Trusted Ticket Requester

# tableau Tableau Server on Linux (server-linux) - Full Documentation [Skip to main content](#main-content) # About Tableau Advanced Management on Tableau Server **Important:** As of September 16, 2024, Advanced Management is no longer available as an independent add-on option. Advanced Management capabilities are only available if you previously purchased Advanced Management, or if you purchase certain license editions: Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server). Tableau Advanced Management is a collection of features for Tableau Server which provide enhanced security, manageability, and scalability capabilities. The Advanced Management capabilities are available to you if you have Tableau Enterprise. **Note:** Tableau Advanced Management includes several Tableau Server features and two separately installed tools: Tableau Content Migration Tool and the Tableau Resource Monitoring Tool. For more information, see the [feature table](#feature_table) later in this topic. ## Advanced Management Licensing Requirements Advanced Management is licensed on a per Deployment basis on Tableau Server, which may be User-Based or Core-Based. A Deployment includes a licensed production Tableau Server installation and two licensed non-production Tableau Server installations that support the production installation. For more information on Deployment, see the [EULA Documentation](https://mkt.tableau.com/files/Documentation.pdf?_ga=2.77356117.133433043.1563398594-1734029830.1510592172). - Advanced Management can only be activated on a licensed Tableau Server Deployment. This means that your Tableau Server must be first activated with a valid key that is either User-Based or Core-Based, before applying the Advanced Management product key. For more information on how to acquire the Advanced Management capabilities and get the product key, contact your account manager. - When the product key is active and enabled, you can use all the features that are included in Advanced Management. - When the Advanced Management product key is removed or deactivated, you will no longer be able to use the features that require a valid Advanced Management license. Any associated data will not be deleted. Each feature might have slight differences on what happens when the license expires. For more information on the individual features use the links in the table below. The following table lists the features that are included and require a valid Advanced Management license:

Feature	Description	Requirements to use the feature	Version
About Tableau Resource Monitoring Tool	Provides a comprehensive look at the health of Tableau Server. With the Resource Monitoring Tool you can identify issues that cause slow load times, extract failures, and other critical issues and can help you proactively address the issues that impact end user experience.	The installation of Tableau Server that you are monitoring must have an Advanced Management license.	Available in 2019.3 and later. Linux support was introduced in version 2020.4.
About Tableau Content Migration Tool	The Content Migration Tool provides an easy way to copy or migrate content between Tableau Server projects, sites and deployments. You can do this between projects on separate Tableau Server installations (for instance, between a development instance of Tableau Server and a production instance of Tableau Server), or between projects on a single Tableau Server installation.	Both the source Tableau Server (Server that you are moving the content from) and the target Tableau Server (Server that you are moving the content to) must have a valid Advanced Management license. The Content Migration Tool must be installed on a version of Microsoft Windows that supports .NET 4.6.1 (Windows 7 or later, Windows Server 2008R2 or later).	Available in version 2019.3 and later.
Activity Log	The Activity Log writes log events to the vizportal logs folder on the local hard drive for further analysis and auditing.	The Tableau Server must have a valid Advanced Management license.	Available in version 2022.3 and later.
Tableau Server External Repository	Allows you to deploy Tableau Server Repository external to Tableau Server. The Tableau Server Repository is a PostgreSQL database that stores data about all user interactions, extract refreshes, and more.	The Tableau Server that is using an external repository must have a Advanced Management license.	Available in version 2019.3 and later. - AWS supported on Tableau Server version 2019.3 and later. - Azure supported on Tableau Server version 2020.4 and later.
Workload Management through Node Roles	Using node roles, you can configure where certain types of workloads are processed on your Tableau Server installation. The node roles features allows you to dedicate and scale resources to specific workloads (ex: extract refreshes, subscriptions).	The Tableau Server must have a valid Advanced Management license.	Available in version 2019.3 and later.
Tableau Server Key Management System	Gives you additional functionality to configure Tableau Server to use AWS as the KMS for extract encryption.	Tableau Server must have a valid Advanced Management license.	Available in version 2019.3 and later. - AWS supported on Tableau Server version 2019.3 and later. - Azure supported on Tableau Server version 2021.1 and later.
Tableau Server External File Store	Allows you to use network attached storage(NAS) as your File Store. This removes the need to run File Store locally on your Tableau Server	Tableau Server must have a valid Advanced Management license.	Available in version 2020.1 and later.
Tableau Backgrounder Resource Limits	The Tableau Server Resource Limits Manager tracks backgrounder resource usage in relation to the set resource limits to make sure the resource limits are applied correctly.	Tableau Server must have a valid Advanced Management license.	Available in version 2022.1 and later.
Tableau Server Independent Gateway	Tableau Server Independent Gateway allows you to install a Tableau Server-managed reverse proxy on a separate computer. Install Independent Gateway in your DMZ to provide security for your Server installation and all your data. The Independent Gateway can be used in a variety of configurations, and can be scaled to meet your client connection demands.	Tableau Server must have a valid Advanced Management license.	Available in version 2022.1 and later.

## Activating the Advanced Management product key The Advanced Management license is applied to a Tableau Server Installation and can be used for both User-Based and Core-Based installations. Here is a quick overview of how you can activate Advanced Management on your Tableau Server Installation. Use the TSM web interface 1. Open TSM in a browser: https://:8850 2. Click **Licensing** on the **Configuration** tab. Click **Activate License**. 3. Enter or paste your Advanced Management product key and click **Activate**. 4. On the **Register** page, enter your registration information and click **Register**. 5. Follow the prompts and restart Tableau Server after registration is complete. **Note:** If this is a new Tableau Server installation, and you apply an Advanced Management Key before you apply the Tableau Server product key, you will see an error. You may however, continue the installation and apply the Tableau Server product key using the same steps described above. Use the TSM CLI 1. Open a command prompt as administrator on a node in the Tableau Server cluster. 2. Run the following command with your Advanced Management product key to activate the license: `tsm licenses activate -k ` **Note:** If this is a new Tableau Server installation, run the command twice, first with the Tableau Server product key and then with an Advanced Management product key. 3. Apply the changes and restart the Server: `tsm pending-changes apply` ### Who can do this Only Server Administrators can activate Advanced Management license keys. ## Other articles in this section [Skip to main content](#main-content) # About Data Management **Important:** As of September 16, 2024, Data Management is no longer available as an independent add-on option. Data Management capabilities are only available if you previously purchased Data Management, or if you purchase certain license editions: Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server). Data Management is a collection of features and capabilities that helps customers manage Tableau content and data assets in their Tableau Server or Tableau Cloud environment. Starting in Tableau Server 2019.1 and Tableau Cloud 2019.3, Tableau Prep Conductor is available to schedule and monitor flows. Starting in Tableau 2019.3, Tableau Catalog is included in Data Management, making a variety of additional features available to you in the data management space. You can use Tableau Catalog to discover data, curate data assets, communicate data quality, perform impact analysis, and trace the lineage of data used in Tableau content. Starting in Tableau 2021.4, more governance and security features are added to Data Management: virtual connections and data policies. Using the virtual connection editor, you can create: - Virtual connections that provide a sharable central access point to data. - Data policies to apply row-level security at the connection level. ## Data Management Features The following table lists the features for Data Management, including Tableau Catalog, Tableau Prep Conductor, Virtual Connections, and Data Policies. ### Tableau Catalog

