Configuration parameters

Daria Barysheva

This article describes the parameters that can be configured for ADB services via ADCM. To read about the configuring process, refer to the relevant articles: Online installation, Offline installation.

NOTE
Some of the parameters become visible in the ADCM UI after the Show advanced flag being set.

ADB

Main
Parameter Description Default value

Name of default database

A name of the database created by default. Subsequently, this database is used to create most extensions via ADB service actions in ADCM

adb

Use segment mirroring

Enables synchronous replication for primary data segments, i.e. adds mirror segments to the cluster. As a result, mirror segments provide higher availability for the stored data, but require twice more space. When the cluster has enough hosts, it uses spread mirroring policy, otherwise — group mirroring policy

true

ADB MADlib Extension

Whether or not to install MADlib. MADlib is an open-source library for scalable in-database analytics that provides data-parallel implementations of mathematical, statistical, and machine-learning methods for structured and unstructured data. It provides a suite of SQL-based algorithms for machine learning, data mining, and statistics, that run at scale within a database engine with no need for transferring data between ADB and other tools

false

ADB PostGIS Extension

Whether or not to install PostGIS. PostGIS is a spatial database extension for PostgreSQL that allows Geographic Information Systems (GIS) objects to be stored in the database. PostGIS includes support for GiST-based R-Tree spatial indexes and functions for analysis and processing of GIS objects

false

ADB Auto Core Dump Service

Whether or not to install the Auto Core Dump service (systemd-coredump) — a plugin that enables core dump files for ADB processes. This feature is useful for debugging purposes. If enabled, the system collects core dumps and saves them in the following directory: /var/lib/systemd/coredump/. When the maximum storage size is reached (1 GB), old files will be deleted. The parameter is available in ADB 6 starting with 6.21.1.36

false

Diskquota Extension

Whether or not to install the diskquota extension, which allows Arenadata DB administrators to limit the amount of the disk space used by schemas or roles in the database

false

PL/Python3u Extension

Whether or not to install the PL/Python3u extension

false
Advanced
Parameter Description Default value

Number of segments per host

A number of primary segments on each segment host. If the parameter is not set, then (<number of CPU cores>) / 2 is used. When you customize a number of primary segments per host, remember that the more parallel SQL queries you plan to run simultaneously — the fewer segments per host you need

(<number of CPU cores>) / 2

Segment host data directories

Directories that are used to store data on segment hosts. The Number of segments per host value should be a multiple of the number of directories. Directory names should be specified in the first column. In the second, optionally, it is possible to specify the devices that should be formatted and mounted in the corresponding directories on the segment hosts, e.g. sdc (without the /dev prefix). Device names should be the same on all segment hosts

/data1

Use nobarrier for segments

Whether or not to use the nobarrier option on segment hosts. This option turns off I/O barriers. It is not recommended to use barriers in XFS

false

Masters host data directory

Directories that are used to store data on master and standby master hosts

/data1

Mount master storage device for data

Whether or not to mount block storage devices to data directories on master and standby master hosts. If no block storage devices are listed in the Master server storage device field, then nothing to be done

false

Master server storage device

Master storage devices, e.g. sdb (without the /dev prefix). Should be the same on all master hosts (including master and standby master)

 — 

Use nobarrier for master

Whether or not to use the nobarrier option on master hosts. This option turns off I/O barriers. It is not recommended to use barriers in XFS

false

Arenadata configs directory name

A name of the folder that contains Arenadata configuration files. It is located in the system user home directory

arenadata_configs

Sysctl parameters

Linux kernel parameters that are needed for ADB

 — 

System user GID

A unique identifier of the group that the system user belongs to. A system user should be created with the same UID and GID across all cluster hosts in order to reduce problems with access to the common network storages, containing ADB backup files

2042

System user name

A system user name for ADB

gpadmin

System user UID

A unique identifier of the system user. A system user should be created with the same UID and GID across all cluster hosts in order to reduce problems with access to the common network storages, containing ADB backup files

2042

Disable firewall

Whether or not to disable firewalld on the cluster hosts

true

Edit /etc/hosts

Whether or not to edit the /etc/hosts file during ADB installation to provide short host names instead of FQDN for the correct ADB work

true

Amount of shared memory

The amount of shared memory allocated for query metrics (in KB). The maximum size is 131072. Restart ADB to apply changes

5120

Maximum scan node’s instrumentations

The maximum number of scan node’s instrumentations per query (in shmem). Restart ADB to apply changes

300
Interconnect properties
Parameter Description Default value

Interconnect type

An interconnect type that should be used. Possible values:

  • udpifc

  • tcp

  • proxy

udpifc

ic-proxy auto-discovery

Whether to use automatic proxy list generation during ic-proxy interconnect configuration. A port shift is defined in the ic-proxy port delta field (by default, 2000)

true

ic-proxy port delta

Defines an integer value that is used to increase/decrease the proxy port value relative to the port of the associated postmaster backend. Applies only in conjunction with ic-proxy auto-discovery set to true.

