OpsCenter configuration properties

The HTTP port used for client connections to the OpsCenter web server. The default port is 8888.

Optional HTTPS support. To enable, remove the comment markers # in front of properties prefixed with ssl in the opscenterd.conf file, as described in Configuring HTTPS.

The interface that the web server uses to listen for client connections. The interface must be an externally accessible IP address or host name. The default interface is 127.0.0.1.

The location in the file system where static content for the OpsCenter web site resides. The default location is /usr/share/opscenter/content for package installations and install_location/content for tarball installations.

The location where the SSL keyfile resides. This option requires ssl_certfile and optionally ssl_port to also be set.

The location where the SSL certificate resides. This option requires ssl_keyfile and optionally ssl_port to also be set.

The port on which to serve SSL traffic. The default port is 8443.

Determines whether or not to open up the non-secure port when enabling HTTPS for the webserver. The default behavior redirects HTTP traffic to the HTTPS port. Default: True

Determines whether to use HTTP Strict Transport Security. Enabling this option causes OpsCenter to return an HSTS header in HTML responses that go over HTTPS. The HTHS header makes HTTPS->HTTP downgrade attacks more difficult by instructing supported browsers to refuse connecting to OpsCenter over unencrypted HTTP. Enabling this option also requires enabling TLS with ssl_certfile and ssl_keyfile. See also hsts_max_age. Default: False.

The length of time in seconds that supported browsers should consider an HSTS header fresh and refuse to connect to OpsCenter with unencrypted HTTP. See also: hsts_enabled. Default: 31536000 seconds (1 year).

The time in seconds OpsCenter waits for subprocesses to complete before a timeout. The default value is 600 seconds. OpsCenter spawns subprocesses for some tasks, such as scp; these tasks have a configurable timeout.

The size of the server’s worker thread pool, used to off load tasks from the main thread

The URL of a proxy server that OpsCenter uses for external http/https connections. Currently only applies to the posturl plugin. Example:

Proxy username for basic proxy HTTP authorization. Currently only applies to the posturl plugin.

Proxy password for basic proxy HTTP authorization. Currently only applies to the posturl plugin.

Specifies whether OpsCenter should attempt to decrypt sensitive config values.

Name of the system key used to encrypt/decrypt stored passwords.

Path to the encryption key. If left blank, the directory of opscenterd.conf is used.

The interval in seconds in which OpsCenter logs the system resource usage. The default value is 60.

Specifies whether SSL should be used to get definition file updates. This option requires OpenSSL on the OpsCenter host. The default value is True.

The file system location where definition files are stored. The default location is /var/lib/opscenter/definitions for package installations and install_location/definitions for tarball installations.

Specifies whether OpsCenter should automatically attempt to periodically update the definition files. The default value is True.

The host to which definition file update requests are made. The default host is opscenter.datastax.com.

The port used to request definition file updates on download_host. The default port is 443.

The name of the tar file on the download_host that contains definition file updates. The default name is definitions_files.tgz.

The name of the hash file on the download_host used to determine if the definition file requires an update. The default file is version.md5.

The duration in seconds between checks to update the definition files. The default time is 3600 seconds (1 hour).

Full path to the file for configuring password authentication for OpsCenter. If this file does not exist, OpsCenter does not verify passwords. The default location is /etc/opscenter/passwd.db for package installations and install_location/passwd.db for tarball installations.

Configures whether user authentication is enabled or not. The default setting is False.

This sets the session timeout, in seconds. Defaults to no timeout (0). If a timeout is desired, the minimum value it can be set to is 60 seconds.

Configured Authentication method. Options include DatastaxEnterpriseAuth and LDAP. For Active Directory (AD), DataStax supports AD over LDAP, so please specify LDAP.

The 1-way password hash algorithm to use when storing user passwords. Options include: bcrypt+blake2b-512 (default), pbkdf2+blake2b-512, pbkdf2+sha512, pbkdf2+sha3-256, bcrypt+sha512.

The number of seconds that opscenterd waits to receive a successful SQLite connection before a timeout. Default: 5

The maximum number of simultaneous active connections to the SQLite database. Default: 200

Password of the LDAP search user. Only needed when using LDAP in plugable authentication.

Password for the LDAP truststore. Only needed when using LDAP in plugable authentication.

The LDAP server host.

The LDAP server port.

