Support Center Home


Credential Vault Integration for the LM Collector

Note: The Credential Vault Integration for the LM Collector is currently an open beta.

The Credential Vault integration for the LogicMonitor Collector makes it possible to store and manage sensitive information (including credentials and secrets for hosts, devices, services, etc.) in an external credential vault. 

LogicMonitor Collector supports the following vault integrations:

Note: Support for the Credential Vault Integration was added in EA Collector 29.108. Refer to the relevant vault integration topics for supported Collector versions.

Integrating Credential Vault Properties

To integrate the Credential Vault with LogicMonitor Collector, complete the following steps.

1. Navigate to Resource> Device> Collector> Info tab and add vault metadata properties to the Collector. For
more information on vault properties, see Adding Vault Properties.

2. Click Settings on the left panel and select Collectors.

3. Select the required Collector and click the Settings icon under the Manage column.

4. On the Manage Collector dialog box, select Collector Configuration from the Support drop-down list.

5. Ensure to set the vault.bypass value to false in agent.conf. Additionally, you can add the required agent
configuration properties to set the Collector. For more information, see  Collector Configurations.

Collector Configurations

The following table lists the configuration properties to set in the Collector agent.conf.

PropertyTypeDefaultDescription
vault.bypass
BooleanTRUEIf the value for the property is true, the vault API calls won’t happen.
Note: You must set the property to false, to enable the vault API calls.
vault.credentials.cache.expirationtime
Integer60The property specifies the value in minutes for the expiry of the credential in the vault cache on the collector. After this time, the credentials in the vault cache will expire.
vault.credentials.refresh.delay
Integer15Controls the Credential Vault integration cache expiration refresh delay in seconds.
vault.url.cache.enabled
BooleanFALSEThe property specifies whether the URL cache is enabled or not. By default the property is set as false; however, if the property is set to true the collector caches the URL and secret value. If the URL for lmvault property is found in the URL cache, the respective secret value is returned, else the API call is made to fetch the secret from the vault. Setting this property to ‘true’ should resolve API rate-limiting issues.
vault.url.cache.max.size
Integer1000The property defines the number of URLs that will be stored in the cache.

Adding Vault Properties

For adding vault properties, such as Vault Metadata and Vault Keys, navigate to Resources > Device > Collector, click Info on the Collector page.

Vault Metadata

The following table lists the Vault Metadata properties.

PropertyDescription
vault.meta.urlThe URL of the vault. 
vault.meta.typeThe type of vault. 
vault.meta.headerThe headers are required for HTTP Get Request. The value for this custom property would be the header separated with & and the header key value separated with = as shown in the below example:
vault.meta.header – Content-Type=application/json&Accept-Encoding=gzip, deflate, br

Vault Keys

Vault keys need to be specified at the device level with suffix .lmvault. 

PropertyDescription
.lmvaultThe custom property for which value should be retrieved from the Vault must be specified at the device level by adding suffix .lmvault. The value of such property would be the path of the key in the Vault.
For example: ssh.user.lmvault = ssh\ssh.user

In This Article