Allowed values: [-60000, 0), (0, 60000].

Please do not use 0 as the parameter value, since it will cause the following error: Check that auto-discovery or proxy delta or gp_interconnect_proxy_addresses guc is not empty

2000

Run ic-proxy check

Whether to run an interconnect test

false
Use dedicated cluster network
Parameter Description Default value

Cluster network

A subnet that is used for cluster nodes interconnection. Requires the <subnet>/<netmask> notation, for example 192.168.1.0/24. If this parameter is not set, then ADCM uses addresses with the default route. A host must have exactly one address in the range. Run Reinstall ADB to apply changes

 — 
ADB ident server
Parameter Description Default value

ADB ident server

Whether to install the Ident server

false

Default deny policy for ident server

Whether to deny access by default for all users for which no explicit rules have been defined in the configuration file of the Ident server (/etc/oidentd.conf)

true
ADB GPperfmon Extension
Parameter Description Default value

ADB GPperfmon Extension

Whether to install the ADB gpperfmon extension. gpperfmon is a built-in activity monitor that populates tables in the gpperfmon database with a variety of information, including a list of slow queries, database usage statistics, system properties, and various other metrics

true

Authentication type

An authentication type that should be defined in the pg_hba.conf file for the gpmon role that is used by the ADB gpperfmon extension. Possible values:

  • md5

  • ident

To use the ident value, you should install an Ident server on the ADB side (see ADB ident server above) or use your own pre-configured Ident server. Otherwise, you get the following error during authentication: FATAL: Ident authentication failed for user "gpmon"

md5
Crontab
Parameter Description Default value

Crontab maintenance scripts

Crontab maintenance scripts of the ADB system user gpadmin. For more information, see Work with arenadata_toolkit

 — 

Delete old maintenane script logs

A number of days after which maintenance script logs should be deleted

30
SSL
Parameter Description Default value

SSL

Whether to use SSL certificates

false

SSL Ciphers

SSL ciphers

["HIGH","MEDIUM","+3DES","!aNULL"]

Server certificate

Server certificate contents in the CRT format (*.crt file)

 — 

Server private key:

Server private key contents (*.key file)

 — 

Root certificate

Root certificate (Certificate Authority, CA) contents in the CRT format (*.crt file)

 — 

Certificate revocation list

Certificates revoked by certificate authorities

 — 

Custom ssl pg_hba section

The custom part of the pg_hba.conf file (with SSL settings)

 — 
UI LDAP authentication
Parameter Description Default value

UI LDAP authentication

Whether or not to use LDAP authentication

false

Type

A type of the LDAP server. Possible values:

  • MSAD — Microsoft Active Directory

  • FreeIPA — 389 Directory server as a part of FreeIPA

MSAD

URI

A URI for connecting to the LDAP server in the following format: <host>:<port>

 — 

LDAP encryption

Encryption method to be used for LDAP connections:

  • ldaps — use LDAP over SSL/TLS (LDAPS)

  • starttls — use the Start Transport Layer Security (StartTLS) operation

  • none — do not use encrypted LDAP

none

Users baseDN

A limitation of the search scope of objects in the LDAP directory that is used in user search requests

 — 

Groups baseDN

A limitation of the search scope of objects in the LDAP directory that is used in group search requests

 — 

Users filter

An LDAP filter that is used to search users. Should be specified according to the RFC 2254

(&(|(objectClass=person)(objectClass=inetOrgPerson))(cn=*))

Groups filter

An LDAP filter that is used to search groups. Should be specified according to the RFC 2254

(&(|(objectClass=group)(objectClass=groupofnames)(objectClass=groupOfUniqueNames))(cn=*))

SA Login

A user name that is used for service requests to the LDAP server

 — 

Password

A user password that is used for service requests to the LDAP server

 — 

Lowercase login

Whether or not to convert user names to lowercase

false

Lowercase group

Whether or not to convert group names to lowercase

false

Sync interval

A cron expression that defines how often synchronization of ADB users and groups with an LDAP server should be performed. The pg-ldap-sync utility, which comes with the ADB bundle, is used for synchronization