URI Scheme, defaults to ldap for ldap_security = None, defaults to ldaps for ldap_security = SSL or TLS.

DN of the user that be used to search for users on the LDAP server. This user should only have the necessary permissions to do the search. If not present, then an anonymous bind is used for the search.

Example: cn=admin,dc=qaldap,dc=datastax,dc=lan

Password of the search user.

The ldap search base used to find a user; Example: ou=users,dc=qaldap,dc=datastax,dc=lan

The ldap search filter used to uniquely identify a user; Example: (uid={0})

The ldap search base used to find a group; example: ou=groups,dc=qaldap,dc=datastax,dc=lan

Deprecated. The ldap search filter used to find a user’s group; example: (member=cn={0},ou=users,dc=nodomain)

The ldap search filter used to find a user’s group. Uses the full user’s DN from a user search. Overrides group_search_filter. Example: (member={0})

The ldap field name used to identify a group’s name; example: cn

The name of the admin group or a comma separated list of admin group names; example: admin, superusers

If your group name contains restricted LDAP characters such as "," (a comma), you must escape them.

For example, the two admin groups "foo , bar" and "baz" should be entered as: foo \, bar, baz

The type of security to use with LDAP: None, TLS, SSL, SSL_TLS when set to TLS or SSL_TLS uses TLS start

Path to the truststore.

Type for the truststore.

Password for the truststore.

Sets whether hostname verification should happen for SSL/TLS connections.

Set to the attribute on the user entry containing group membership information.

Set to True if the memberof attribute’s value is distinguished names of groups. Default: False

The group_search_type defines how group membership is determined for a user. It can be one of:

directory_search - does a subtree search of group_search_base using group_search_filter to filter the results

memberof_search - gets groups from the memberof attribute of the user. This requires the directory server to have memberof support

Sets whether the OpsCenter LDAP client should follow referrals. AD typically does not follow referrals. Default: False.

Returns an error when multiple entries are returned from a user search after all referrals (if applicable) are followed. Set to False if the user_search_base is not confined to one particular OU. Defaults to True.

The number of seconds to wait before concluding the ldap server is down, defaults to 30 seconds.

The durations in seconds in between updates to the agent config md5. The default value is 420 seconds (7 minutes).

The Secure Shell (SSH) port that listens for agent-OpsCenter communications. The default port is 22. Add an [agents] section, if one doesn’t already exist, to the opscenterd.conf. In this section, add the ssh_port option and a value for the port number:

The port used by OpsCenter for incoming stomp communication. The default port is 61620.

The interface used by OpsCenter for incoming stomp traffic from the DataStax Agents. The default interface is 0.0.0.0.

Specifies whether traffic between OpsCenter and the DataStax Agents should use SSL. The default value is False.

How often OpsCenter updates agent install status during an agent install.

The number of seconds to wait after agent install before checking DataStax Agents for known problems

The number of seconds to wait for the install to complete before automatically terminating the install.

The location of the SSL key file used for SSL traffic between OpsCenter and the DataStax Agents. The default location is /var/lib/opscenter/ssl/opscenter.key for package installations and install_location/ssl/opscenter.key for tarball installations.

The location of the SSL certificate used for SSL traffic between OpsCenter and the DataStax Agents. The default location is /var/lib/opscenter/ssl/opscenter.der for package installations and install_location/ssl/opscenter.der for tarball installations.

The location of the keyfile sent to the DataStax Agents when using SSL communication between OpsCenter and the DataStax Agents. The default location is /var/lib/opscenter/ssl/agentKeyStore for package installations and install_location/ssl/agentKeyStore for tarball installations.

The raw keystore file stored in the Java keystore from agent_keyfile. This parameter is required only when configuring high availability, so that the secondary OpsCenter instance can communicate with the primary OpsCenter instance. The failover opscenterd processes on the secondary OpsCenter instance use this key to establish a STOMP connection to the primary opscenterd instance.

The location of the certfile sent to the DataStax Agents when using SSL communication between OpsCenter and the DataStax Agents. The default location is /var/lib/opscenter/ssl/agentKeyStore.der for package installations and install_location/ssl/agentKeyStore.der for tarball installations.

The location of the ssh executable binary. The default locations is /usr/bin/ssh.

The location of the scp executable binary. The default location is /usr/bin/scp.

The location of the ssh-keygen executable binary. The default location is /usr/bin/ssh-keygen.

