agent chooses an available port automatically. ```ini localConfigurationServerPort=20128 ``` *Type*: string Specifies a shell command to call the Cloud Manager agent API (Application Programming Interface) key of your Cloud Manager project. ```ini mmsApiKeyExec=echo $myKey ``` ### Transparent Huge Page (THP) Settings MongoDB Agent allows you to disable Transparent Huge Pages (THP) on a per-process basis to avoid accidental performance degradation. To disable THP, perform the following steps: 1. Upgrade the MongoDB Agent version to 108.0.x. 2. Modify the automation config file to include `enableAgentManagingTHPSettings=true`. 3. Restart the MongoDB Agent and the managed [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) and [`mongos`](https://www.mongodb.com/docs/manual/reference/program/mongos.md#mongodb-binary-bin.mongos) processes. You can now enable THP on a system-wide level. **Note:** This may generate a false positive start-up warning. 4. (Optional) Upgrade to 8.0. *Type:* boolean *Default*: false Specifies whether the MongoDB Agent should disable [Transparent Huge Pages (THP)](https://www.mongodb.com/docs/manual/tutorial/disable-transparent-huge-pages.md#std-label-disable-thp) for [`mongo`](https://www.mongodb.com/docs/manual/reference/mongo.md#mongodb-binary-bin.mongo) process versions before 8.0. The MongoDB Agent disables THP on a per [`mongo`](https://www.mongodb.com/docs/manual/reference/mongo.md#mongodb-binary-bin.mongo) process basis regardless of the OS-level THP settings. ## Automation Settings The following configuration settings are used for authentication in automated clusters. ### MongoDB Kerberos Settings Specify these settings if Automation authenticates to hosts using Kerberos. To configure Kerberos, see [Configure the MongoDB Agent for Kerberos.](https://www.mongodb.com/docs/cloud-manager/tutorial/configure-mongodb-agent-for-kerberos.md) *Type*: string Specifies an *absolute* path to an non-system-standard location for the Kerberos configuration file. ```ini krb5ConfigLocation=/path/to/krb_custom.conf ``` **Note:** Cloud Manager creates a Kerberos Credential (Ticket) Cache for each agent automatically when Kerberos is enabled. If you want to override the location of the [Kerberos Credential Cache](https://web.mit.edu/kerberos/krb5-latest/doc/basic/ccache_def.html), you must set the `KRB5CCNAME` environment variable to the desired file name and path before running the agent. *Type* string Specifies the `KRB5CC` environment variable that the MongoDB Agent sets for the Backup process. Used only to authenticate the Backup to your MongoDB deployment when the MongoDB Agent starts the Backup function. ```ini backupAgentKrb5CCName=/path/to/credentials_cache_file ``` *Type* string Specifies the `KRB5CC` environment variable that the MongoDB Agent sets for the Monitoring function. Used only to authenticate Monitoring to your MongoDB deployment when the MongoDB Agent starts the Monitoring function. ```ini monitoringAgentKrb5CCName=/path/to/credentials_cache_file ``` ## Monitoring Settings Use the Cloud Manager interface to configure Monitoring settings. ### Log Settings 1. In MongoDB Cloud Manager, go to the Agents page for your project. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Agents under the Database heading. The [Agents](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fdeployment%2Fagents%2Fall) page displays. 2. Edit the log settings. Click Downloads & Settings. In the Agent Log Settings section, click next to Monitoring Log Settings. Edit the Monitoring log settings: | Setting | Default Value | Console Suggested Value | | --- | --- | --- | | Linux Log File Path | `/var/log/mongodb-mms-automation/monitoring-agent.log` | | | Windows Log File Path | `%SystemDrive%\MMSAutomation\log\mongodb-mms-automation\monitoring-agent.log` | | | Rotate Logs | YES | | | Size Threshold (MB) | 1000 | | | Time Threshold (Hours) | 24 | | | Max Uncompressed Files | | 5 | | Max Percent of Disk | | 2 | | Total Number of Log Files | 0 | | Click Save. ### Custom Settings 1. In MongoDB Cloud Manager, go to the Agents page for your project. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Agents under the Database heading. The [Agents](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fdeployment%2Fagents%2Fall) page displays. 2. Edit the configuration. Click Downloads & Settings. In the Custom Configuration section, next to Edit Custom Configurations, click . Enter the Monitoring configuration setting and value. Click Save and Close. You can configure the following Monitoring settings: #### Connection Settings *Type*: string Specifies the ID of your Cloud Manager project. To find the project ID: 1. In MongoDB Cloud Manager, go to the Project Settings page. