Monitoring: Security Concerns

• The monitoring views and endpoints are protected like the rest of RavenDB: on a secure server, access requires a client certificate with a sufficient security clearance.

• Some monitoring channels are enabled by specific license features.

• This page lists the clearance each monitoring view and endpoint requires, the license features some of them depend on, and exposure considerations.

• In this article:

  • Access control
  • License requirements
  • Exposure considerations

Access control

On a secure server, the monitoring views and endpoints require a client certificate.
The table below lists the security clearance the certificate needs for each view and endpoint:

View or endpoint	Required clearance
JSON monitoring endpoints	Operator or higher
The Prometheus endpoint	Operator or higher
SNMP metrics over HTTP, including MIB generation	Operator or higher
The Traffic Watch live stream, endpoints, and configuration	Operator or higher
The IO Stats views	Operator or higher
The advanced-debug view, the Stack Traces view, and the Admin Logs view	Operator or higher
Deleting an entry from the Raft log, in the advanced-debug view's Cluster Debug tab	Cluster Admin
The Admin JS Console	Cluster Admin
The Running Queries view	Every clearance. Users with User clearance see only the queries of the databases their certificates grant access to.
The notification center	Every clearance. Users with User clearance see only the notifications of the databases their certificates grant access to.
The Ongoing Task Stats view	Read access to the database

On an unsecure server, no certificate is needed, and the per-database visibility restrictions do not apply.

License requirements

The Monitoring Endpoints feature

A license that includes the Monitoring Endpoints feature enables:

• The JSON monitoring endpoints
• The Prometheus endpoint
• OpenTelemetry support

When the license does not include this feature, requests to the endpoints fail with HTTP status 402 Payment Required.
When the license is upgraded to include this feature while the server is running, OpenTelemetry meters are registered only on the next server restart; until then, RavenDB collects no OpenTelemetry metrics.

The SNMP feature

SNMP support, including the Zabbix template that reads RavenDB metrics over SNMP, requires a license that includes the SNMP feature.

Exposure considerations

Cleartext community string in SNMPv2c

Concern: SNMPv2c sends the community string, which is used as a password, in cleartext.

• Mitigation: Use SNMPv3
  SNMPv3 adds user authentication and traffic encryption, and is the right choice when SNMP traffic crosses an untrusted network.
  Set the SNMPv3 credentials using the Monitoring.Snmp.* configuration keys.

• Mitigation: Use a trusted network
  When you use SNMPv2c, keep the SNMP traffic inside a trusted local network.

Open monitoring data on an unsecure server

Concern: On an unsecure server, the monitoring views and endpoints require no certificate, and anyone with network access to the server can read the monitoring data.

• Mitigation: Run a secure server
  On a secure server, every monitoring view and endpoint requires a client certificate with the clearance listed in Access control above.

Operational details in streamed requests and log files

Concern: Traffic Watch and the server logs record operational details, like database names, request URLs, and client certificate thumbprints.

• Mitigation: Clearance gates
  Connecting to the Traffic Watch live stream and opening the Admin Logs view both require an Operator clearance or higher.

• Mitigation: Log-to-file filters
  The Traffic Watch configuration keys filter the log output, e.g., to requests made to listed databases or with listed client certificate thumbprints.

Diagnostic tools that modify the server

Concern: Some diagnostic tools modify data rather than just observe it, and may corrupt the data and crash the server.

This concern relates to the Admin JS Console, and to the deletion of Raft-log entries in the advanced-debug view's Cluster Debug tab.

• Mitigation: Cluster Admin clearance
  Both running JavaScript code in the JS console and deleting a log entry require a Cluster Admin clearance.

• Mitigation: Explicit confirmation
  Deleting an entry from the Raft log requires a confirmation that states the risk: the deletion can lead to data inconsistencies and cluster instability.