Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/open-telemetry/opentelemetry-collector-contrib/receiver/mongodbreceiver
Status | |
---|---|
Stability | beta: metrics |
Distributions | contrib |
Issues | |
Code Owners | @djaglowski, @schmikei | Seeking more code owners! |
This receiver fetches stats from a MongoDB instance using the golang
mongo driver. Stats are collected
via MongoDB's dbStats
and serverStatus
commands.
The purpose of this receiver is to allow users to monitor metrics from standalone MongoDB clusters. This includes non-Atlas managed MongoDB Servers.
This receiver supports MongoDB versions:
Mongodb recommends to set up a least privilege user (LPU) with a clusterMonitor
role in order to collect metrics. Please refer to lpu.sh for an example of how to configure these permissions.
The following settings are optional:
hosts
(default: [localhost:27017
]): list of host:port
or unix domain socket endpoints.The transport
option is no longer available.
replica_set
field is specified, nodes will be autodiscovered.mongos
hosts.username
: If authentication is required, the user can with clusterMonitor
permissions can be provided here.password
: If authentication is required, the password can be provided here.collection_interval
: (default = 1m
): This receiver collects metrics on an interval. This value must be a string readable by Golang's time.ParseDuration. Valid time units are ns
, us
(or µs
), ms
, s
, m
, h
.initial_delay
(default = 1s
): defines how long this receiver waits before starting.replica_set
: If the deployment of MongoDB is a replica set then this allows users to specify the replica set name which allows for autodiscovery of other nodes in the replica set.timeout
: (default = 1m
) The timeout of running commands against mongo.tls
: (defaults defined here): TLS control. By default insecure settings are rejected and certificate verification is on.direct_connection
: If true, then the driver will not try to autodiscover other nodes, and perform instead a direct connection o the host.receivers:
mongodb:
hosts:
- endpoint: localhost:27017
username: otel
password: ${env:MONGODB_PASSWORD}
collection_interval: 60s
initial_delay: 1s
tls:
insecure: true
insecure_skip_verify: true
The full list of settings exposed for this receiver are documented here with detailed sample configurations here.
The following metric are available with versions:
mongodb.extent.count
< 4.4 with mmapv1 storage engineDetails about the metrics produced by this receiver can be found in metadata.yaml
See the Collector feature gates for an overview of feature gates in the collector.
STABLE: receiver.mongodb.removeDatabaseAttr
The feature gate receiver.mongodb.removeDatabaseAttr
will remove the database name attribute from data points
because it is already found on the resource. This feature gate cannot be changed and will be removed soon.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.