Add a Database Collector

Note: When you create a Database Collector, the password is encrypted and saved in the database. When the password is saved, you cannot retrieve the saved password. Splunk AppDynamics uses the secure-credential-store-api internal library to encrypt passwords and the PKCS5 encryption algorithm.
FIPS migration of Database Collector secrets

Applies when `appdynamics.controller.fips.enabled=true`.

Database Monitoring stores database credentials and other sensitive collector attributes in encrypted form. Existing collectors might contain secrets encrypted with legacy DES or the Secure Credential Store implementation. These encryption methods are unavailable or not FIPS compliant when FIPS mode is enabled.

Collectors without sensitive attributes are not affected. Affected attributes can include:

  • Database password

  • Host password

  • Oracle SSL keystore password

  • Oracle SSL truststore password

  • JMX password

  • HashiCorp Vault JWT token

  • AWS secret access key

  • Other collector properties marked as sensitive

To migrate an existing collector:

  1. In the Controller UI, select Configuration > Collectors.

  2. Find the collector identified by the migration query.

  3. Edit the collector.

  4. Re-enter each applicable password or secret.

  5. Save the collector configuration.

After saving the configuration, verify that the collector is functional. Support or the SRE team can rerun the identification query and confirm that the encryption_scheme value is standard.

Support identification query

Use the following query to identify collectors that contain sensitive attributes and might require migration:

CODE 
SET @HasPropertiesTable := (
    SELECT COUNT(*)
    FROM information_schema.tables
    WHERE table_schema = 'controller'
      AND table_name = 'db_monitor_config_properties'
);

SET @ConfigCheckSql := IF(
    @HasPropertiesTable > 0,
    'SELECT dmc.id, dmc.name, dmc.encryption_scheme
     FROM controller.db_monitor_config dmc
     LEFT JOIN controller.db_monitor_config_properties dmcp
       ON dmc.id = dmcp.db_monitor_config_id
      AND dmcp.name IN (
          ''dbagent.hc.vault.auth.jwt.token'',
          ''dbagent.hc.vault.auth.aws.secretAccessKey''
      )
     WHERE dmc.password IS NOT NULL
        OR dmc.host_password IS NOT NULL
        OR dmc.orassl_keystore_password IS NOT NULL
        OR dmc.orassl_truststore_password IS NOT NULL
        OR dmc.extra_properties LIKE ''%"sensitive":true%''
        OR dmcp.value IS NOT NULL',
    'SELECT dmc.id, dmc.name, dmc.encryption_scheme
     FROM controller.db_monitor_config dmc
     WHERE dmc.password IS NOT NULL
        OR dmc.host_password IS NOT NULL
        OR dmc.orassl_keystore_password IS NOT NULL
        OR dmc.orassl_truststore_password IS NOT NULL
        OR dmc.extra_properties LIKE ''%"sensitive":true%'''
);

PREPARE ConfigCheckStmt FROM @ConfigCheckSql;
EXECUTE ConfigCheckStmt;
DEALLOCATE PREPARE ConfigCheckStmt;
  1. Click the Configuration tab in the left panel menu.
  2. Click the Collectors option.
  3. In the Collectors panel, click Add (+).
  4. Complete each field of the Create New Collector dialog.
    Important: Do not use a colon (:) in the Database Collector name.
  5. If you want to add a sub-collector to be monitored, click Advanced > +Add sub-collector to enter host and port details.
    Sub-collectors are applicable only to relational database types.
  6. Click OK.
    Your database administrator can provide you with the necessary details.
After you have added a Database Collector, you can configure it for your database. You can also link a database on the application flow maps to a database instance monitored by Database Visibility.