The location of the ssh-keyscan executable binary. The default location is /usr/bin/ssh-keyscan.

The location of the OpsCenter user’s known_hosts file that is used by OpsCenter during SSH communications. The default location is ~/.ssh/known_hosts.

The location of the system wide known_hosts file that is used by OpsCenter during SSH communications. The default location is /etc/ssh/ssh_known_hosts.

The path to a temporary directory on the OpsCenter machine used for installing DataStax Agents. The default location is /usr/share/opscenter/tmp/ for package installations and install_location/tmp for tarball installations.

Set the path to a temporary directory used by the DataStax agents to hold files for backup and repair service.

The maximum time in seconds since the last agent status about a specific connection, such as stomp, was sent before that agent connection is considered down. This threshold also affects how long OpsCenter waits before marking node health as unknown. Default value: 180 seconds.

Number of times to try different up nodes on agent requests.

The number of seconds between log flushes for verbose aggregated and periodically batched agent messages. Default: 600 seconds.

The frequency in seconds between attempts to poll agent http health. Default value: 60 seconds.

Base port to use for setting up the HTTP proxy for the Spark master. Spark master UI is exposed at port 7080 and increasing ports from that + 10k (17080) are largely unused.

The period of time in seconds between each NodeSync Service refresh of status data from the NodeSync metrics table. Default: 300 (5 mn).

The maximum number of tables that can be processed for a single request to enable or disable NodeSync. Only adjust the default value if schema agreement errors are encountered when enabling or disabling NodeSync on multiple tables. Default: 50.

The location in which to store a file with the current repair service status. The default location is /var/lib/opscenter/repair_service for package installations and install_location/repair_service for tarball installations.

The period of time in seconds the Repair Service pauses in response to certain events before verifying the cluster stability and restarting repairs. Default: 300 (5 minutes).

The frequency in seconds that the Repair Service checks for cluster stability before making repairs. The check begins when the Repair Service is activated (either by a user or after an OpsCenter restart) and repeats until the cluster is stable. Default: 30.

The maximum number of times to retry a repair task before temporarily skipping the task and moving on to the next task. The skipped task is moved to the end of the repairs queue to retry later. After the maximum retries is reached, an alert is fired. Default: 10.

The maximum number of subrange repairs to run in parallel. If unspecified or set to 0, the Repair Service calculates the correct number of maximum repairs to run in parallel. Default: 0.

The maximum number of pending repairs allowed to be running on a node at one time. Default: 5.

The maximum length of time in seconds for a repair to complete. Default: 3600 (1 hour).

The minimum length of time in seconds for a repair to complete. If a repair finishes sooner, it is padded with a sleep. Default: 5.

The maximum number of remaining subrange repair tasks for the repair service to evaluate when choosing the next low-impact repair to run. Default: 512. This parameter applies to subrange repairs only.

The minimum number of subrange splits for a node to have per keyspace when falling back to offline splits if the node is unable to communicate with its agent to get more optimal splits. Default: 256. This parameter applies to subrange repairs only.

The minimum throughput in bytes needed to calculate parallel repairs. See also num_recent_throughputs. Default: 512. This parameter applies to subrange and incremental repairs only, and is not applicable to distributed subrange repairs.

The maximum most recent completed repair throughputs used to calculate the average repair throughput, which is then used to determine how many parallel repairs are needed. See also min_throughput. Default: 500. This parameter applies to subrange and incremental repairs only, and is not applicable to distributed subrange repairs.

The frequency in seconds to log errors and trigger alerts after exceeding time_to_completion. Default: 86400 (1 day).

Specifies whether to override the default snapshot repair behavior. Specifying this option as True runs validation compaction sequentially rather than in parallel. Default: False.

The list of keyspaces to ignore during a subrange or distributed subrange repair in addition to system keyspaces.

The list of keyspace and tables to exclude during a subrange repair. Not applicable to distributed subrange repairs. Example: keyspace1.standard1, keyspace1.standard2.

The list of keyspaces and tables to include in incremental repairs.Example: keyspace1.standard1, keyspace1.standard2.

Restricts incremental repairs by datacenters or racks. Setting this option improves performance by limiting the repair requests to only those replicas within the datacenters and any specified racks. Example: dc1,dc2:rack1,dc2:rack2. The default behavior sends repair requests to all datacenters and racks for all replicas.