Feature	Description
Permissions on metadata	Tableau Catalog enables you to control who can see and manage external assets and what metadata is shown through lineage by setting permissions.
Expanded connect experience - data discovery	Whether you author in the web or in Tableau Desktop, you can now search for and connect to the specific databases and tables used by published data sources and workbooks on your Tableau Server or Tableau Cloud site.
Expanded search	Tableau Catalog expands search to include results based on columns, databases, and tables.
Tag external assets	You can categorize items on Tableau Server and Tableau Cloud with tags, helping users to filter external assets (databases, files, tables, and columns).
Certify databases and tables	Help users find trusted data that meets the standards you set by certifying databases and tables.
Set data quality warnings	You can set warnings to alert users to data quality issues, such as stale or deprecated data.
Lineage and impact analysis	The Lineage tool traces the source of your data. You can use it to analyze the impact of changes to your data, identify which users might be impacted, and email owners of a workbook, data source, or flow, or contacts for a database or table, about data-related updates.
Data Details	Enable users to better understand a published visualization by seeing information about the data used.
Add descriptions to assets	Help users find the data they're looking for by adding descriptions to databases, tables, and columns.
Developer resources	Tableau REST API Metadata Methods	Programmatically add, update, and remove external assets; and add additional metadata to Tableau content and external assets like descriptions.
	Tableau Metadata API	Programmatically query metadata from the content published to Tableau Server or Tableau Cloud. Programmatically update certain metadata using the metadata methods in the Tableau Server REST API. (Note: Tableau Cloud requires Data Management to access the Metadata API, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027.)
	GraphiQL	Explore and test queries against the Metadata API schema using an interactive in-browser tool called GraphiQL. (Note: Tableau Cloud requires Data Management to access GraphiQL, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027.)

