231 results found

1. Add flexibility to disable and enable specific fetures of managing mongodb instance in OPS Manager (like user Sync)

   Currently , Mongodb admin can not select to disable or enable feature after put mongodb manageed under OPS Manager. like security control .

   Normally , Security control is not mongodb or Ops manager admin's responsibility , which is managed by a enterprice access control team.

   1 , In opsmanager , there is not role for security control, like useradmin in mongodb.
   2 , When ACCESS control team create role in mongodb. Ops Manager sycn it back.
   3 , Opsmanager admin have to be engaged to work with ACCESS control team to complete the task.

   It is kind of not least previledge and seperation of duty.

   I would suggest to provide a feature to give Flexibility to disable and enable specific features of managing mongodb instance in OPS Manager (like user Sync), and other features, like configuration. Have parameter should be fine.

   Currently , Mongodb admin can not select to disable or enable feature after put mongodb manageed under OPS Manager. like security control .

   Normally , Security control is not mongodb or Ops manager admin's responsibility , which is managed by a enterprice access control team.

   1 , In opsmanager , there is not role for security control, like useradmin in mongodb.
   2 , When ACCESS control team create role in mongodb. Ops Manager sycn it back.
   3 , Opsmanager admin have to be engaged to work with ACCESS control team to complete the task.

   It is kind of not least… more

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   2 comments  ·  Ops Manager  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

2. ops manager agent support for Rocky Linux

   Ops manager and Mongodb work on Rocky, but it seems there is no option for Rocky in the Ops Manager agent manifest, the current agent detects no Linux flavor for Rocky Linux. This already works on RHEL/CentOS and Rocky is supposed to be fully compatible with these OS's.

   4 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Ops Manager  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

3. Set log file permissions using Ops Manager

   Currently there is no way to set the log file permissions from Ops Manager and the default value is 600. Our organization uses Splunk and with the current settings the Splunk user is not able to read the log files. Config file options such as processUmask and honorSystemUmask can be used to change the log file permissions, but they will also change other files such as journal files, wiredtiger files, etc. The only option we have is to add the Splunk user to our role group in Unix, but this causes a security issue.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

4. “Content-Security-Policy” header

   Hello,

   We want to add the “Content-Security-Policy” header to the OpsManager/MongoDB answers to increase the security level:

   frame-ancestors 'none' (Do not render in frames)
   script-src 'self': only loads scripts originating on the site (subdomains excluded)
   default-src 'none': recommended for services returning HTML.
   Could you please tell us how to set up these elements ?

   Thank you in advance for your support.

   Regards

   7 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Ops Manager  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

5. OPS Manager should call updateUser to change password to trace it in DB Audit.

   If you enable auditing in database, you can't trace change password actions. The reason is OPS Manager updates system.user collection record directly. as a result, this action is not traceble in audit if parameter auditAuthorizationSuccess is not enabled.

   But enabling this parameter cause performance degradation as all DML/DDL will be sent through audit layer.

   Dropping user at the same time happening as expected and traceable in audit files.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

6. Agent authentication to opsmanager using x509 credentials

   Similar to how Opsmanger can use x509 to manage deployments, it should be possible to configure the agents to use x509 credentials to communicate with Opsmanager. This will allow for a more consistent security posture across the whole mongodb/opsmanager stack. It would also simplify security procedures such as credential rotation by unifying the authentication mechanism.

   This will be an alternative to the existing API Key approach https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-agent-api-key/index.html

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

7. Ability to remove parameter tlsCertificateKeyFilePassword from Advanced configuration

   Currently the behavior around this parameter is tricky -once you added this parameter to advanced config - you can't remove it. if you try to remove it - OPS Manager simply ignores this action and when you run "Review and Deploy" - it displays nothing but still let you deploy this "nothing". similar if you want to set the value of this parameter to empty string from something - OPS Manager ignores it and deploy empty list of actions.

   the workaround is to remove both tlsCertificateKeyFile and tlsCertificateKeyFilePassword in advanced config, but don't deploy it. then add back tlsCertificateKeyFile parameter with original value and now OPS Manager understands what do you want.