0 * * * *
Password hashing type algorithm
Parameter Description Default value

Password hashing type algorithm

Whether to use a hashing algorithm for storing user passwords in ADB databases

false

Hash algorithm

A hashing algorithm: scram-sha-256 or md5

scram-sha-256
Other
Parameter Description Default value

Custom pg_hba section

A custom part of the pg_hba.conf file

 — 

ADBC agents

Parameter Description

Use dedicated network

Whether to use a dedicated network for ADB Control agents. If enabled, specify the network in the Dedicated network field. The field requires the <subnet>/<netmask> notation, for example 192.168.1.0/24. ADB Control agents must have access to the ADB cluster network and the ADB ES cluster network. If this parameter is not set, then ADCM uses addresses with the default route. A host must have exactly one address in the range. Run the Reconfigure and restart ADBM agents action to apply the changes.

If you use SSL certificates with an IP address in the SAN section, the IP addresses of the ADB Control agents may differ in the dedicated network. In this case, you will need to issue a new certificate specifying the new IP address
ADB Control agent parameters
Parameter Description Default value

Xmx ram parameter

A maximum Java heap size for the ADB Control agents component (in GB)

2

Log level

Logging level for the ADB Control agents component. Possible values: TRACE, DEBUG, INFO, WARN, and ERROR

INFO

Servers list update timeout

Time interval between requests for information about available ADB Control Backend servers (in ms)

5000

Environment key-value

This section lets you customize the behavior of the ADB Control agents component using environment variables. Click Add property and enter the name of a variable and its value. Use the ADCC agents environment reference file read-only field in the ADB ES cluster to get the names of available variables

 — 

ADBM agents

Parameter Description

Use dedicated network

Whether to use a dedicated network for ADBM agents. If enabled, specify the network in the Dedicated network field. The field requires the <subnet>/<netmask> notation, for example 192.168.1.0/24. ADBM agents must have access to the ADB cluster network and the ADB ES cluster network. If this parameter is not set, then ADCM uses addresses with the default route. A host must have exactly one address in the range. Run the Reconfigure and restart ADBM agents action to apply the changes.

If you use SSL certificates with an IP address in the SAN section, the IP addresses of the ADBM agents may differ in the dedicated network. In this case, you will need to issue a new certificate specifying the new IP address
ADBM agent parameters
Parameter Description Default value

Xmx ram parameter

A maximum Java heap size for the ADBM agents component (in GB)

2

Log level

Logging level for the ADBM agents component. Possible values: TRACE, DEBUG, INFO, WARN, and ERROR

INFO

Environment key-value

This section lets you customize the behavior of the ADBM agents component using environment variables. Click Add property and enter the name of a variable and its value. Use the ADBM agents environment reference file read-only field in the ADB ES cluster to get the names of available variables

 — 

Chrony

Parameter Description Default value

NTP servers

Addresses of valid NTP servers. For example, 0.ru.pool.ntp.org, 1.ru.pool.ntp.org. If this parameter is set, then master takes the time from NTP servers, standby master — from master or NTP servers, segment hosts — from master or standby master. If the parameter is not set or all NTP servers become unavailable, then master uses its local clocks, standby master uses the master or local clocks, and segment hosts get the time from master or standby master

 — 

PXF

Parameter Description Default value

Use custom JAVA_HOME

Whether or not to use a custom JAVA_HOME path

false

JAVA_HOME

A custom JAVA_HOME path. Should lead to the working JAVA. The property becomes available after setting the Use custom JAVA_HOME flag. If empty, then the default system value is used:

  • /usr/lib/jvm/java-17-openjdk-amd64 (Ubuntu)

  • /usr/lib/jvm/jre-17 (AltLinux)

For Astra Linux, the JAVA_HOME field is mandatory starting with ADB 6.27.1.58

 — 

PXF_JVM_OPTS

Sets PXF_JVM_OPTS

-Xmx2g -Xms1g

PXF log4j properties

log4j properties for PXF

 — 

Use custom PXF_BASE

Whether or not to use a custom PXF_BASE path

false

PXF_BASE

A custom PXF_BASE path for PXF installation. The property becomes available after setting the Use custom PXF_BASE flag

/var/lib/pxf

Encryption

Whether or not to use encryption

false

Keystore file

An absolute path to the JKS keystore file. For example, /var/lib/pxf/conf/pxfkeystore.jks