The number of seconds to pause after completing all incremental repairs for a cluster. Default: 3600 (1 hour).

The minimum number of bytes required to consider a table for incremental repairs. The default value of 1 byte means that if there is any unrepaired data in a table, the Repair Service runs an incremental repair. Be cautious of setting this value too high. If not enough data is written to exceed the threshold in the gc_grace_seconds period, deletes might be lost. Default: 1.

The threshold for the number of errors during incremental repair to ignore before alerting that incremental repair seems to be failing more than an acceptable amount. Default: 20.

A percentage of the time to completion that the repair service should target, including slowing down or reducing parallelism as necessary to avoid overtaxing the cluster. Default: 65. This parameter applies to subrange and incremental repairs only, and is not applicable to distributed subrange repairs.

The timeout in seconds for the HTTP call to the agent to retrieve node token range splits. The default value (30) is deliberately set higher than the default value for DataStax Agents http_timeout in clustername.conf (10). Default: 30. This parameter applies to subrange repairs only, and is not applicable to incremental or distributed subrange repairs.

The minimum number of seconds between Repair Service writing the persist file to disk. Default: 3600 (1 hour). This parameter applies to subrange and incremental repairs only, and is not applicable to distributed subrange repairs.

Target number of partitions for each range in a subrange repair. This value is used by the Repair Service to create repair tasks, and is set to the max DSE merkle tree depth by default. Default: 1048576.

The maximum number of attempts to retry a repair task when a node containing a replica is down. The default is 1080 retry attempts. Retries occur every 10 seconds. The default 1080 retries elapses after 10800 seconds (3 hours), which corresponds to the default Cassandra hinted-handoff expiration. Example: To double the time allowed to attempt repairs on a down node or replica to 6 hours, set the number of retries to 2160. Default: 1080.

Specifies whether to enable the Distributed Subrange Repair job type in the Repair Service, which is designed to better scale for large, dense clusters that require an extremely large number of individual subrange repairs. Default: False.

Interval at which to recalculate parallel tasks to use for the Repair service in seconds. Default: 120 (2 minutes). This parameter applies to subrange and incremental repairs only, and is not applicable to distributed subrange repairs.

When true, specifies to the Repair Service that it can continue the repair process even in case of schema addition type(Addition of new Keyspace/Table) changes. When set to false, repair service stops the current process and restart it from beginning.

The default timeout value in seconds for an API call from the OpsCenter UI to the OpsCenter API. The default value is 30. Some API calls require a timeout longer than 30 seconds. In those cases, the API call timeouts are scaled relative to the default_api_timeout (for example, 6 * default_api_timeout). Changing the default_api_timeout affects those timeouts accordingly.

The maximum concurrent metrics requests from the OpsCenter UI to opscenterd. The default value is 16.

The time in seconds between polling calls to update node details. The default value is 5.

Time to to live in seconds for cached storage capacity data. The default value is 300. Agents send storage capacity data to opscenterd based on disk_usage_update_period in address.yaml. The data for some nodes are missing if storagemap_ttl is set to a value less than disk_usage_update_period.

The maximum number of requests that can be tracked. The default value is 10,000.

How long in seconds OpsCenter waits when adding a cluster before reporting an error. The default value is 300 seconds. Adding a cluster includes connecting to DSE, getting topology information, and creating the OpsCenter schema. Increasing this value may be necessary when running a very large cluster with vnodes enabled.

How long in seconds OpsCenter waits between connecting to clusters on startup. The default value is 0 (no wait).

The maximum time in seconds to wait for schema agreement after executing a schema-altering query. Default value: 30 seconds. Increase the value if there are schema creation or schema alteration errors present in the opscenterd log.

How often OpsCenter should heartbeat to the backup. Default: 10 seconds.

How often a backup OpsCenter should heartbeat to the primary Opscenter. Default: 300 seconds.

The amount of time required before a lack of heartbeat triggers failover. Default: 60 seconds.

The directory where failover specific configuration is stored. This directory should not be mirrored/replicated across OpsCenter installs when configuring OpsCenter to support failover. The default location is /var/lib/opscenter/failover/ for package installations and install_location/failover/ for tarball installations.

