Automation Suite on Linux installation guide

Last updated Nov 13, 2025

Monitoring Automation Suite

Automation Suite includes pre-configured Prometheus, Grafana, and Alert manager components by default, offering:

Ready-to-use dashboards
Out-of-the-box alert rules
Integrated logs and metrics for core components

Alternatively, you can export metrics to your own monitoring tools. For details, see External monitoring tools.

For a list of components that you can monitor, see Deployment architecture.

Using the monitoring stack

Note:

Node failures might lead to a Kubernetes shutdown, which would disrupt Prometheus alerts. To prevent this, we recommend setting up a separate alert on the RKE2 server.

You must configure alert receivers to prevent any issues that may lead to downtime.
You can refer to dashboards for regular monitoring.
You can refer to logs for troubleshooting.

Accessing the monitoring tools

Overview

You can access the Automation Suite monitoring tools individually using the following URLs:

Application	Tool	URL	Example
Metrics	Prometheus	`https://monitoring.fqdn/metrics`	`https://monitoring.automationsuite.mycompany.com/metrics`
Dashboard	Grafana	`https://monitoring.fqdn/grafana`	`https://monitoring.automationsuite.mycompany.com/grafana`
Alert Management	Alert Manager	`https://monitoring.fqdn/alertmanager`	`https://monitoring.automationsuite.mycompany.com/alertmanager`

For details on how to fetch Grafana credentials, refer to the Accessing Grafana dashboard section.

Note: If you have excluded the built-in monitoring components, the related tools and URLs will not be available. For details, refer to Optional: Configuring the monitoring solution.

Monitoring tool authentication

To access the monitoring tools for the first time, log in as an admin with the following default credentials:

Username: admin
Password: to retrieve the password , run the following command:
```
kubectl get secrets/dex-static-credential -n uipath -o "jsonpath={.data['password']}" | base64 --decodekubectl get secrets/dex-static-credential -n uipath -o "jsonpath={.data['password']}" | base64 --decode
```

Dex authentication

To update the default password used for Dex authentication while accessing the monitoring tools, take the following steps.

Note:

Dex is a basic authentication method layered over the monitoring tools. Therefore, updating the Dex password does not impact the passwords for the monitoring tools. In this scenario, the passwords for the monitoring tools remain the same as before.

Run the following command by replacing newpassword with your new password:

password="newpassword"
password=$(echo -n $password | base64)
kubectl patch secret dex-static-credential -n uipath --type='json' -p="[{'op': 'replace', 'path': '/data/password', 'value': '$password'}]"password="newpassword"
password=$(echo -n $password | base64)
kubectl patch secret dex-static-credential -n uipath --type='json' -p="[{'op': 'replace', 'path': '/data/password', 'value': '$password'}]"

Run the following command to update the password:

./bin/uipathctl manifest apply /opt/UiPathAutomationSuite/cluster_config.json --versions versions/helm-charts.json./bin/uipathctl manifest apply /opt/UiPathAutomationSuite/cluster_config.json --versions versions/helm-charts.json

Integrating external monitoring tools

If your organization prefers to use a centralized observability platform (such as Datadog, ELK, New Relic), you can disable the built-in monitoring components during installation by updating the cluster_config.json configuration file. For details, refer to Optional: Configuring the monitoring solution.

Exporting critical metrics

When you use an external monitoring solution, certain critical platform metrics, such as certificate expiry, must be collected and monitored to maintain platform reliability and security.

To support this, Automation Suite deploys Pushgateway even when built-in monitoring is excluded. Pushgateway pushes important metrics at regular intervals so that external systems can scrape them and generate alerts.

Internal platform jobs collect certificate and license expiry data and send it to Pushgateway. Your external Prometheus instance can then scrape the endpoint and trigger alerts as needed.

The following critical metrics are available through Pushgateway for external monitoring:

Metric name	Description
`rke2-cert-expiry`	Number of days until RKE2 node or server certificates expire.
`tls-cert-expiry`	Number of days until TLS certificates in Kubernetes secrets expire.
`redis-license-expiry`	Number of days until the Redis Enterprise license expires.
`signing-certificate-expires-30`	Indicates that an identity signing certificate expires in 30 days.
`signing-certificate-expires-7`	Indicates that an identity signing certificate expires in 7 days.

The following example shows the tls-cert-expiry metric when scraped by Prometheus:

tls_cert_expiry {
  certname="ca.crt",
  instance="",
  job="tls-cert-expiry",
  ns="istio-system",
  secret="istio-ingressgateway-certs"
} 10tls_cert_expiry {
  certname="ca.crt",
  instance="",
  job="tls-cert-expiry",
  ns="istio-system",
  secret="istio-ingressgateway-certs"
} 10