We use cookies or similar technologies to personalize your online experience and tailor marketing to you. Many of our product features require cookies to function properly. Your use of this site and online product constitutes your consent to these personalization technologies. Read our Privacy Policy to find out more.

X

Collecting MongoDB TCP traffic

Honeycomb’s TCP collector for MongoDB passively analyzes traffic between your MongoDB clients and servers to give you query-level visibility into your database workload. It doesn’t require reconfiguring MongoDB, and doesn’t affect database performance.

Setup

You can install and run the TCP collector on either your MongoDB or your application servers – the choice is yours.

Download and install the latest version of honeycomb-tcpagent by running:

wget -q https://honeycomb.io/download/honeycomb-tcpagent/honeycomb-tcpagent_1.29_amd64.deb && \
      echo '44ceaf19a9a19a61c094ed529dfebef45d2d534867942c84e5d63b2741347b21  honeycomb-tcpagent_1.29_amd64.deb' | sha256sum -c && \
      sudo dpkg -i honeycomb-tcpagent_1.29_amd64.deb

The package installs honeycomb-tcpagent, a sample config file /etc/honeycomb-tcpagent/honeycomb-tcpagent.conf, and start scripts. The binary is just honeycomb-tcpagent, available if you need it in an unpackaged form or for ad-hoc use.

Usage

Start collecting data by running

honeycomb-tcpagent --writekey=YOUR_API_KEY --dataset="MongoDB"

You are currently logged in to the team, so we have populated the write key here to the first write key for that team.

To run honeycomb-tcpagent as a service, modify the config file at /etc/honeycomb-tcpagent/honeycomb-tcpagent.conf and set:

Then run sudo initctl start honeycomb-tcpagent (if your init system uses Upstart) or sudo systemctl start honeycomb-tcpagent (if your init system uses systemd).

Note: Are you running MongoDB on a non-standard port, or have other special configuration? Run honeycomb-tcpagent --help for advanced configuration options.

Starter queries

A few things you might want to look at are:

Example field

An example find query on a MongoDB collection named “restaurants” will produce a Honeycomb event that looks like this:

field name type value
client_ip string 10.2.0.45
collection string restaurants
command json { “batchSize”: 1, “filter”: { “grade”: “A”, “score”: { “$gte”: 3 } }, “find”: “restaurants”, “limit”: 100 }
commandType string find
database string appdb
duration_ms float 14.332
namespace string appdb.$cmd
normalized_query json { “filter”: {“grade”: 1, “score”: { “$gte”: 1 }}, “find”: 1, “limit”: 1 }
nreturned float 1
ninserted float 0
request_id float 3139
request_length float 48
response_length float 3442
server_ip string 10.2.0.230

Numbers are ingested as floats by default in Honeycomb. You can change a field’s type in the Schema section of your dataset’s Overview page.

Scrubbing the raw command

If you have sensitive data in your queries that you don’t want to send to Honeycomb, you can use the --mongodb.scrub_command flag or set ScrubCommand = true in the configuration file. When set, the value of the command field (which contains raw queries, inserts, etc.) will be replaced with its SHA256 hash. You will still be able to do inclusion and frequency analysis on the hashed field, but the actual value won’t be sent.

Open source

The honeycomb-tcpagent source code is available on Github and Apache 2.0 licensed.