 — 

Keystore password

A JKS keystore password

 — 

Encryption key alias

An encryption key alias. Do not enter a private key in this field

 — 

Monitoring

Prometheus settings
Group Parameter Description Default value

 — 

scrape_interval

Specifies how frequently to scrape targets

1m

 — 

scrape_timeout

Specifies how long to wait until a scrape request times out

10s

 — 

Password for grafana connection

Password of a Grafana user (admprom_grafana) to connect to Prometheus

 — 

 — 

Prometheus users to login/logout to Prometheus

User credentials for logging into the Prometheus web interface

 — 

Service parameters

config.file

Path to the Prometheus server configuration file

/etc/admprom/prometheus/prometheus.yml

web.config.file

Path to the web configuration file. The file is written in YAML format

/etc/admprom/prometheus/prometheus-auth.yml

storage.tsdb.path

Path to the Prometheus server database

/var/lib/admprom/prometheus

web.listen-address

Address to access the Prometheus web interface

0.0.0.0:11200

web.console.libraries

Path to console management libraries

/usr/share/admprom/prometheus/console_libraries

web.console.templates

Path to Prometheus server console templates

/usr/share/admprom/prometheus/consoles

storage.tsdb.retention.time

Specifies how long to retain samples in the storage. Supported units: y, w, d, h, m, s, ms

15d
Grafana settings
Parameter Description Default value

Grafana administrator’s password

Password for the admin user to access the Grafana web interface

 — 

Grafana listen port

Port to access the Grafana web interface

11210
Node Exporter settings
Parameter Description Default value

Listen port

Port to access ADB host system metrics in the Prometheus format

11203

Metrics endpoint

Endpoint where the Node Exporter exposes system metrics in the Prometheus format

/metrics
SSL configuration
Parameter Description Default value

[Prometheus] → Enable SSL

Enables SSL encryption of incoming traffic for the Prometheus Server component

Disabled

[Prometheus] → Certificate file

Path to the server SSL certificate file for the Prometheus Server component

/etc/admprom/prometheus/server.crt

[Prometheus] → Private key file

Path to the file with the private key of the server SSL certificate for the Prometheus Server component

/etc/admprom/prometheus/server.key

[Prometheus] → Certificate authority file

Path to the file with the CA certificate to verify Prometheus targets

/etc/admprom/prometheus/ca.crt

[Grafana] → Enable SSL

Enables SSL encryption of incoming traffic for the Grafana component

Disabled

[Grafana] → Certificate file

Path to the server SSL certificate file for the Grafana component

/etc/admprom/grafana/server.crt

[Grafana] → Private key file

Path to the file with the private key of the server SSL certificate for the Grafana component

/etc/admprom/grafana/server.key

[Grafana] → Certificate authority file

Path to the file with the CA certificate to verify the Prometheus certificate

/etc/admprom/grafana/ca.crt

[Node-exporter] → Enable SSL

Enables SSL encryption of incoming traffic for the Node Exporter component

Disabled

[Node-exporter] → Certificate file

Path to the server SSL certificate file for the Node Exporter component

/etc/ssl/server.crt

[Node-exporter] → Private key file

Path to the file with the private key of the server SSL certificate for the Node Exporter component

/etc/ssl/server.key

[Greengage Exporter] → Enable SSL

Enables SSL encryption of incoming traffic for the Greengage Exporter component. If enabled, specify the path to the server SSL certificate file and the private key file and configure a keystore password

Disabled

[PXF Metrics group] → SSL option

Expand the section and specify the path to the CA file in the Certificate authority file parameter. The file is used if PXF operates over HTTPS

/etc/admprom/prometheus/pxf_ca.crt
Greengage Exporter settings
Parameter Description Default value

Listen port

Port to access Greengage Exporter metrics in the Prometheus format

9080

Listen SSL port

Port to access Greengage Exporter metrics in the Prometheus format via SSL

9443

Metrics endpoint

Endpoint where the Greengage Exporter exposes system metrics in the Prometheus format

/metrics
Process exporter settings

The Process exporter component and this section of configuration parameters are available only in the Enterprise edition of ADB.

