FAQ
The questions asked most often about Database Health Monitor, answered.
Several checks read "unknown". Is the install broken?
No — that is the intended state until you finish configuring them.
Three checks watch models you nominate (integration failures, backlog, credential expiry) and read unknown until you register a source. Two need a host agent and read unknown until one reports.
Unknown is a deliberate fourth state, not a failure. It means nobody can answer the question yet. A dashboard that showed green instead would be worse than no dashboard, because somebody would believe it.
Why can it not see my disk space by itself?
Because it never runs an operating-system command. Giving an ERP process the ability to shell out is a bigger problem than not knowing the disk is full — it is the same capability an attacker wants most.
A small agent on the host POSTs the figure to a token-protected endpoint instead. There is no fallback guess, because a guess about free disk is worse than an honest gap.
Can a failing probe take Odoo down?
No, and this is the design decision the module is built around. Every probe runs in its own savepoint with a five-second statement timeout. Anything that goes wrong is caught and stored as an unknown reading carrying the error text.
The failure mode it avoids: a monitoring cron that raises gets switched off by Odoo after a week of failing, and the first symptom is silence — which is also what a healthy system looks like.
Will it fix anything it finds?
No. No VACUUM, no reactivating a cron, no clearing a queue. A monitor that also acts is two systems whose failures compound, and one bad remediation costs you both the fix and your trust in the monitoring.
Does it take backups?
No. It reports what an agent tells it about them — age and size. It does not take them and it cannot verify that one restores. Only a restore proves a restore.
Why is the metrics route off by default?
Prometheus text format cannot avoid naming every check you have. That is fine on a private network and not something to hand to the internet. Status is the one designed to be exposed: it returns a severity and a count, and 503 for critical or unknown, so an uptime checker works on the status code alone.
Why is the token not accepted in a query string?
A token in a URL ends up in the web server's access log, the browser history and every proxy in between. Authorization: Bearer is the header it belongs in.
Can I rotate the token without downtime?
Yes. Rotation keeps the previous token valid for a grace period, so you can roll the agent and the uptime checker separately and neither has a gap.
Server errors reads zero. Is that real?
It counts rows in ir_logging, so it depends on the server's log_db setting. If log_db is off, nothing is written there and zero means "not recorded" rather than "none happened". The reading says so rather than leaving you to work it out.
Why two switches for alerting?
The company has a master switch and each check has its own, and both must be on. Turning everything off for a migration should not mean unticking thirteen checks and remembering to put them all back.
Acknowledging did not clear the red
Correct. Acknowledging clears the cooldown so the next alert can arrive; it does not change the severity. Seeing a problem is not fixing one, and a dashboard that goes green because somebody clicked acknowledge is a dashboard that lies.
Does it work in a multi-company database?
Yes. Checks, readings, sources and the endpoint are all company-scoped, and there is one endpoint record with its own token per company.