Databases

Overview

The database monitors connect to your PostgreSQL, MySQL/MariaDB or MongoDB server the way your application does, run a query, and check the result. Unlike a TCP check on port 5432, this proves the server accepts connections, authenticates you, and actually answers — and it records the connect + query latency on every check.

Three monitor types, one behaviour:

Type	Schemes accepted	Default port	Default query
PostgreSQL	postgres://, postgresql://	5432	SELECT 1
MySQL	mysql://, mariadb://	3306	SELECT 1
MongoDB	mongodb://, mongodb+srv://	27017	{ "ping": 1 }

MariaDB speaks the MySQL protocol — use the MySQL type.

How it works

1. The agent opens a connection to the server (TLS when the URL asks for it) and authenticates with the monitor’s user and password.
2. It runs the configured query — or the type’s default.
3. The result is compared to the optional result check. Connection refused, authentication failure, a query error or a timeout all count as a failed check; a result outside the expected value counts as a failed check too.

Latency is the full connect + query time, so a database that is getting slower shows up as a trend on the monitor’s chart long before it stops answering.

Settings

Setting	Description	Default
Connection URL	postgres://host:5432/dbname?sslmode=require, mongodb://host1,host2/admin?replicaSet=rs0&tls=true	—
Database user	Login used for the check	—
Database password	Stored encrypted	—
Test query	SQL statement, or a MongoDB command document as JSON	SELECT 1 / { "ping": 1 }
Result check	Operator + expected value applied to the query result (optional)	none
Skip TLS validation	Accept a self-signed certificate	off
Interval	Check frequency	plan-dependent
Timeout	Fixed check budget, connect + query (not configurable)	5s

Where the credentials go

Paste the connection URL exactly as your provider gives it, credentials included. Anything before the @ is moved to the user and password fields and the URL is saved without it:

you paste   mongodb://monitoring:s3cret@node1.example.net,node2.example.net/admin?replicaSet=rs0&tls=true
saved URL   mongodb://node1.example.net,node2.example.net/admin?replicaSet=rs0&tls=true
user        monitoring        (encrypted)
password    s3cret            (encrypted)

The URL is what the monitors list, alert messages, public status pages, the audit log and the GDPR export show. The user and password are encrypted at rest, masked as *** in the API and in every export, and scrubbed from error messages. This applies to every monitor type — an https://user:password@host HTTP target is split the same way.

Use a read-only database user created for monitoring. The query runs with that user’s privileges, nothing else limits it.

TLS

The URL decides whether TLS is used, with each engine’s own convention:

• PostgreSQL — ?sslmode=require (or verify-ca, verify-full)
• MySQL / MariaDB — ?ssl-mode=REQUIRED (or tls=true)
• MongoDB — ?tls=true; mongodb+srv:// URLs always use TLS

The server’s certificate is validated against the public roots. For a self-signed certificate, tick Skip TLS certificate validation on the monitor.

Result check

The query result is reduced to one value:

• SQL — the first column of the first row. SELECT count(*) FROM jobs WHERE status = 'stuck' gives a number; SELECT pg_is_in_recovery() gives t/f.
• MongoDB — the command’s reply document. Pick a field with a dot path (ok, members.0.stateStr, repl.setName); leave the path empty to compare the whole reply.

Then choose an operator (==, !=, contains, >, <, >=, <=) and the expected value. Numeric operators compare numbers; the others compare text.

Examples:

Engine	Query	Check	Meaning
PostgreSQL	SELECT count(*) FROM jobs WHERE status='stuck'	< 10	job queue is not backing up
PostgreSQL	SELECT extract(epoch from now() - pg_last_xact_replay_timestamp())	< 30	replica lag under 30 s
MySQL	SHOW STATUS LIKE 'Threads_connected'	(first column is the name — use a subquery)	—
MySQL	SELECT count(*) FROM information_schema.processlist	< 200	connection count under 200
MongoDB	{ "replSetGetStatus": 1 }	members.0.stateStr == PRIMARY	node 0 is the primary
MongoDB	{ "serverStatus": 1 }	connections.current < 500	connection count under 500

Without a result check, connecting and running the query successfully is the whole check.

Private databases

A database that is not reachable from the internet — and most should not be — is monitored from a private agent running inside your network. The check is identical; only the agent doing it changes. Public regions refuse targets that resolve to private addresses.

Metrics

Connect + query time is recorded on every check and drives the same latency chart, percentiles and alerts as an HTTP monitor.