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Project Settings. The [Project Settings](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsettings%2FgroupSettings) page displays. ```ini mmsGroupId=8zvbo2s2asigxvmpnkq5yexf ``` *Type*: string Specifies the Cloud Manager agent API key of your Cloud Manager project. You can use an Agent API key that you have already generated for the project. Otherwise, you can generate a new Agent API key. A project can have more than one Agent API key, and any of the project's agents can use any of the keys. For more information, see [Manage Agent API Keys.](https://www.mongodb.com/docs/cloud-manager/tutorial/manage-agent-api-key.md) To generate an Agent API key, go to the Agent API Keys tab. To navigate to the tab: In MongoDB Cloud Manager, go to the Agents page for your project. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Agents under the Database heading. The [Agents](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fdeployment%2Fagents%2Fall) page displays. Click the Agent API Keys tab. **Important:** When you generate an Agent API Key, Cloud Manager displays it **one time only**. You must copy this key. Treat it like a password; store it in a secure place. Cloud Manager never displays the full key again. Cloud Manager configures this setting when you install the MongoDB Agent. If you need to configure Monitoring separately, include this setting. ```ini mmsApiKey=rgdte4w7wwbnds9nceuodx9mcte2zqem ``` *Type*: string Specifies the URL (Uniform Resource Locator) of the Cloud Manager. ```ini mmsBaseUrl=http://example.com:8080 ``` #### HTTP Proxy Settings *Type*: string Specifies the URL (Uniform Resource Locator) of an HTTP (Hypertext Transfer Protocol) proxy server that Monitoring can use. ```ini httpProxy=http://proxy.example.com:8080 ``` #### MongoDB Kerberos Settings Specify these settings if Monitoring authenticates to hosts using Kerberos. To configure Kerberos, see [Configure the MongoDB Agent for Kerberos](https://www.mongodb.com/docs/cloud-manager/tutorial/configure-mongodb-agent-for-kerberos.md). The same procedures and requirements apply, only use a different UPN (User Principal Name) for Monitoring. **Note:** Cloud Manager creates a Kerberos Credential (Ticket) Cache for each agent automatically when Kerberos is enabled. If you want to override the location of the [Kerberos Credential Cache](https://web.mit.edu/kerberos/krb5-latest/doc/basic/ccache_def.html), you must set the `KRB5CCNAME` environment variable to the desired file name and path before running the agent. *Type*: string Specifies the Kerberos principal that Monitoring uses. ```ini krb5Principal=monitoring/myhost@EXAMPLE.COM ``` *Type*: string Specifies the *absolute* path to Kerberos principal's `keytab` file. ```ini krb5Keytab=/path/to/mms-monitoring.keytab ``` *Type*: string Specifies the *absolute* path to an non-system-standard location for the Kerberos configuration file. ```ini krb5ConfigLocation=/path/to/krb_custom.conf ``` *Type*: string Specifies the service name with the [`gssapiServiceName`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-msetting-msetting.gssapiServiceName) setting. *By default, MongoDB uses* `mongodb` *as its service name.* #### MongoDB TLS Settings Specify these settings when Monitoring connects to MongoDB deployments using TLS (Transport Layer Security). To learn more, see [Configure MongoDB Agent to Use TLS.](https://www.mongodb.com/docs/cloud-manager/tutorial/configure-mongodb-agent-for-tls.md) *Type*: boolean Specifies whether or not to encrypt **all** connections to MongoDB deployments using TLS (Transport Layer Security). **Important:** Setting this to `true` overrides any per-host TLS (Transport Layer Security) settings configured in the Cloud Manager interface. *Type*: string Specifies the *absolute* path to the private key, client certificate, and optional intermediate certificates in PEM (Privacy-Enhanced Mail) format. Monitoring uses the client certificate to connect to any configured MongoDB deployment that uses TLS (Transport Layer Security) and requires client certificates. (The deployment runs with the [`--tlsCAFile`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#std-option-mongod.--tlsCAFile) setting.) **Example:** If you want to connect to a MongoDB deployment that uses both TLS (Transport Layer Security) and certificate validation using [`mongosh`:](https://www.mongodb.com/docs/mongodb-shell.md#mongodb-binary-bin.mongosh) ```sh mongosh --tls --tlsCertificateKeyFile /path/to/client.pem --tlsCAFile /path/to/ca.pem example.net:27017 ``` You must set these settings in your Custom Settings: ```ini sslTrustedServerCertificates=/path/to/ca.pem sslClientCertificate=/path/to/client.pem ``` *Type*: string Specifies the password needed to decrypt the private key in the [`sslClientCertificate`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-msetting-msetting.sslClientCertificate) file. Include this setting if you encrypted the client certificate PEM (Privacy-Enhanced Mail) file. ```ini sslClientCertificatePassword=password ``` *Type*: string Specifies the *absolute* path that contains the trusted Certificate Authority certificates in PEM (Privacy-Enhanced Mail) format. These certificates verify the server certificate returned from any MongoDB deployments running with TLS (Transport Layer Security). ```ini sslTrustedServerCertificates=/path/to/ca.pem ``` *Type*: boolean Specifies whether Monitoring should validate the TLS (Transport Layer Security) certificates presented by the MongoDB databases. ```ini sslRequireValidServerCertificates=true ``` By default, Cloud Manager sets [`sslRequireValidServerCertificates`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-msetting-msetting.sslRequireValidServerCertificates) to `true`. You need a valid trusted certificate to connect to MongoDB instances using TLS (Transport Layer Security). - If MongoDB Agent manages Monitoring, you can't set this option to `false`. - If you configure Monitoring manually, you *can* set [`sslRequireValidServerCertificates`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-msetting-msetting.sslRequireValidServerCertificates) to `false`. - If you set [`sslRequireValidServerCertificates`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-msetting-msetting.sslRequireValidServerCertificates) to `false`, don't set [`sslTrustedServerCertificates`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-msetting-msetting.sslTrustedServerCertificates). Cloud Manager won't verify the certificates. **Warning:** Changing this setting to `false` disables certificate verification and makes connections between Monitoring and MongoDB deployments susceptible to *man-in-the-middle* attacks. Change this setting to `false` only for testing purposes. #### Cloud Manager Server TLS Settings Specify the settings Monitoring uses when communicating with Cloud Manager using TLS (Transport Layer Security). *Type*: string Specifies the *absolute* path that contains the trusted Certificate Authority certificates in PEM (Privacy-Enhanced Mail) format. Monitoring uses this certificate to verify that the agent can communicate with the designated Cloud Manager instance. *By default, Monitoring uses the trusted root* Certificate Authoritys *installed on the host.* If the agent cannot find the trusted root Certificate Authoritys, configure these settings manually. ```ini httpsCAFile=/path/to/mms-certs.pem ``` ## Backup Settings Use the Cloud Manager interface to configure Backup settings. ### Log Settings 1. In MongoDB Cloud Manager, go to the Agents page for your project. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Agents under the Database heading. The [Agents](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fdeployment%2Fagents%2Fall) page displays. 2. Edit the log settings. Click Downloads & Settings. In the Agent Log Settings section, click next to Backup Log Settings. Edit the Backup log settings: | Setting | Default Value | Console Suggested Value | | --- | --- | --- | | Linux Log File Path | `/var/log/mongodb-mms-automation/backup-agent.log` | | | Windows Log File Path | `%SystemDrive%\MMSAutomation\log\mongodb-mms-automation\backup-agent.log` | | | Rotate Logs | YES | | | Size Threshold (MB) | 1000 | | | Time Threshold (Hours) | 24 | | | Max Uncompressed Files | | 5 | | Max Percent of Disk | | 2 | | Total Number of Log Files | 0 | | Click Save. ### Custom Settings 1. In MongoDB Cloud Manager, go to the Agents page for your project. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Agents under the Database heading. The [Agents](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fdeployment%2Fagents%2Fall) page displays. 2. Edit the configuration. Click Downloads & Settings. In the Custom Configuration section, next to Edit Custom Configurations, click . Enter a Backup configuration setting and value. Click Save and Close. You can configure the following Backup settings: #### Connection Settings *Type*: string Specifies the ID of your Cloud Manager project. To find the project ID: 1. In MongoDB Cloud Manager, go to the Project Settings page. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Project Settings. The [Project Settings](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsettings%2FgroupSettings) page displays. ```ini mmsGroupId=8zvbo2s2asigxvmpnkq5yexf ``` *Type*: string Specifies the MongoDB Agent API (Application Programming Interface) key of your Cloud Manager project. You can use an Agent API key that you have already generated for the project. Otherwise, you can generate a new Agent API key. A project can have more than one Agent API key, and any of the project's agents can use any of the keys. For more information, see [Manage Agent API Keys.](https://www.mongodb.com/docs/cloud-manager/tutorial/manage-agent-api-key.md) To generate an Agent API key, go to the Agent API Keys tab. To navigate to the tab: In MongoDB Cloud Manager, go to the Agents page for your project. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Agents under the Database heading. The [Agents](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fdeployment%2Fagents%2Fall) page displays. Click the Agent API Keys tab. **Important:** When you generate an Agent API Key, Cloud Manager displays it **one time only**. You must copy this key. Treat it like a password; store it in a secure place. Cloud Manager never displays the full key again. Cloud Manager configures this setting when you install the MongoDB Agent. If you need to configure Backup separately, include this setting. ```ini mmsApiKey=rgdte4w7wwbnds9nceuodx9mcte2zqem ``` *Type*: string Specifies the hostname and port of the Cloud Manager used by the Backup agent. **Note:** Don't include the protocol (`http://` or `https://`) in the [`mothership`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-bsetting-bsetting.mothership) setting. ```ini mothership=example.com:8080 ``` *Type*: integer Specifies the length of time in seconds Backup waits for the Cloud Manager to respond. If the MongoDB Agent doesn't get a response, it resets and retries the connection to the Cloud Manager. This value defaults to `90` seconds. *Type*: integer Specifies the length of time, in milliseconds, that a socket between Backup and Cloud Manager can remain idle before Cloud Manager breaks the connection. If omitted, defaults to `180000` milliseconds (`3` minutes). *Type*: boolean Specifies whether or not communication with the Cloud Manager web server uses Secure HTTP (Hypertext Transfer Protocol). #### HTTP Proxy Settings *Type*: string Specifies the URL (Uniform Resource Locator) of an HTTP (Hypertext Transfer Protocol) proxy that Backup can use. ```ini httpProxy=http://proxy.example.com:8080 ``` #### MongoDB Kerberos Settings To configure Kerberos, see [Configure the MongoDB Agent for Kerberos](https://www.mongodb.com/docs/cloud-manager/tutorial/configure-mongodb-agent-for-kerberos.md). The same procedures and requirements apply, only use a different UPN (User Principal Name) for Backup. **Note:** Cloud Manager creates a Kerberos Credential (Ticket) Cache for each agent automatically when Kerberos is enabled. If you want to override the location of the [Kerberos Credential Cache](https://web.mit.edu/kerberos/krb5-latest/doc/basic/ccache_def.html), you must set the `KRB5CCNAME` environment variable to the desired file name and path before running the agent. *Type*: string Specifies the Kerberos principal that Backup uses. ```ini krb5Principal=backup/myhost@EXAMPLE.COM ``` *Type*: string Specifies the *absolute* path to Kerberos principal's keytab file. ```ini krb5Keytab=/path/to/mms-backup.keytab ``` *Type*: string Specifies the *absolute* path to an non-system-standard location for the Kerberos configuration file. ```ini krb5ConfigLocation=/path/to/krb_custom.conf ``` *Type*: string Specifies the service name with the [`gsapiServiceName`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-bsetting-bsetting.gsapiServiceName) setting. *By default, MongoDB uses* `mongodb` *as its service name.* #### MongoDB TLS Settings Specify these settings when Backup connects to MongoDB deployments using TLS (Transport Layer Security). To learn more, see [Configure MongoDB Agent to Use TLS.](https://www.mongodb.com/docs/cloud-manager/tutorial/configure-mongodb-agent-for-tls.md) *Type*: string Specifies the path to the private key, client certificate, and optional intermediate certificates in PEM (Privacy-Enhanced Mail) format. Backup uses the client certificate when connecting to a MongoDB deployment that uses TLS (Transport Layer Security) and requires client certificates. (The deployment runs with the [`--tlsCAFile`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#std-option-mongod.--tlsCAFile) setting.) *Type*: string Specifies the password needed to decrypt the private key in the [`sslClientCertificate`](https://www.mongodb.com/docs/cloud-manager/reference/mongodb-agent-settings.md#mongodb-bsetting-bsetting.sslClientCertificate) file. Include this setting if you encrypted the client certificate PEM (Privacy-Enhanced Mail) file. *Type*: string Specifies the path that contains the trusted CA certificates in PEM (Privacy-Enhanced Mail) format. These certificates verify the server certificate returned from any MongoDB deployments running with TLS (Transport Layer Security). ```ini sslTrustedServerCertificates=/path/to/mongodb-certs.pem ``` *Type*: boolean Specifies if Backup should validate TLS (Transport Layer Security) certificates presented by the MongoDB deployments. **Warning:** Changing this setting to `false` disables certificate verification and makes connections between Backup and MongoDB deployments susceptible to *man-in-the-middle* attacks. Change this setting to `false` only for testing purposes. #### Cloud Manager Server TLS Settings Specify the settings Backup use when communicating with Cloud Manager using TLS (Transport Layer Security). Specifies the *absolute* path that contains the trusted Certificate Authority certificates in PEM (Privacy-Enhanced Mail) format. Backup uses this certificate to verify that the MongoDB Agent can communicate with the designated Cloud Manager instance. *By default, Backup uses the trusted root* Certificate Authoritys *installed on the system.* If Backup cannot find the trusted root Certificate Authoritys, configure these settings manually. If Cloud Manager use a self-signed TLS (Transport Layer Security) certificate, provide a value for this setting. ```ini sslTrustedMMSBackupServerCertificate=/path/to/mms-certs.pem ```