### Tableau Prep Conductor | Feature | Description | | --- | --- | | Schedule Flow Tasks in the [Tableau Cloud](https://help.tableau.com/current/online/en-us/prep_conductor_online_schedule_flow_task.htm) or [Tableau Server](https://help.tableau.com/current/server/en-us/prep_conductor_schedule_flow_task.htm) help. | You can create scheduled flow tasks to run a flow at a specific time or on a recurring basis. | | [Monitor Flow Health and Performance](https://help.tableau.com/v0.0/server-linux/en-us/prep_conductor_monitor_flow.htm) | Set up email notifications at the site or server level when flows fail, view and resume suspended flow tasks, and view errors and alerts. | | [Administrative Views for Flows](https://help.tableau.com/v0.0/server-linux/en-us/prep_conductor_admin_views.htm) | Use Administrative Views to monitor the activities related to flows, performance history, and the disk space used at the server or site level. | | Tableau REST API - [flow methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_flow.htm) | Programmatically schedule flows. | ### Virtual connections and data policies | Feature | Description | | --- | --- | | [Create a Virtual Connection](https://help.tableau.com/v0.0/server-linux/en-us/dm_vconn_create_conn.htm) | A Tableau content type that enables you to create a shareable re-usable connection to curated data. | | [Create a Data Policy for Row-Level Security](https://help.tableau.com/v0.0/server-linux/en-us/dm_vconn_create_rlspolicy.htm) | Use the virtual connection editor to create data policies with policy conditions that apply row-level security to the data at the connection level. | | [Test Row-Level Security with Preview as User](https://help.tableau.com/v0.0/server-linux/en-us/dm_vconn_test_preview.htm) | Test the data policy with Preview as user to ensure that users can see only their data. | | [Schedule Extract Refreshes for a Virtual Connection](https://help.tableau.com/v0.0/server-linux/en-us/dm_vconn_extract.htm) | Create an extract refresh schedule for the tables in your connection, ensuring that the data is fresh for any content that uses that virtual connection. | ## Other articles in this section [Skip to main content](#main-content) # About Data Policies Use a data policy when you want to apply row-level security to one or more tables in the connection. Data policies apply to both live and extract connections. A data policy has three main components: ![An example of the three components of a data policy](/tableau/next/en-us/server-linux/en-us/Img/ipa_vconns_policy_components.png) 1. The tables it applies to, called policy tables. These are the tables that are filtered. 2. The mapped columns that define the relationships between tables (for example, between entitlement and fact tables) and between table columns and policy columns. A policy column is the column used to filter data. 3. The policy condition, which is an expression that is evaluated for every row at query time. When TRUE, the row is shown in the query. To get started, click ![Create New Policy button](/tableau/next/en-us/server-linux/en-us/Img/ipa_Create_New_Policy_btn.png). [Read full topic](https://help.tableau.com/current/server-linux/en-us/dm_vconn_create_rlspolicy.htm) ## Related tasks [About the Virtual Connection Editor](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_about_editor.htm) [Add Tables to the Connection](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_add_tables.htm) [Create and Test Data Policies](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_create_data_policy.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) # Extract Upgrade to .hyper Format In Tableau version 2018, we introduced the `.hyper` format for Tableau extracts to replace the old `.tde` format. The `.hyper` format has been the standard format used by Tableau to create extracts since 2018, and the large majority of extracts are now `.hyper` files. Beginning in early 2023, Tableau discontinued support for the `.tde` format on Tableau Cloud and Tableau Public. For more details about this deprecation, see this [Tableau Community post](https://community.tableau.com/s/feed/0D54T00001BHiGwSAL). ## Discontinuation of support for .tde files Beginning in 2023, the `.tde` format for Tableau extracts was deprecated. This format was replaced by the `.hyper` format in 2018 but continued to be valid for uploaded files until March 2023. - This change took place for Tableau Cloud and Tableau Public as of March 2023. - Beginning with version 2023.1.0 of Tableau Server, the uploading of `.tde` format files is disabled. - 2024.2 is the last version of Tableau Desktop that supports any .tde-based workbooks, data sources, or bookmarks. Versions 2024.3 and beyond only support .hyper format. ## Manually upgrade your .tde extract using Tableau Desktop If you manage extracts locally, you can manually upgrade your `.tde` extract to a `.hyper` extract using Tableau Desktop. **Note**: This functionality is only available in Tableau Desktop versions 2024.2 and older. 1. In Tableau Desktop, open a workbook that uses a `.tde` extract. 2. Select the extract data source from the Data menu and then select Extract \> Upgrade. 3. Select File \> Save, which saves the workbook and also completes the extract upgrade. [Skip to main content](#main-content) # About Multi-fact Relationship Data Models Multi-fact relationships let you build data sources with more than one _base table_. Using multiple base tables in your data model allows you to perform multi-fact analysis in Tableau. By establishing _trees_ of tables, rooted in a base table, you can model data structures with different conceptual domains and use their shared characteristics to connect them. This type of analysis is often referred to as multi-fact analysis, conformed dimensions, or shared dimensions. In Tableau, we call this a multi-fact relationship data model because you use relationships to build it. A multi-fact relationship data model always contains multiple base tables. Base tables are the left-most tables in the data model. For guidance on how to determine which tables to use as base tables, see [When to Use a Multi-fact Relationship Model](https://help.tableau.com/v0.0/server-linux/en-us/datasource_mfr_when_to_use.htm). ![a multiple base table model with one tree highlighted](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_highlightedtree.png) A multiple base table data model with one base table's tree highlighted. ## Levels of relatedness Data models with multiple base tables have a lot of flexibility to how pieces of data can relate—or not relate—to each other. **Note**: Relatedness at any level is only relevant in data models with multiple base tables. Prior to multi-fact relationship data models, either everything was related (within a single data source) or nothing was (blending across multiple data sources). **Relatedness in the data model** Tables are related, unrelated, or shared based on the structure of the data model. In a data source, the relatedness of tables is a constant. As a brief overview: - _Related tables_ are in the same tree. - Prior to 2024.2, all data sources were single base table data sources consisting of a single tree, and in a single base table data source all tables are related. - _Unrelated tables_ are in different trees. Base tables are always unrelated to each other. Tables that are downstream of exactly one base table are also unrelated to tables in other trees. - _Shared tables_ have multiple incoming relationships and belong to more than one tree. - Tables downstream from a table with multiple incoming relationships are also considered shared. **Relatedness during analysis** Fields can be related, unrelated, not yet related, ambiguously related, or they can act as stitching fields. The relatedness among a group of fields is determined on a sheet-by-sheet basis based on the structure of the data model, what fields are actively in use (that is, on the shelves as pills), and if those fields are dimensions or measures. ![a simple viz with two unrelated fields, one on rows and one on columns, and an unrelated tooltip showing](/tableau/next/en-us/server-linux/en-us/Img/mfr_unrelatedtooltip_example.png) To make a visualization with fields from multiple tables, Tableau has to perform joins behind the scenes to compute the values. The type of join used depends on the [relatedness of the fields](#fieldlevel). As a brief overview: - When _related fields_ are used in a viz, dimensions are inner joined and measure values are broken down by the dimensions. - It's a little more