Skip to main content

MongoDB operations

v0.3.12

Replica-set + shard-cluster introspection, slow-query identification, collection stats, plus remediation surface (killOp, replSet stepDown, collection compact, dropIndex). Authenticates via MONGO_URI env var on the runner host.

31 allowed by default 3 need approval by default 1 denied by default
Pack ID
mongodb
Vendor
emisar
OS
linux
Actions
35
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
mongosh

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host
sudo emisar pack install mongodb --hash sha256:afbe47cd3b4ff35ea31013fd0193d9ef56cbda90cdf3af4b0f17afc3454d05ee

Setup

Every action reads MONGO_URI from its environment and connects inside the mongosh eval (new Mongo(process.env. MONGO_URI )), so the host, port, replica set, auth database, and credentials all live in that single URI — and the credential never lands on mongosh's argv (/proc/<pid>/cmdline).

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • MONGO_URI required

    Full MongoDB connection string, including credentials and any auth/TLS options.

Notes

  • Create the user with db.createUser({user: 'emisar', pwd: '...', roles: [{role: 'clusterMonitor', db: 'admin'}]}) on a self-managed deployment, or under Database Access → Add New Database User on Atlas.
  • mongosh does not read MONGO_URI on its own; each action connects with new Mongo(process.env. MONGO_URI ) inside its --eval, so the user it encodes needs the privileges (clusterMonitor for reads, plus killOp/replSetStateChange/compact/dropIndex for the mutators) for the actions you enable.
  • Because the URI carries the credentials, it must be allowlisted in inherit_env for any action to reach the database.

Verify it works

Runs mongo.server_status, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host
sudo emisar pack verify mongodb

Install and configure a pack walks through the whole sequence on a host.

Actions 35 total

View on GitHub
  • mongo.balancer_status exec low Low — read-only or trivially reversible

    sh.getBalancerState()

    Show whether the balancer is enabled + currently running.

    View source on GitHub
  • mongo.build_info exec low Low — read-only or trivially reversible

    buildInfo

    Show server version + build flags.

    View source on GitHub
  • mongo.collection_list exec low Low — read-only or trivially reversible

    db.getCollectionNames()

    List collections in one database.

    View source on GitHub
  • mongo.collection_stats exec low Low — read-only or trivially reversible

    db.<coll>.stats()

    Show per-collection totals — count, size, storage, indexes.

    View source on GitHub
  • mongo.compact_collection exec high High — service-affecting

    db.runCommand({compact:"<coll>"})

    Compact one collection on the connected node. Reclaims disk for WiredTiger after large deletes. BLOCKS reads/writes on the collection during compaction. Run during a low-traffic window; prefer running on a secondary first.

    View source on GitHub
  • mongo.concurrent_transactions exec low Low — read-only or trivially reversible

    Read/write tickets (concurrency saturation)

    Show read/write ticket pools — out vs available. Queued/exhausted tickets are the classic sign of storage-engine overload. Version-tolerant: reads queues.execution on MongoDB 8.0+, else wiredTiger.concurrentTransactions (<= 7.0).

    View source on GitHub
  • mongo.connection_stats exec low Low — read-only or trivially reversible

    Incoming connection saturation (serverStatus.connections)

    Show incoming connection counts — current, available, active, totalCreated. Approaching the available limit means new clients will be refused. Distinct from connections (connPoolStats), which is the outgoing pool.

    View source on GitHub
  • mongo.connections exec low Low — read-only or trivially reversible

    connPoolStats

    Show connection pool stats — totals, active, available, by host.

    View source on GitHub
  • mongo.current_op exec medium Medium — changes state, easily reversible

    db.currentOp()

    List in-flight operations. The canonical "what is the server doing right now?" check. Rated medium because an operation can include full command arguments and literal query values that no redaction list can enumerate.

    View source on GitHub
  • mongo.cursor_stats exec low Low — read-only or trivially reversible

    Cursor saturation / timed-out cursors (metrics.cursor)

    Show cursor counts — open.total, open.noTimeout, open.pinned, timedOut, totalOpened. A growing timedOut count usually means an application is leaking cursors.

    View source on GitHub
  • mongo.db_list exec low Low — read-only or trivially reversible

    listDatabases

    List all databases with size + empty flag.

    View source on GitHub
  • mongo.db_stats exec low Low — read-only or trivially reversible

    db.stats()

    Show database-level totals — collections, indexes, data size, storage size.

    View source on GitHub
  • mongo.default_rw_concern exec low Low — read-only or trivially reversible

    Default read/write concern (getDefaultRWConcern)

    Show cluster default read and write concern (e.g. w:majority) and its source. The durability/consistency config for the replica set — a weakened default write concern is a common cause of surprising data loss on failover.

    View source on GitHub
  • mongo.drop_index exec high High — service-affecting

    db.<coll>.dropIndex("<name>")

    Drop one index from a collection. Use to remove a hot or unused index discovered via index_stats. Queries that relied on the index degrade to COLLSCAN until rebuilt or replaced.

    View source on GitHub
  • mongo.election_metrics exec low Low — read-only or trivially reversible

    Election / stepdown history (electionMetrics)

    Show cumulative election and stepdown counters for this member — stepUpCmd, priorityTakeover, electionTimeout, catchUpTakeover, numStepDownsCausedBy HigherTerm, numCatchUps. Use to see how often the set has been re-electing.

