, free & fully virtual. June 9th - 10th. Register Now

How to make mongotop/mongostat work for a specific database user that does not have an admin role?

iam able to run mongotop mongostat only on user that has admin roles. For example i have assigned below roles to the user fred. iam able to run the mongotop only with user credentials having admin role as shown below.

mongotop --host --port 12017 -u fred -p fred1 --authenticationDatabase "admin"

    "role" : "userAdminAnyDatabase",
    "db" : "admin"
    "role" : "dbAdminAnyDatabase",
    "db" : "admin"
    "role" : "readWriteAnyDatabase",
    "db" : "admin"
    "role" : "clusterAdmin",
    "db" : "admin"

when i use an usercredentials with below role, i get below error
roles: [ { role: "readWrite", db: "dbz" }]
i checked the docs to see if there are any roles i could add to this user to make this command work using this userid, but iam not able to find it in docs

Failed: (Unauthorized) not authorized on admin to execute command { serverStatus: 1, recordStats: 0, lsid: { id: UUID("cf3fe918-2abf-44c9-b67d-1c7916f84f7f") }, $clusterTime: { clusterTime: Timestamp(1590182369, 3), signature: { hash: BinData(0, 30748E38362C79FB87FB2FA102DC33259F87300E), keyId: 6823102724234543106 } }, $db: "admin", $readPreference: { mode: "primaryPreferred" } }

why i need this?
when i run mongotop with my admin credential i see output of all databases present in the mongodbinstance. i have multiple database in my replicaset, i dont want to see the output of mongotop from all the collections in those databases. i want to see only the output of collections running in one specific database

Hi @Divine_Cutler, The information you need can be found in the MongoDB documentation.

For mongotop the user needs to have both serverStatus and top privileges.

For mongostat the user needs to have serverStatus privileges.

The built in clusterManager role has these two privileges plus more that a monitoring admin might need, so it might fit your needs as well.

1 Like

i can see privileges in this doc. but how to add it to an useraccount?

in which property should i add privilege?

i found some clue in this doc .

i think it could be added like this, but iam not so sure as i don’t find the syntax for it in createUser method

{ role: "<role>", db: "<database>" ,actions: [ "serverStatus","top"] }

please let me know