complicated than that—additional joins might be needed behind the scenes to ensure that [no measure values are dropped](https://www.tableau.com/blog/relationships-tableau-data-model). But in a dimension-only viz, related dimensions are inner joined and that's the main concept here. - This is the same behavior as single-base table models. - When _unrelated fields_ ![](/tableau/next/en-us/server-linux/en-us/Img/mfr_icon_unrelated.png "unrelated icon") are used in a viz, dimensions are cross joined. Measure values are table scoped (that is, aggregated locally to a single value for their entire table) and repeated. - It's also possible for fields to be _not yet related_ or _ambiguously_ related, which means that for the combination of active fields, there is more than one way for the relationships between their tables to be resolved. If Tableau encounters uncertainty, it treats the fields as unrelated. - When fields are _stitched_ ![](/tableau/next/en-us/server-linux/en-us/Img/MFR_icon_related.png "stitching icon") based on a shared field, dimensions are outer joined. Measure values are aggregated at the level of whatever dimension they can be broken down by and might be repeated. - _Stitching dimensions_ are similar to [linking fields in data blending](https://help.tableau.com/current/pro/desktop/en-us/multiple_connections.htm#define-blend-relationships-for-blending). Results are calculated for each pair of related fields, then the unrelated values are stitched together across the shared values of the dimension shared between them. All of these concepts and definitions are discussed in more detail later in this topic. An aside on dimensions and measures In Tableau, _measures_ are _aggregations_—they're aggregated up to the _granularity_ set by the _dimensions_ in the view. The value of a measure therefore depends on the context of the dimensions. For example, "number of cereal boxes" depends on if we mean the total inventory or the number of boxes per brand. _Dimensions_ are usually categorical fields, such as country or brand. In Tableau, dimensions set the granularity, or the _level of detail_, of the view. We typically want to group our data into marks by some combination of categories. What dimensions we use to build the view determines how many marks we have. When a measure is used without dimensions, it's said to be _table scoped_. This means its value is the fully aggregated value for the entire table. As soon as we use a dimension such as brand in the viz, the measure is broken down more granularly. The total number of cereal boxes is now per brand. _Aggregation_ refers to how the data is combined. Tableau's default aggregation is SUM. You can change the aggregation to other options, including: average, median, count distinct, minimum, and so on. _Granularity_ refers to how detailed or broken down the measure is—which is controlled by the dimensions. Unless the granularity of the measure is row level (aka disaggregated), its value must be aggregated. #### Example ![a table of values for number of boxes of cereal, across five brands and three sizes of boxes](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_cereal_rawdata.png) What's the value of "number of boxes of cereal?" Well, it depends on the aggregation type and the granularity as set by the dimensions. - Aggregations: - Sum (or total) - Average - Granularity: - Table scoped / fully aggregated (the blue bars in the example) - Broken down by the **Brand** dimension (the colored bars in the example) ![A dashboard with four vizzes, one for the summed table scoped number of boxes (54), one with the average table scoped number of boxes (6), and then versions of those two broken down by the five brands](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_cereal.png) ## Field-level relatedness indicators There are several visual clues that can help you understand the degree of relatedness for fields you're using in an analysis. ### Relatedness indicators on a worksheet - **Unrelated icon**: Tableau uses an unrelated icon ![unrelated icon](/tableau/next/en-us/server-linux/en-us/Img/mfr_icon_unrelated.png) to indicate not everything in the view is related. If you see an unrelated icon on a pill in the view or in the Data pane, you can hover over the icon [to get more information](https://help.tableau.com/current/pro/desktop/en-us/mfr_relatedness_messages.htm). - The related icon ![](/tableau/next/en-us/server-linux/en-us/Img/MFR_icon_related.png "stitching icon") indicates that field is stitching together unrelated fields. - **Light gray field names**: Field names are displayed in light gray text in the Data pane when they're not related to _any_ fields in use on shelves. You can still use these fields for analysis in that viz, but unrelated fields are [evaluated differently](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#joinsbyrelatedness) in analysis than fields that are related. On hover, these fields also display an unrelated icon. ![the data pane, with one entire table grayed out, and two fields with the slashed eye icon for hidden fields](/tableau/next/en-us/server-linux/en-us/Img/mfr_gray_datapane.png) **Note**: In previous versions of Tableau, light gray field names indicated that the fields were hidden and Show hidden fields was selected. Hidden fields, when shown, are now indicated with a clickable eye icon ![hidden field icon](/tableau/next/en-us/server-linux/en-us/Img/mfr_icon_hidden.png). ### Relatedness warning dialog When unrelated fields are used together in a viz, Tableau shows a warning dialog to let you know that the fields aren't related. This warning appears each time you add an unrelated field to prevent accidental cross joins that might impact performance. - If you want to use unrelated fields without stitching, click Add to continue adding the field to the viz. - If you want to stitch unrelated fields, a best practice is to bring out the stitching field before an otherwise unrelated field. The dialog won't show if the stitching field is already in use. See [How joins are used for each level of relatedness](#joinsbyrelatedness) for more information about how stitching prevents cross joins. ![the relatedness warning dialog showing a warning for unrelated dimensions](/tableau/next/en-us/server-linux/en-us/Img/mfr_unrelated_dialog_simple_v2.png) When multiple fields are being added or are already present in the view, the Details area appears in the dialog. Expand it to see more information about the relatedness of all the fields in use and identify where the unrelatedness issue is coming from. ![the relatedness warning dialog with a message for both unrelated dimensions and measures, and with the Details area expanded](/tableau/next/en-us/server-linux/en-us/Img/mfr_unrelated_dialog_details_v2.png) To stop the warning message from appearing at all, select the option Don't show this again. You can always re-enable these warning messages again by turning them back on: - In Tableau Desktop, open the Help menu > Settings and Performance > Reset Ignored Messages. - In a browser, clear your cached data. For example in Chrome, open the **3 dots menu** > **Delete Browsing Data...** > Choose "**Cached images and files**" > **Delete data**. ## Table-level relatedness in the data model In a data model with multiple base tables, each base table defines a set of tables that are related and form a conceptual _tree_. These trees must be connected by at least one shared table to ensure the overall data source is a single entity. What might previously have been two data sources that could be blended using linking fields can now be a single data source with two trees, connected by the shared tables that contain those common fields. ![two data models, one made of two distinct data sources, one of the two data sources superimposed on the tables they have in common to form a single data source](/tableau/next/en-us/server-linux/en-us/Img/mfr_blending_comparison.png) > [!TIP] > > How tables are related in the data model impacts how their fields can be related in the analysis. It can be helpful to use the [View Data Model](https://help.tableau.com/current/pro/desktop/en-us/viewdatamodel.htm) dialog during analysis to see how a table fits into the overall data model. Let's walk through what tables are related, unrelated, or shared using this example data source. There are two trees, one established by base Table A and one by base Table B. ### Unrelated tables Base tables are fundamentally unrelated. Similarly, any tables that exist solely in a single tree are unrelated to tables in other trees.