If set, overrides the primary OpsCenter URL automatically generated during failover. Example:

The location of the lcm.db database used for storing Lifecycle Manager information. Default: /var/lib/opscenter/lcm.db

The directory to use when storing SSL-related files that are automatically generated during provisioning tasks. Default: /var/lib/opscenter/ssl/lcm

The location of the truststore containing the root CA cert for signing certificates. Default: /var/lib/opscenter/ssl/lcm/lcm-auto-generated.truststore

The password to open the cacerts truststore.

The key to use to encrypt sensitive data in the database for storing Lifecycle Manager information. The encryption key is automatically generated if it does not already exist. Default: /etc/opscenter/lcm.key

Polling frequency in seconds when performing Lifecycle Manager tasks. Default: 5 seconds.

Duration of inactivity in seconds before marking an install job as idle. Default: 900 seconds.

Duration of inactivity in seconds before marking a node restart job as idle. Default: 300 seconds.

Duration of inactivity in seconds before marking a node configuration job as idle. Default: 300 seconds.

Duration of inactivity in seconds before marking a cluster import job as idle. Default: 120 seconds.

Duration of inactivity in seconds before marking an agent install job as idle. Default: 120 seconds.

Duration in seconds to allow for connecting to DataStax Enterprise when provisioning a DataStax Enterprise cluster. Default: 20 seconds.

The number of seconds to wait for the SSH server on a target node to respond to a connection attempt during an LCM job. Default: 30 seconds.

The maximum number of times to attempt an SSH connection to a given target during an LCM job. Default: 3.

The number of seconds to wait between SSH connection retries during an LCM job. Default: 10 seconds.

Platform check ensures DSE compatibility and support. Disable at your own risk. Default: False.

The maximum number of minutes meld waits for DSE to start up.

The number of seconds to wait between polls of DSE’s status during startup.

The meld_upload_method defines how meld is uploaded to a node. It can be one of:

sftp - uses SFTP when transferring meld to a node.

scp - uses scp when transferring meld to a node.

sftp_with_scp_fallback - uses sftp when transferring meld to a node and fallback on scp if that fails. This is the default.

Feature flag for doing local query health checks on each node. Default: False.

The number of times to auto retry sending a backup to a destination if there are failures. Default: 3.

The amount of time in minutes to wait between retry attempts. Default: 60.

The amount of time in seconds to wait for DataStax Agents to respond when validation a backup destination. Default: 30.

The optional proxy host for connection to AWS S3.

The optional proxy port for connection to AWS S3.

The timeout in seconds to wait for backup sync status updates through Stomp. A value of 0 disables this property. Default: 300 seconds.

Example: stomp_status_update_timeout = 300

Force opscenterd to use https for redirects during authentication. Required if opscenterd is behind a proxy that handles encryption. Default False.

The location of the sudo_with_pass.py wrapper for old Red Hat installations. The default location is /usr/share/opscenter/bin/sudo_with_pass.py for package installations and install_location/bin/sudo_with_pass.py for tarball installations.

Deprecated. Use [lifecycle_manager] opscenterd_agent_package_directory instead.

Deprecated. Use [lifecycle_manager] opscenterd_agent_package_directory instead.

The interface used when automatically setting up target nodes to communicate with opscenterd. The value is used when installing the DataStax Agent automatically through OpsCenter, during failover, and is also used by the remote script deployed by the Lifecycle Manager (LCM) to communicate status back to the central opscenterd process. The value is written as the stomp_interface property in address.yaml. If not explicitly set, this value is determined by an algorithm that works automatically in most cases. The reported_interface property should be set if that algorithm fails to determine the proper IP that DataStax Agents should use to connect (that is, if stomp_interface is configured incorrectly in address.yaml, or the remote LCM script fails to report back).

The port used when automatically setting up DataStax Agents to communicate with OpsCenter via stomp. The value is used when installing the DataStax Agent automatically through OpsCenter, and during failover. The value is written as the stomp_port property in address.yaml. If not explicitly set, this property defaults to a value of 61620. The reported_port property should be set if OpsCenter is listening for agents on a different port than the default of 61620.

Sets whether the DataStax Agent is run using sudo or not. The default value is True. Setting this option to False means the agent does not use sudo, and the agent user is not run using elevated privileges. Setting this option to True means the agent runs using sudo and elevated privileges.

Override the protocol/address/port that meld uses to contact LCM.

The protocol defaults to http/https based on the webserver SSL configuration.

The address falls back to agents incoming_interface

The port falls back to webserver port