   Currently the behavior around this parameter is tricky -once you added this parameter to advanced config - you can't remove it. if you try to remove it - OPS Manager simply ignores this action and when you run "Review and Deploy" - it displays nothing but still let you deploy this "nothing". similar if you want to set the value of this parameter to empty string from something - OPS Manager ignores it and deploy empty list of actions.

   the workaround is to remove both tlsCertificateKeyFile and tlsCertificateKeyFilePassword in advanced config, but don't deploy it. then add back tlsCertificateKeyFile parameter… more

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

8. Ops Manager API should be authenticated via Certificate

   Ops Manager API uses HTTP Digest Authentication, this method requires a username and a password which are hashed and provided in the form of registered Ops Manager account, and the password which is a Public API Key associated with that account.

   But as part of security feature we should be allowed to use Authentication based on SSL certificates as we are using for Client connection, This will help to secure the self automation process if we are developing any internally.

   3 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Ops Manager  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

9. When changing snapshot retention, prompt user to apply new policy to existing snapshots

   Currently when you change the snapshot schedule, the changes only apply to NEW snapshots.

   Please allow the user the option to apply the new policy automatically to all existing snapshots. Or at the very least, notify them of them of snapshots that exist which do not meet the current policy!

   ---

   Let me provide an example of the problem. If you have a retention policy of 10 days and on DAY1 you change it to 30 days, your retention will look like this:

   DAY1 - 10 snapshots
   DAY2 - 10 snapshots
   ...
   DAY10 - 10 snapshots
   DAY11 - 11 snapshots
   DAY12 - 12 snapshots
   ...
   DAY30 - 30 snapshots

   It takes 30 days to build up to the desired number of retained snapshots, even though you already had 10 perfectly good snapshots you could have kept if their expiration was bumped to creationTime+30d.

   ---

   This problem exists in other direction, too. Let's say you reduce your retention from 30d to 10d, it will look like this:

   DAY1 - 30 snapshots
   DAY2 - 29 snapshots
   ...
   DAY15 - 25 snapshots (15 of them are 15+ days old!)
   DAY16 - 24 snapshots
   ...
   DAY20 - 20 snapshots (10 are 20+ days old!)
   ...
   DAY30 - 10 snapshots

   At DAY20 you have snapshots from 1-10 days and 20-30 days ago, with a wonky gap between 20-30 days.

   Currently when you change the snapshot schedule, the changes only apply to NEW snapshots.

   Please allow the user the option to apply the new policy automatically to all existing snapshots. Or at the very least, notify them of them of snapshots that exist which do not meet the current policy!

   ---

   Let me provide an example of the problem. If you have a retention policy of 10 days and on DAY1 you change it to 30 days, your retention will look like this:

   DAY1 - 10 snapshots
   DAY2 - 10 snapshots
   ...
   DAY10 - 10 snapshots
   DAY11 - 11 snapshots
   DAY12… more

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

10. Lock enableLocalConfigurationServer setting on OPS Manager side

    To harden security for mongodb deployment managed by OPS Manager, we can use setting enableLocalConfigurationServer = true so automation-mongod.conf won't have any passwords for ssl certs and agent will retrieve them from OPS Manager.

    to disable this feature and to read all passwords for ssl certs (and hence get access to mongodb data) it's enough to comment out this parameter an restart automation service (or wait until host will be restarted).

    Linux root user can modify any file on mongodb host including this file and can restart any services, so it's impossible to protect getting all passwords and mongod.conf from root user only using Linux functionality.

    But it's possible to add feature in OPS Manager to "lock automation agent setting for enableLocalConfigurationServer" on OPS Manager side.

    Even if root comments out/disables this setting, automation agent will request full config file from OPS Manager and OPS Manager will check on its side if it's allowed to send full config back to agent.

    i.e. only MongoDB DBA who manages deployment from OPS Manager controls if full config with all password should be sent to host and Linux root user won't be able on their own retrieve passwords.

    To harden security for mongodb deployment managed by OPS Manager, we can use setting enableLocalConfigurationServer = true so automation-mongod.conf won't have any passwords for ssl certs and agent will retrieve them from OPS Manager.

    to disable this feature and to read all passwords for ssl certs (and hence get access to mongodb data) it's enough to comment out this parameter an restart automation service (or wait until host will be restarted).