Table A and Table X are unrelated	Table B and Table X are unrelated

### Related tables Tables in the same tree are considered related.

Table A and Table S are related	Table B and Table S are related (through Table A)

### Shared tables Shared tables have multiple incoming relationships. These tables belong to multiple trees and are shared across them. Table S and Table T are shared. ![A data model where tables S and T both have multiple incoming relationships. They both belong to base table A's tree and base table X's tree. ](/tableau/next/en-us/server-linux/en-us/Img/mfr_relatedness_tables_shared.png) ## Field-level relatedness in the analysis Relatedness between fields is determined on a sheet-by-sheet basis based on the [structure of the data model](https://help.tableau.com/current/pro/desktop/en-us/viewdatamodel.htm), what fields are actively in use (that is, what fields are in the viz as pills on shelves), and if those fields are dimensions or measures. How field relatedness impact the results of a viz is covered in [the next section](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#joinsbyrelatedness). Let's walk through some scenarios using the same example data source. Each field's name indicates which table it is from, such as FieldB from Table B. Fields can be dimensions or measures unless otherwise noted. ### Related fields At a high level, fields are related when Tableau can clearly determine how to evaluate them together based on a relationship path within a single tree. For example, FieldB (from Table B) and FieldS (from Table S) are related. ![FieldB and FieldS are related](/tableau/next/en-us/server-linux/en-us/Img/mfr_relatedness_tables_related2.png) ### Unrelated fields At a high level, fields are unrelated in any case when they're not related. This could be because the fields are from unrelated tables, such as using fields from two base tables. In this case, fields from different base tables are fundamentally unrelated. For example, FieldA and FieldX are unrelated. ![FieldA and FieldX are unrelated](/tableau/next/en-us/server-linux/en-us/Img/mfr_relatedness_tables_unrelatedbase.png) Or fields can be treated as unrelated for a point in time—such as in ambiguous or not yet related cases. For the most part, you can rely on [relatedness indicators](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_relatedness_messages.htm) to alert you when fields are unrelated in the context of a viz. ### Stitching dimension Stitching is how Tableau evaluates fields from unrelated tables in a multi-fact data model during analysis. In a viz, using a dimension from a shared table stitches together otherwise unrelated fields and allows them to be evaluated simultaneously in the same viz. Think of this as juxtaposing results from two trees together based on a dimension they share. For example, if a viz is built with FieldA and FieldX, these two fields are unrelated. Adding DimensionS introduces a stitching field. - FieldA and DimensionS are evaluated together. - FieldX and DimensionS are evaluated together. - Those intermediate results are brought together based on the values of DimensionS. - FieldA and FieldX are now stitched. ![unrelated base tables A and X stitched together by their shared table S](/tableau/next/en-us/server-linux/en-us/Img/mfr_relatedness_fields_stitching.png) **Tip**: A best practice is to use a stitching field in the viz before bringing out an unrelated field. For example, drag out DimensionS first, or FieldA then DimensionS then FieldX, instead of FieldA then FieldX then DimensionS. Adding the stitching field first ensures that Tableau is always aware of how to evaluate the relationships and avoids potential performance issues from evaluating unrelated dimensions together with cross joins. Stitching requires a dimension from a shared table to be active in the viz. Fields placed on the Filters shelf or on the Tooltip property of the Marks card aren't considered active for the purposes of stitching. ### Not yet related fields Fields can also have multiple ways they could be related but aren't yet. This happens when there's more than one possible relationship between two shared tables (or downstream shared tables). Consider FieldS and FieldT. Their tables are related to each other both through the tree defined by base Table A and through the tree defined by base Table X. In a viz with just FieldS and FieldT, there's no information about which tree should be used to relate them. Without additional information Tableau can't evaluate whether to relate these fields through Base Table A's tree or Base Table B's tree. FieldS and FieldT are treated as unrelated although there are multiple _potential_ relationships. ![Under-related ambiguous fields S and T](/tableau/next/en-us/server-linux/en-us/Img/mfr_relatedness_fields_not-yet_hyporelated.png) These could-be-but-aren't-yet-related fields are evaluated as unrelated because Tableau can't clearly determine their relationship path. Unlike truly unrelated fields which can only be stitched, not yet related fields can be resolved and the fields can be directly related. ### Ambiguously related fields Fields can also be ambiguously related. This happens when there is more than one active possible relationship between shared tables (or downstream shared tables). Unlike not yet related fields, which can be thought of as hypo-related or under related, ambiguously related fields are hyper-related or over related. Consider FieldS and FieldT. Their tables are related to each other both through the tree defined by base Table A and through the tree defined by base Table X. In a viz with FieldA, FieldX, FieldS, and FieldT, there's too much information to decide which tree should be used to relate them. Without trimming the information, Tableau can't evaluate whether to relate these fields through Base Table A's tree or Base Table B's tree. FieldS and FieldT are treated as unrelated although there are multiple _active_ relationships. ![](/tableau/next/en-us/server-linux/en-us/Img/mfr_relatedness_fields_ambiguous_hyperrelated.png "over related") These ambiguously related fields are evaluated as unrelated because Tableau can't clearly determine their relationship path. Unlike truly unrelated fields which can only be stitched, ambiguously related fields can be resolved and the fields can be directly related. ### Ambiguous measure from a shared table When a dimension is used from a shared table, it stitches together fields from its unrelated upstream tables. Measure can't stitch, however, and the value of a measure depends on its related dimensions. In a viz with DimensionA and DimensionX, these two dimensions are unrelated. If MeasureS is brought out from Table S, it is unrelated to the combination DimensionA and DimensionX together. Although it could be related to either one independently, it can't be simultaneously related to both of them in the same viz. ![unrelated base tables A and X stitched together by their shared table S](/tableau/next/en-us/server-linux/en-us/Img/mfr_relatedness_fields_stitching.png) A shared measure can be considered a type of ambiguity or over relatedness and is resolved the same way. ### Resolve unclear relationships between fields Whenever there is uncertainty about how to relate fields, Tableau won't make an arbitrary decision and instead treats them as unrelated. It's often better to relate these fields by clarifying the uncertainty around which tree to use. Resolving not yet related fields is done by adding a field to establish which tree to use. Resolving ambiguously related fields is done by removing fields to establish which tree to use. _Example:_ **Resolving not yet related**: add a field - In a viz of FieldS and FieldT, adding a field from Table A, B, or C to the viz makes Base Table A's tree active and resolves the desired path between FieldS and FieldT. - Alternatively, using a field from Table X resolves the desired path between FieldS and FieldT to Base Table X's tree. **Resolving ambiguously related**: remove a field or fields - In a viz of FieldA, FieldX, FieldS, and FieldT, removing FieldX makes only Base Table A's tree active and resolves the desired path between FieldS and FieldT. - Alternatively, removing FieldA resolves the desired path between FieldS and FieldT through Base Table X's tree. **Resolving a shared measure**: remove a field or fields - In a viz of DimensionA, DimensionX, and MeasureS, removing DimensionX makes only Base Table A's tree active and resolves the desired path between DimensionA and MeasureS. - Alternatively, removing DimensionA resolves the desired path between DimensionX and MeasureS through Base Table X's tree.

Not yet related	Ambiguously related	Relatedness resolved to a single tree
		Related through base Table A	Related through base Table X

Resolving uncertainty is similar to using a FIXED Level of Detail (LOD) expression. In a FIXED LOD expression, you tell Tableau what level of detail to aggregate to by defining the dimension declaration. Uncertainty is resolved by changing the structure of the viz to make only one tree active, thus telling Tableau what relationship paths it can consider to perform the analysis. ### Stitching vs resolving uncertainty Both stitching and resolving uncertainty are ways of dealing with unrelatedness, but they have different outcomes:

Stitching	Resolving uncertainty
Unrelated FieldA and FieldX stitched by DimensionS	FieldS and FieldT evaluated through the tree defined by base Table A
Juxtaposes unrelated fields based on shared attributes	Narrows down which relationship path to use when there are multiple options (ambiguity or a shared measure), or establishes a relationship path when there wasn't one (not yet related).
Uses multiple base table logic to calculate results	Uses single base table logic to calculate results
Analysis involves unrelated tables	Analysis involves shared tables

## How joins are used for each level of relatedness After the field-level relatedness has been determined, Tableau has to evaluate the results to create the actual visualization. The queries used to calculate the values shown in a viz rely on joins. Whether fields are related, unrelated, or stitched has a different impact on what joins are performed. Remember, ambiguously related and not yet related fields are treated as unrelated in this context. To explain relatedness and joins, this section covers tables and their fields, plus the values in those fields. Consider the following data model with two base tables, Classes and Clubs, and a shared table, Students. ![A data model with two base tables, classes and clubs, and a shared table, students](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_model.png)

Classes

Clubs

Students

view data for the classes table, showing the values for three fields

Fields:

Class, a dimension with values of Nesting Basics, Advanced Songs, Flying for Fledglings, and Alarm Calls 101
Length, a measure
Student, a dimension used to relate to the Student table

Fields:

Club, a dimension with values of Photography, Travel, Juggling, Art, and First Aid
Dues, a measure
Student, a dimension used to relate to the Student table

Fields:

Bus Rider, a dimension with values of yes or no
Student, a dimension with values of Finch, Cardinal, Sparrow, Robin, and Jay. Used to relate to the other two tables
Age, a measure