    View source on GitHub
  • mongo.explain_query exec low Low — read-only or trivially reversible

    explain a find()

    Show the query plan for `find(filter)` on one collection at `queryPlanner` verbosity — the plan MongoDB would choose, without running it. Mirrors `postgres.explain_query`; `executionStats` verbosity is not used here because it runs the winning plan to completion, which is a real read against a production primary rather than the plan-only inspection this action's risk tier promises.

    View source on GitHub
  • mongo.get_parameter exec low Low — read-only or trivially reversible

    getParameter '*'

    List all server parameters (read-only view of the current config).

    View source on GitHub
  • mongo.global_lock exec low Low — read-only or trivially reversible

    Global lock queue / active clients (globalLock)

    Show global lock contention — currentQueue (total/readers/writers) waiting on the lock, and activeClients (total/readers/writers). A growing queue points to lock contention or an overloaded server.

    View source on GitHub
  • mongo.host_info exec low Low — read-only or trivially reversible

    hostInfo

    Show host CPU, memory, NUMA layout, OS.

    View source on GitHub
  • mongo.index_builds exec medium Medium — changes state, easily reversible

    In-progress index builds (with progress)

    List active index-build operations with progress (done/total), via $currentOp. The canonical "is an index build stuck / how far along is it" check across the deployment. Rated medium because the full operation document can include partial-index filter values and arbitrary command comments that no redaction list can enumerate.

    View source on GitHub
  • mongo.index_stats exec low Low — read-only or trivially reversible

    $indexStats aggregation

    Show per-index access counts since server start. Zeros usually mean unused indexes.

    View source on GitHub
  • mongo.kill_op exec high High — service-affecting

    db.killOp(opid)

    Kill one in-flight operation by opid.

    View source on GitHub
  • mongo.long_running_ops exec medium Medium — changes state, easily reversible

    Long-running active ops (currentOp, secs_running >= N)

    List active operations that have been running at least N seconds — the canonical hunt for a hung or blocked op. Filters currentOp by secs_running. Rated medium because an operation can include full command arguments and literal query values that no redaction list can enumerate.

    View source on GitHub
  • mongo.oplog_size exec low Low — read-only or trivially reversible

    Oplog size + window

    Show oplog size + first/last timestamps + estimated time window. The canonical "how far can a secondary fall behind?" check.

    View source on GitHub
  • mongo.profile_slow_queries exec medium Medium — changes state, easily reversible

    Read slow ops from the profiler (system.profile)

    Read the database profiler collection (system.profile) for the slowest recent ops over a millis threshold, newest first. Requires profiling to be enabled on the database already (see profiler_status); does not change it. Rated medium because a profiler document can include the full command and literal query values that no redaction list can enumerate.

    View source on GitHub
  • mongo.profiler_status exec low Low — read-only or trivially reversible

    db.getProfilingStatus()

    Show profiler level + slow-op threshold for one database.

    View source on GitHub
  • mongo.replication_info exec low Low — read-only or trivially reversible

    Oplog time window (db.getReplicationInfo)

    Show oplog time window — logSizeMB, usedMB, timeDiff / timeDiffHours, tFirst, tLast. How much history the oplog retains, which bounds how long a secondary can be down before it needs a full resync. Distinct from oplog size.

    View source on GitHub
  • mongo.replset_config exec low Low — read-only or trivially reversible

    rs.conf()

    Show replica set configuration — members, votes, priorities, settings.

    View source on GitHub
  • mongo.replset_lag exec low Low — read-only or trivially reversible

    Replication lag (secs behind primary)

    Show per-member seconds behind the primary, computed from rs.status() optimeDate (with state, health, sync source, ping). The canonical replica-set lag check.

    View source on GitHub
  • mongo.replset_status exec low Low — read-only or trivially reversible

    rs.status()

    Show replica set member health, lag, last applied optime.

    View source on GitHub
  • mongo.replset_stepdown exec critical Critical — data loss or irreversible

    rs.stepDown(<seconds>)

    Force the current primary to step down. Replica set elects a new primary; ~5–15s of write unavailability is typical. Use during planned failover when one secondary is known healthier.

    View source on GitHub
  • mongo.server_status exec low Low — read-only or trivially reversible

    db.serverStatus()

    Show top-level server metrics: connections, ops counters, memory, cluster role.

    View source on GitHub
  • mongo.shard_status exec medium Medium — changes state, easily reversible

    sh.status()

    Show sharded cluster summary — shards, databases, and chunk distribution. Rated medium because verbose chunk ranges can include real shard-key values from application data.

    View source on GitHub
  • mongo.top exec low Low — read-only or trivially reversible

    db.adminCommand({top:1})

    Show per-collection time spent in reads/writes/commands. Mongo "top" for query traffic.

    View source on GitHub
  • mongo.wiredtiger_cache exec low Low — read-only or trivially reversible

    WiredTiger cache pressure (serverStatus.wiredTiger.cache)

    Show WiredTiger cache pressure — bytes currently in cache vs maximum configured, tracked dirty bytes, pages evicted by application threads, and pages read into cache. Application-thread eviction and a full dirty cache indicate memory pressure.

    View source on GitHub