Parameter Description Default value

Listen port

Port to access Process Exporter metrics in the Prometheus format

9256

PgBouncer

Parameter Description Default value

PgBouncer listen port

The TCP port on which PgBouncer listens for client connections. The port cannot be changed for a running cluster

6432

Pool mode

Specifies when a server connection can be reused by other clients. Possible values are session (reused after the client disconnects), transaction (reused after each transaction), and statement (reused after each statement)

session

Max client connections

The maximum number of client connections allowed to PgBouncer

100

Default pool size

The number of server connections that are allowed per user/database pair

20

Minimum open connections

The minimum number of server connections to keep in the pool

0

Reserve pool max size

The number of additional connections allowed to the pool if a client connection exceeds the time specified in Timeout for reserve pool

0

Timeout for reserve pool

If a client waits longer than this time (in seconds), additional connections from the reserve pool are used

5

Max connections to DB through pooler

The maximum number of server connections for a database. 0 means unlimited

0

Max client connections to server for a user

The maximum number of server connections for a user. 0 means unlimited

0

Enable all users

When enabled, allows all ADB users to connect via PgBouncer using password authentication. When disabled, use Users list (see below) to specify allowed users

true

Users list

A comma-separated list of users allowed to connect via PgBouncer. Used when the Enable all users option is disabled. For example, postgres,user1

 — 

Enable all databases

When enabled, allows access to all existing databases via PgBouncer. When disabled, use Databases list (see below) to specify allowed databases

true

Databases list

A list of databases that clients can connect to via PgBouncer. Used when the Enable all databases option is disabled. Use the same syntax as in the [databases] section of pgbouncer.ini: <database_name> = <connection string>. For example, postgres = host=localhost port=5432

 — 

Use custom pg_hba.conf

When disabled, PgBouncer uses the same pg_hba.conf settings as the ADB service. When enabled, the Custom pg_hba.conf field becomes available to let you specify custom authentication settings for PgBouncer

false

Custom pg_hba.conf

Custom pg_hba rules for PgBouncer. Available when the Use custom pg_hba.conf option is enabled. When configuring these rules, consult the Allow PgBouncer connections section below

 — 

Enable ADB LDAP settings

When enabled, adds the same LDAP authentication rules to PgBouncer as configured for ADB, except that the +ldap_users group is replaced with all. Requires LDAP to be enabled in the ADB service configuration

false

SSL

Enables SSL/TLS encryption for client connections to PgBouncer. When enabled, you can provide custom certificates or reuse certificates from the ADB service

false

PgBouncer TLS mode

Specifies the client_tls_sslmode value for PgBouncer. Available if the SSL option is enabled. Allowed values: disable, allow, require, verify-ca, and verify-full

disable

Server certificate

The contents of the server certificate file (.crt) used for client connections to PgBouncer. Available if the SSL option is enabled. If provided, the certificate is copied to /etc/pgbouncer/crt_from_adcm.crt on the PgBouncer host. If not provided, but SSL is enabled, the value of the Server certificate field from the ADB configuration parameters is used

 — 

Server private key

The contents of the server private key file (.key) used for client connections to PgBouncer. Available if the SSL option is enabled. If provided, the key is copied to /etc/pgbouncer/key_from_adcm.key on the PgBouncer host. If not provided, but SSL is enabled, the value of the Server private key field from the ADB configuration parameters is used

 — 

Root certificate

The contents of the root CA certificate file (.crt) to verify client certificates. Available if the SSL option is enabled. If provided, the certificate is copied to /etc/pgbouncer/root_crt_from_adcm.crt on the PgBouncer host. If not provided, but SSL is enabled, the value of the Root certificate field from the ADB configuration parameters is used

 — 

User-specific parameters for PgBouncer

Additional lines in the <username> = <settings> format that will be added to the [users] section of pgbouncer.ini

 — 

Custom PgBouncer section

Additional lines that will be added to the [pgbouncer] section of pgbouncer.ini

 — 

Allow PgBouncer connections

When configuring PgBouncer parameters, pay attention to the following:

  • If PgBouncer is installed on the master host, a rule with the local type must be added in the Custom pg_hba.conf configuration parameter of the ADB service to allow local connections to ADB via PgBouncer:

    local   <database_name>  <user_name>     <auth_method>

  • If PgBouncer is installed on a separate host, then a rule with the host type and the IP address of the PgBouncer host must be added in the Custom pg_hba.conf configuration parameter of the ADB service:

    host    <database_name>  <user_name>  <PgBouncer_IP_address>   <auth_method>

  • To allow connections to PgBouncer, the Use custom pg_hba.conf parameter of the PgBouncer service can be used to set up PgBouncer-specific rules. If this option is disabled, the rules from the ADB pg_hba.conf file are used. In this case, note that PgBouncer HBA implementation has limitations compared to the PostgreSQL pg_hba.conf format. Refer to the HBA file format section of the PgBouncer documentation for more details.

Found a mistake? Seleсt text and press Ctrl+Enter to report it