This very simple model illustrates how the high-level join logic is calculated for multi-fact relationship data models. For more information about the basics of joins used in single base table data models built on relationships, see [How Analysis Works for Multi-table Data Sources that Use Relationships](https://help.tableau.com/current/pro/desktop/en-us/datasource_multitable_analysis_overview.htm). Should this example be a data model with multiple base tables? For this three table data model, it might be tempting to set it up as a single base table model, as Classes-Students-Clubs or Clubs-Students-Classes, or with Students as a base table. As a rule, multi-fact relationship data models are intended for specific kinds of data schemas or analysis scenarios. If your data model [has characteristics that are best suited to a multi-fact relationship data model](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_when_to_use.htm), set it up that way to keep your base tables conceptually unrelated. However, if your data doesn't require this type of structure, a single base table model can be simpler to use. ![alternative data model structures for the classes-clubs-students example model](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_model_versions.png) Models that could be built for these three tables: (1) Classes and Clubs as base tables with Students as a shared table, (2) linearly, starting with either Classes or Clubs, and (3) Students as a single base table with Classes and Clubs as downstream tables. In this particular instance, there's nothing about these tables, the data, or the model that truly requires multiple base tables. We're using this model as an example to keep it simple so the focus can be on the join logic. Or you could imagine that there's another related table, Rooms, that we're simply ignoring to avoid over complicating the discussion. ![a version of the classes-clubs-students model with an additional shared table, rooms](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_model_withroom.png) As a best practice, however, only use a multi-fact relationship model when your data requires it. ### Related dimensions use inner joins Related dimensions are inner joined. Inner joins drop any dimension values that aren't shared across both tables. - Tableau uses additional logic to ensure measure values aren't lost. This section uses only dimensions to demonstrate the basics of how Tableau applies inner joins to related dimensions. The following example shows how related dimensions only return rows that are present in the data. No students are in the Alarm Calls 101 class, so it's not present in the results. Cardinal and Jay aren't in any classes, so they're not present in the results. ![A viz showing an inner join of Class and Student, with two rows for Finch (Advanced Songs, Nesting Basics), two rows for Robin (Flying for Fledgelings, Nesting Basics), and two rows for Sparrow (Advanced Songs, Nesting Basics)](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_relateddims_innerjoin.png) ### Unrelated dimensions use cross joins Unrelated dimensions—on their own, without a stitching dimension—are cross joined. In a cross join, every value from one dimension is combined with every value from the other dimension, even if a resulting combination doesn't actually exist in the data. In this example, the cross join adds a row for each possible combination of Class and Club. ![A viz showing a cross join of Class and Club with rows for every combination of Advanced Songs/Alarm Calls 101/Flying for Fledglings/Nesting Basics with Art/First Aid/Juggling/Photography. There is an unrelated icon shown on both dimension pills on the Rows shelf](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_unrelateddims_crossjoin.png) It's important to recognize when a cross join is occurring in your analysis. Although there's a row for Advanced Songs + First Aid in the results table for the cross join, no students are actually in this combination of activities (we'll see proof of this in the stitching example in the next section). Why is it important to recognize that not all cross join results are based in the data? Imagine you were trying to build a schedule for classes and clubs so there were no conflicts for any students. There aren't any students in Advanced Songs and First Aid, so you could ignore this result and schedule that class and club simultaneously. The cross join doesn't represent combinations of values that actually exist in the data. Additionally, cross joins when there is high cardinality (a large number of unique values) can impact performance. Imagine cross joining every phone number with every email address in your contacts. That would be a huge explosion of combinations and a potentially costly operation. ### Stitched dimensions use outer joins Unrelated dimensions—in the presence of a stitching dimension—are outer joined. In this example, both the Classes table and Clubs table are related to the shared Students table but not to each other, so the fields Class and Club are unrelated. Adding the Student dimension lets Tableau know which values from Class and which values from Club should be juxtaposed in the analysis. We call this outer join behavior _stitching_. ![A viz showing the results of an outer join of the Student-Class inner join and the Student-Club inner join. There is an unrelated icon on the Class and Club pills on the Rows shelf. A pill for Student is on the Color property of the Marks card and does not have an unrelated icon. Not all combinations of classes and clubs are represented, and there are rows for students and clubs without a class](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_stitched_outerjoin.png) Stitching is similar to data blending in that there are intermediate results that are brought back together for the overall results. Unlike blending, however, stitching is an outer join, not a left join, and doesn't drop values from either side. There's no concept of primary or secondary data sources when it's all one data source, so both of the unrelated fields are given equal precedence. #### Intermediate results are outer joined What goes into the outer join for stitched fields? An intermediate inner join is computed for the stitching field and each of the unrelated fields in turn, then those intermediate results are outer joined based on the values of the stitching dimension. **Example** An inner join for Student and Class... ![A results table for three values of students and three values of classes](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_stitched_inner1.png) ...and an inner join for Student and Club... ![A results table for four values of students and five values of clubs](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_stitched_inner2.png) ...are then outer joined on Student. ![A results table for four values of students, three values of classes, and five values of clubs](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_stitched_outerjoin.png) ### Additional joins to retain measures In addition to the join logic for dimensions, measures can introduce additional joins. When relationships were first introduced in Tableau, one of the [core principles was that measure values aren't lost](https://www.tableau.com/blog/relationships-tableau-data-model). This is also maintained in multi-fact relationship data models. The essential details are: - Measure values are broken down only by related dimensions. - Measure values repeat for unrelated dimensions. - Dimension values that would be dropped in dimension-only vizzes may be returned if there are relevant measure values associated with them. **Note**: Remember that measures are aggregations—they're computed at the level of detail (the granularity) set by the combination of dimensions in the viz. This is referred to as a measure being _broken down_ by a dimension. When a measure is used without any dimensions, it is said to be _table scoped_. This means the measure's value is the fully aggregated value. As soon as we use a dimension in the viz, the measure is broken down more granularly based on the dimension values. The value of a measure in an analysis therefore depends on the context of the dimensions. #### Related measures Consider the subset of dimension values that are returned for an inner join on the related dimensions **Student** and **Class.** There are _three_ student values, Finch, Robin, and Sparrow; and _three_ class values, Advanced Songs, Nesting Basics, and Flying for Fledgelings. ![a results table for an inner join between student and class](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_inner_student_class.png) If we add the **Length** measure from the Class table, we see that all _four_ classes are shown and there's a null for Student. Every class **Length** is displayed, at the level of **Class**. ![A null value appears for student even though dimensions are inner joined](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_related_measurefrombase.png) If we instead add the **Age** measure from the Student table, we see that all _five_ students are shown and there are two nulls for Class. The results preserve every student, even if they're not in a class. Every student **Age** is displayed, at the level of **Student**. ![A null value appears for classes even though the dimensions are inner joined](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_related_measurefromshared.png) #### Unrelated measures Measure values are repeated for unrelated dimension values. If we look at the **Length** measure from the Classes table and the unrelated **Club** dimension, the measure is table scoped and repeated across all the dimension values of **Club**. ![a table scoped measure repeated across unrelated dimension values](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_unrelateddim-measure.png) In the presence of a stitching dimension, measures can be both broken down and repeated. Here, the measure **Age** is from the Students table and is broken down to the level of student. Each time a student is repeated based on the dimensions for **Class** and **Club**, the **Age** value is repeated. ![](/tableau/next/en-us/server-linux/en-us/Img/mfr_ex_birds_unrelateddims_sharedmeasure.png) ## Troubleshooting ### Considerations when working with multi-fact relationship data models **Per table extract filters** All extract filters for a multi-fact relationship data model extract are per-table (not pervasive). Because of this, filtering results may be different between live and extract connection. **Row level calculations** Row level calculations can only refer to fields which share the same upstream base table. That is, row level calculations can't be performed across trees. **Combined Fields** All fields in a combined field must share an upstream table. That is, you can't create a combined field using fields that are in different trees. **Sets** Sets can only be created with a definition that involves fields that share the same upstream base table. However, in a viz, the option to Add to Set may be available from a mark when that mark is defined by fields unrelated to the fields used to define the set. If you choose Add to Set, Tableau will add only the related fields to the set definition. This is different from the behavior for Add to Set in single base table data sources, when Add to Set adds everything that defines the mark. **Validate INCLUDE level of detail expressions** INCLUDE LOD expressions can't be evaluated across unrelated fields. Because relatedness between fields is evaluated on a sheet-by-sheet basis, it's possible to have a valid LOD expression in the Data pane or calculation editor that becomes invalid in the context of a specific viz (in the presence of an unrelated dimension). When this happens, the LOD pill will turn red. You can update the LOD expression to remove unrelated field conflicts, change the structure of the viz, or remove the LOD expression from the viz. **Updating Published Data Sources** As a best practice, create a copy of an existing published data source if you plan to modify it to become a multi-fact relationship data model when not all of its connected workbooks need the new data model. Don't update the existing version of the data source unless all its workbooks need the new tables. Publish the modified data source as a new data source and create new workbooks from it. This will prevent the existing workbooks from being converted to use VDS instead of data server when they don't need the functionality, preventing the potential for a performance hit. ### Resolved issues