    Linux root user can modify any file on mongodb host including this file and can restart any services, so it's impossible to protect getting all passwords and mongod.conf from… more

    1 vote

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

11. The Ops Manager UI provide an option to trigger election (stepDown)

    Have the option to perform primary stepDown from Ops Manager UI to trigger election

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

12. I found what I believe to be an error in the following document

    I found what I believe to be an error in the following document.
    https://www.mongodb.com/docs/ops-manager/current/tutorial/install-simple-test-deployment/

    In the section "5. Create the Ops Manager Application Database directory," it instructs to execute the following command
    sudo chown -R mongod:mongod /data

    In my environment, the mongod user does not exist and I get an error, but looking at the passwd file, the mongodb user and mongodb group seem to exist. The version is 11.7.

    I think the correct command is as follows
    sudo chown -R mongodb:mongodb /data

    1 vote

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

13. Operating System distribution and version of a host in OPS Manager API

    Hi,
    would be useful having the operating system distribution and version of a host for our automation scripts.
    This info is not available in any OPS Manager API request, as the case 01119828.
    My suggestion is add this info at "Get Host by ID" https://www.mongodb.com/docs/ops-manager/current/reference/api/hosts/get-one-host-by-id/
    Best regards,
    Danilo

    1 vote

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

14. Ability to mark a deployment as an INELIGIBLE restore target

    Restoring to a cluster is one of the few destructive actions that Ops Manager takes and it's terrifying to see our main production cluster listed as a possible restore target!

    I would love to be able to toggle a setting on this cluster to indicate that it is NOT available as a restore target.

    This could be similar to the AWS "DisableApiTermination" feature that prevents instance termination.
    https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination

    1 vote

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

15. Ops Manager Load Balancer

    In the same way we can connect to a replica set via a connection string containing the 3 hostnames of the members (in a 3 member replica set) which indicates some load balancing built in, it would be good to allow automation agent's mmsBaseUrl parameter to accept 3 Ops Manager web app hostnames if Ops Manager was running in 3 nodes on top of a 3 member replica set OM Application DB. With this, if one of the 3 Ops Manager web apps fails, the agent's connection to OM will be uninterrupted. Currently we will have to configure our own load balancer, or manually update the agent's mmsBaseUrl if the current OM fails both of which are tedious setups.

    In the same way we can connect to a replica set via a connection string containing the 3 hostnames of the members (in a 3 member replica set) which indicates some load balancing built in, it would be good to allow automation agent's mmsBaseUrl parameter to accept 3 Ops Manager web app hostnames if Ops Manager was running in 3 nodes on top of a 3 member replica set OM Application DB. With this, if one of the 3 Ops Manager web apps fails, the agent's connection to OM will be uninterrupted. Currently we will have to configure our own… more

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

16. Add recommended ulimit settings to the systemctl service definition

    The Ops Manager documentation recommends higher than default ulimit settings, so why not include these in the systemctl service definition?

    https://www.mongodb.com/docs/ops-manager/current/core/requirements/index.html#ulimits-requirements-for-application

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

17. Deploy Changes without restarting mongod/mongos instance immediately.

    Whenever we want to make changes, eg. set a new parameter or add new parameter in configuration (advance configuration options), after we save changes, review and deploy, automation immediately starts applying that change and does a rolling restart.
    We need flexibility in restart, means one should have an option to perform immediate rolling restart or defer it to later time. We may apply multiple changes at different times and set one preferred window to restart instance instead of doing multiple restarts.

    15 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    2 comments  ·  Ops Manager  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

18. Ability to start the bi connector using a .drdl file in Ops Manager

    Ability to start the bi connector using a .drdl file in Ops Manager. Currently only possible with en premise bi connector deployment(mongosqld).

    1 vote

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

19. Add possibility to configure the process hostnames for the automation config map

    In order to use external certificates could it be possible to configure the process hostnames in automation config map

    1 vote

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

20. TLS secret key config

    Add option to configure the secret keys for the server and CA certificate and replace the default ones tls.crt, tls.key and ca.crt

    1 vote

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Ops Manager  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close