Metrics and Logging Settings

This page covers settings that control behavior related to MinIO metrics and logging. See Metrics and alerts for more information.

These settings configure publishing regular minio server logs and audit logs to an HTTP webhook. See Publish Server or Audit Logs to an External Service for more complete documentation.

You can establish or modify settings by defining:

• an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
• a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

• Server Logs
• Webhook Audit Logs
• Kafka Audit Logs

Prometheus Authentication

This setting controls how MinIO authenticates to Prometheus.

• Environment Variable
• Configuration Setting

Specifies the authentication mode for the Prometheus scraping endpoints.

• jwt - Default MinIO requires that the scraping client specify a JWT token for authenticating requests.

  Use mc admin prometheus generate to generate the necessary JWT bearer tokens.

• public MinIO does not require that scraping clients authenticate their requests.

Server Logs

The following section documents settings for configuring MinIO to publish minio server logs to an HTTP webhook endpoint. See Publish Server Logs to HTTP Webhook for more complete documentation and tutorials on using these settings.

Defining Multiple Endpoints

You can specify multiple webhook endpoints as log targets by appending a unique identifier _ID for each set of related logging environment variables. For example, the following settings define two distinct server logs webhook endpoints:

• Environment Variables
• Configuration Setting

export MINIO_LOGGER_WEBHOOK_ENABLE_PRIMARY="on"
export MINIO_LOGGER_WEBHOOK_AUTH_TOKEN_PRIMARY="TOKEN"
export MINIO_LOGGER_WEBHOOK_ENDPOINT_PRIMARY="http://webhook-1.example.net"

export MINIO_LOGGER_WEBHOOK_ENABLE_SECONDARY="on"
export MINIO_LOGGER_WEBHOOK_AUTH_TOKEN_SECONDARY="TOKEN"
export MINIO_LOGGER_WEBHOOK_ENDPOINT_SECONDARY="http://webhook-2.example.net"

mc admin config set logger_webhook:primary \
   endpoint="http://webhook-01.example.net" [ARGUMENTS=VALUE ...]

mc admin config set logger_webhook:secondary \
   endpoint="http://webhook-02.example.net" [ARGUMENTS=VALUE ...]

Settings

Enable

• Environment Variable
• Configuration Setting

Endpoint

Required

• Environment Variable
• Configuration Setting

The HTTP endpoint of the webhook.

Auth Token

Optional

• Environment Variable
• Configuration Setting

export MINIO_LOGGER_WEBHOOK_AUTH_TOKEN_myendpoint="Bearer 1a2b3c4f5e"

export MINIO_LOGGER_WEBHOOK_AUTH_TOKEN_xyz="ServiceXYZ 1a2b3c4f5e"

   mc admin config set myminio logger_webhook   \
      endpoint="https://webhook-1.example.net"  \
      auth_token="Bearer 1a2b3c4f5e"

   mc admin config set myminio logger_webhook   \
        endpoint="https://webhook-1.example.net"  \
      auth_token="ServiceXYZ 1a2b3c4f5e"

Batch Size

Optional

• Environment Variable
• Configuration Setting

Collect and send the specified number of events to the webhook as a batch. If not set, MinIO sends one event per request.

Client Certificate

Optional

Requires also setting the Client Key.

• Environment Variable
• Configuration Setting

The path to the mTLS certificate to use for authenticating to the webhook logger.

Client Key

Optional

Required if you define the Client Certificate.

• Environment Variable
• Configuration Setting

The path to the mTLS certificate key to use to authenticate with the webhook logger service.

Proxy

Optional

• Environment Variable
• Configuration Setting

Define a proxy to use for the webhook logger when communicating from MinIO to external webhooks.

Queue Directory

Optional

• Environment Variable
• Configuration Setting

Specify the directory path, such as /opt/minio/events, to enable MinIO’s persistent event store for undelivered messages. The MinIO process must have read, write, and list access on the specified directory.