Resolved Issue

Fixed as of

Extracts

Local data source (in a workbook): Attempting to extract a multi-fact relationship data source will give a "No such table" error.

Published data source: Extracting a published multi-fact relationship data source appears to succeed, but field values can be swapped.

Tableau Cloud: Resolved as of mid July updates. This also applies to public.tableau.com.
Tableau Desktop: Resolved as of maintenance release 2024.2.1 released July 24th, 2024
Tableau Server: Resolved as of maintenance release 2024.2.1 released July 24th, 2024

If you still see these issues in Tableau Desktop or Tableau Server, upgrade to a version from July 24th, 2024 or later.

EXCLUDE Level of Detail expressions

Only INCLUDE LODs should be validated in the presence of unrelated fields. However, EXCLUDE LODs may also be incorrectly marked as not valid in the same conditions.

Nested user calculations

Nested user calculations are not available in published data sources with a multi-fact relationship data model.

### Known issues **Relatedness indicators with multiple Marks cards** When a viz is built with multiple measures on the Rows shelf or on the Columns shelf, each measure gets its own Marks card. The logic used to determine relatedness indicators (the unrelated icon, the text in tooltips, and the relatedness warning dialog) may not give expected results depending on which Marks card is open. The viz itself, however, is correctly computed based on the relatedness of each pair of fields. There is a planned fix for this behavior. **BatchQueryProcessor** BatchQueryProcessor must be enabled to support multi-fact relationship data models. This is expected behavior with no currently planned fix. **Tableau Pulse** Tableau Pulse may not work with multi-fact relationship data models. You may be prevented from creating a metric definition, or any metrics that are created may be blank. This is not expected behavior but there is no currently planned fix yet. **Changing dimensions with a parameter** Tableau lets you [swap fields using a parameter](https://help.tableau.com/current/pro/desktop/en-us/parameters_swap.htm). However, with multi-fact relationships, swapping dimensions with a parameter will fail silently. The parameter and its calculation can be created, and the parameter control can be shown, but the field won't change when the parameter does. This is due to when dimensions are evaluated for relatedness and when parameters are evaluated in the order of operations. ## Other articles in this section [Skip to main content](#main-content) # About Tableau Resource Monitoring Tool This document gives you an overview of the Tableau Resource Monitoring Tool. ## What is Resource Monitoring Tool? The Resource Monitoring Tool is a tool that you can use to monitor the health and performance of your Tableau Server. It gathers data from your Tableau Server to provide a comprehensive look at the health of Tableau Server. Using this tool, you can identify the cause of slow load times, extract failures, and other critical issues. To use the Resource Monitoring Tool, you must have Advanced Management enabled on your server. For more information on Advanced Management, see [About Tableau Advanced Management on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm) The Resource Monitoring Tool has two main components: Resource Monitoring Tool Server (RMT Server) and Agent. - The RMT Server is where the data from Tableau Server is collated and served up through a web interface. This is also where you can configure, monitor, and analyze the health and performance of Tableau Server. - An Agent runs on each of the nodes in your Tableau cluster to monitor their performance and activity. The following diagram illustrates the interaction between a Tableau Server node and the RMT Server. ![A diagram that illustrates the transmission of hardware metrics, usage and performance metrics, and their corresponding user-friendly names and data structures from a master server to a node.](/tableau/next/en-us/server-linux/en-us/Img/rmt-data-flows-linux.png) ## Other articles in this section [Skip to main content](#main-content) # About Tableau Catalog > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. Data is increasing in volume, formats, and importance leading to more complex environments. With the rapid pace that data changes, it can be hard to keep track of that data and how it's being used in such complex environments. At the same time, more users need to access more of that data in more places, and it's difficult for users to find the right data. Ultimately, this causes a lack of trust in the data because people question whether they're using the right source or if the source is up to date. Tableau Catalog integrates features like lineage, impact analysis, data dictionary, data quality warnings, and search into your Tableau applications, helping solve these problems differently from a stand-alone catalog. It focuses on both IT and the end user so that everyone using Tableau Server or Tableau Cloud has more trust in and visibility into the data, while also enabling more discoverability. Tableau Catalog builds a catalog out of the Tableau content being used by your organization, enabling comprehensive functionality like the following: - **Impact analysis and lineage**. - You can see the workbooks and other Tableau content that depend on particular columns or fields from tables or data sources you manage. When you need to make changes to your data, you can notify the impacted Tableau authors using email. - As a workbook author, you can use lineage to trace the fields that your workbook depends on. - As a user, when you use a Tableau visualization, you can see where the data came from that was used to create the view. - **Curation and trust**. As a data steward, you can add helpful metadata, like descriptions and certification, so that users find the right data. You can set data quality warnings, view data details on the Data Details pane, certify assets, and remove assets from the catalog. - **Data discovery**. In Tableau Desktop or Tableau web authoring, you can use Tableau Catalog to search for databases, tables, data sources, and virtual connections to analyze in Tableau and connect to them from the search results. Starting in 2019.3, Tableau Catalog is available as part of Data Management for Tableau Server and Tableau Cloud. When the product key is active and enabled, the catalog features described above are integrated into the product you're using, so you can work with the data where you find it. ## How Tableau Catalog works Tableau Catalog discovers and indexes all the content on your site—workbooks, data sources, sheets, virtual connections, and flows—to gather metadata about the content. From the