MinIO stores undelivered events in the specified store while the webhook service is offline and replays the stored events when connectivity resumes.

Queue Size

Optional

• Environment Variable
• Configuration Setting

An integer value to use for the queue size for logger webhook targets.

Webhook Audit Logs

The following section documents environment variables for configuring MinIO to publish audit logs to an HTTP webhook endpoint. See Publish Audit Logs to HTTP Webhook for more complete documentation and tutorials on using these environment variables.

Multiple Targets

You can specify multiple webhook endpoints as audit log targets by appending a unique identifier _ID for each set of related logging settings.

For example, the following commands set two distinct audit log webhook endpoints:

• Environment Variables
• Configuration Setting

export MINIO_AUDIT_WEBHOOK_ENABLE_PRIMARY="on"
export MINIO_AUDIT_WEBHOOK_AUTH_TOKEN_PRIMARY="TOKEN"
export MINIO_AUDIT_WEBHOOK_ENDPOINT_PRIMARY="http://webhook-1.example.net"
export MINIO_AUDIT_WEBHOOK_CLIENT_CERT_SECONDARY="/tmp/cert.pem"
export MINIO_AUDIT_WEBHOOK_CLIENT_KEY_SECONDARY="/tmp/key.pem"

export MINIO_AUDIT_WEBHOOK_ENABLE_SECONDARY="on"
export MINIO_AUDIT_WEBHOOK_AUTH_TOKEN_SECONDARY="TOKEN"
export MINIO_AUDIT_WEBHOOK_ENDPOINT_SECONDARY="http://webhook-1.example.net"
export MINIO_AUDIT_WEBHOOK_CLIENT_CERT_SECONDARY="/tmp/cert.pem"
export MINIO_AUDIT_WEBHOOK_CLIENT_KEY_SECONDARY="/tmp/key.pem"

mc admin config set audit_webhook \
   endpoint="http://webhook.example.net" [ARGUMENTS=VALUE ...]

mc admin config set audit_webhook:primary \
   endpoint="http://webhook-01.example.net" [ARGUMENTS=VALUE ...]


mc admin config set audit_webhook:secondary \
   endpoint="http://webhook-02.example.net" [ARGUMENTS=VALUE ...]

Settings

Enable

• Environment Variable
• Configuration Setting

Endpoint

Required

• Environment Variable
• Configuration Setting

The HTTP endpoint of the webhook.

Auth Token

Optional

• Environment Variable
• Configuration Setting

An authentication token of the appropriate type for the endpoint. Omit for endpoints which do not require authentication.

To allow for a variety of token types, MinIO creates the request authentication header using the value exactly as specified. Depending on the endpoint, you may need to include additional information.

• Environment Variable
• Configuration Setting

export MINIO_AUDIT_WEBHOOK_AUTH_TOKEN_myendpoint="Bearer 1a2b3c4f5e"

export MINIO_AUDIT_WEBHOOK_AUTH_TOKEN_xyz="ServiceXYZ 1a2b3c4f5e"

mc admin config set myminio audit_webhook       \
         endpoint="http://webhook.example.net"  \
         auth_token="Bearer 1a2b3c4f5e"

mc admin config set myminio audit_webhook       \
         endpoint="http://webhook.example.net"  \
         auth_token="ServiceXYZ 1a2b3c4f5e"

Consult the documentation for the desired service for more details.

Batch Size

Optional

• Environment Variable
• Configuration Setting

Collect and send the specified number of events to the webhook as a batch. If not set, MinIO sends one event per request.

Client Certificate

Optional

• Environment Variable
• Configuration Setting

The x.509 client certificate to present to the HTTP webhook. Omit for webhooks which do not require clients to present a known TLS certificate.

Client Key

Optional

• Environment Variable
• Configuration Setting

The x.509 private key to present to the HTTP webhook. Omit for webhooks which do not require clients to present a known TLS certificate.

Queue Directory

Optional

• Environment Variable
• Configuration Setting

Specify the directory path, such as /opt/minio/events, to enable MinIO’s persistent event store for undelivered messages. The MinIO process must have read, write, and list access on the specified directory.

MinIO stores undelivered events in the specified store while the webhook service is offline and replays the stored events when connectivity resumes.

Queue Size

Optional

• Environment Variable
• Configuration Setting

An integer value to use for the queue size for audit webhook targets. The default is 100000 events.

Kafka Audit Logs

The following section documents environment variables for configuring MinIO to publish audit logs to a Kafka broker.

audit_kafka

mc-conf

The top-level configuration key for defining a Kafka broker target for publishing MinIO audit logs.

Use mc admin config set to set or update a Kafka audit target. Specify additional optional arguments as a whitespace (" ")-delimited list.

mc admin config set audit_kafka \
   brokers="https://kafka-endpoint.example.net:9092" [ARGUMENTS=VALUE ...]

Settings

Enable

Required

• Environment Variable
• Configuration Setting

Brokers

Required

• Environment Variable
• Configuration Setting

A comma-separated list of Kafka broker addresses:

brokers="https://kafka-1.example.net:9092,https://kafka-2.example.net:9092"

At least one broker must be online and reachable by the MinIO server to initialize and send audit log events. MinIO checks each specified broker in order of specification.

Topic

Required

• Environment Variable
• Configuration Setting

The name of the Kafka topic to associate to MinIO audit log events.

TLS

Optional

• Environment Variable
• Configuration Setting

Set to "on" to enable TLS connectivity to the specified Kafka brokers.

Defaults to "off".

TLS Skip Verify

Optional

• Environment Variable
• Configuration Setting

Set to "on" to direct MinIO to skip verification of the Kafka broker TLS certificates.

You can use this option for enabling connectivity to Kafka brokers using TLS certificates signed by unknown parties, such as self-signed or corporate-internal Certificate Authorities (CA).

MinIO by default uses the system trust store and the contents of the MinIO CA directory for verifying remote client TLS certificates.

Defaults to "off" for strict verification of TLS certificates.

SASL

Optional

• Environment Variable
• Configuration Setting

Set to "on" to direct MinIO to use SASL to authenticate against the Kafka brokers.

SASL Username

Optional

• Environment Variable
• Configuration Setting

The SASL username MinIO uses for authentication against the Kafka brokers.

SASL Password

Optional

• Environment Variable
• Configuration Setting

The SASL password MinIO uses for authentication against the Kafka brokers.

SASL Mechanism

Optional

• Environment Variable
• Configuration Setting

The SASL mechanism MinIO uses for authentication against the Kafka brokers.

Defaults to plain.

TLS Client Auth

Optional

• Environment Variable
• Configuration Setting

Set to "on" to direct MinIO to use mTLS to authenticate against the Kafka brokers.

Client TLS Certificate

Optional

• Environment Variable
• Configuration Setting

The path to the TLS client certificate to use for mTLS authentication.

Client TLS Key

Optional

• Environment Variable
• Configuration Setting

The path to the TLS client private key to use for mTLS authentication.

Version

Optional

• Environment Variable
• Configuration Setting

The version of the Kafka broker MinIO expects at the specified endpoints.

MinIO returns an error if the Kakfa broker version does not match those specified to this setting.

Comment

Optional

• Environment Variable
• Configuration Setting

A comment to associate with the configuration.

Queue Directory

Optional

• Environment Variable
• Configuration Setting

Specify the directory path to enable MinIO’s persistent event store for undelivered messages, such as /opt/minio/events.

MinIO stores undelivered events in the specified store while the Kafka service is offline and replays the stored events when connectivity resumes.

Queue Size

Optional

• Environment Variable
• Configuration Setting

Specify the maximum limit for undelivered messages. Defaults to 100000.