metadata, external assets (databases, tables, and other objects) are identified. Knowing the relationships between the content and the external assets enables Tableau to display the lineage of the content and external assets. Tableau Catalog also enables users to connect to external assets using Tableau Server or Tableau Cloud. Users on your site can publish or delete content, can attach data quality warnings or certifications, or do anything else that changes the content or its metadata on the site, and Tableau Catalog will update its information accordingly. For information about how you can use Tableau Catalog to support data governance in your organization, see [Governance in Tableau](https://help.tableau.com/current/blueprint/en-us/bp_governance_in_tableau.htm) in the Tableau Blueprint Help. ## Key Tableau Catalog terms - Metadata - Information about the data. - Tableau content - Content created in Tableau such as workbooks, data sources, virtual connections, and flows. - External assets - Databases (including data files) and tables (including table-like objects) used by Tableau content, published to Tableau Server or Tableau Cloud. ## License Tableau Catalog Tableau Catalog is licensed through Data Management. For information about how Data Management licensing works, see [License Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_license.htm). ## Enable Tableau Catalog After Tableau Server or Tableau Cloud is licensed with Data Management capabilities, you can enable Tableau Catalog by doing one of the following tasks: - **For Tableau Cloud**, no action is necessary unless your site was upgraded from Standard. Tableau Catalog is on by default, configured to use derived permissions, and ready to use. If your site was upgraded from Standard, a site admin must first turn on Catalog. For more information, see [Enable Tableau Catalog](https://help.tableau.com/v0.0/server-linux/en-us/dm_catalog_enable.htm). For more information about derived permissions, see the [Permissions on metadata](https://help.tableau.com/v0.0/server-linux/en-us/dm_perms_assets.htm#perms) topic. - **For Tableau Server**, the Server admin must first enable the Tableau Metadata API using the `tsm maintenance metadata-services` command. For more information, see [Enable Tableau Catalog](https://help.tableau.com/v0.0/server-linux/en-us/dm_catalog_enable.htm). After the Metadata API is enabled, Tableau Catalog is on by default, configured to use derived permissions, and ready to use. For more information about derived permissions, see the [Permissions on metadata](https://help.tableau.com/v0.0/server-linux/en-us/dm_perms_assets.htm#perms) topic. ## Features and functionality To learn more about the features you can use with Tableau Catalog, see the following Help articles: ### Data discovery - In the Connect pane on Tableau Desktop, under Search for Data select Tableau Server to [connect to data using Tableau Server or Tableau Cloud](https://help.tableau.com/current/pro/desktop/en-us/examples_tableauserver.htm). When Tableau Catalog is enabled, in addition to searching for published data sources to connect to, you can now search for and connect to the specific databases, tables, and objects used by published data sources and workbooks on your Tableau Server or your Tableau Cloud site. - [Search](https://help.tableau.com/current/pro/desktop/en-us/search.htm) is expanded to include results based on columns, databases, tables, and other objects when Tableau Catalog is enabled. - If you author in the web, in addition to published data sources, you can also [connect to databases and tables](https://help.tableau.com/current/pro/desktop/en-us/getstarted_web_authoring.htm#tableau-catalog-users-create-workbooks-from-external-assets). - If you use Tableau Prep on the web, you can [create new flows based on external assets](https://help.tableau.com/current/prep/en-us/prep_startflow.htm#start-a-new-flow), such as databases and tables. - If you [connect to Salesforce Data Cloud](https://help.tableau.com/current/pro/desktop/en-us/examples_data_cloud.htm), you'll see support for native Data Cloud objects built into Tableau Catalog. Data Lake Objects (DLOs), Data Model Objects (DMOs), and calculated insights appear distinct in search, connect, and lineage pages, which makes discovering, connecting to, and reusing them simpler. ### Curation and trust - [Certify your data assets](https://help.tableau.com/current/server/en-us/datasource_certified.htm) to help users find trusted and recommended data. - Set [data quality warnings](https://help.tableau.com/current/server/en-us/dm_dqw.htm) to alert users to data quality issues, such as stale or deprecated data. - Add [sensitivity labels](https://help.tableau.com/current/server/en-us/dm_labels_sensitivity.htm) to warn users about data that needs to be handled with care. - Add [custom labels](https://help.tableau.com/current/server/en-us/dm_labels_custom_categories.htm) to classify data in ways that suit the needs of your organization - [Manage data labels](https://help.tableau.com/current/server/en-us/dm_labels_manage.htm) to extend the label names and categories available to users. - Categorize items on Tableau Server and Tableau Cloud using [tags](https://help.tableau.com/current/pro/desktop/en-us/tags.htm) to help users filter external assets. - Better understand published visualizations by using the [Data Details](https://help.tableau.com/current/pro/desktop/en-us/data_explore_analyze_interact.htm#use-data-details-to-see-visualization-information) tab to see information about the data used. - [Add descriptions](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm#add-or-edit-descriptions) to databases, tables, and columns to help users find the data they're looking for. ### Lineage and impact analysis - Use [lineage](https://help.tableau.com/current/server/en-us/dm_lineage.htm) to trace the source of your data and to analyze the impact of changes to your data and identify which users might be impacted. - [Email owners](https://help.tableau.com/current/server/en-us/dm_lineage.htm#email) of a workbook, data source, or flow about data-related updates. Do the same with database, table, or object contacts. ### Developer resources You can use metadata methods in the Tableau REST API to programmatically update certain metadata. For more information about the metadata methods, see [Metadata Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_metadata.htm) in the Tableau Server REST API. In addition to the REST API, you can use the [Tableau Metadata API](https://help.tableau.com/current/api/metadata_api/en-us/index.html) to programmatically query metadata from the content published to Tableau Server or Tableau Cloud. The Metadata API is fast and flexible and is best when you are looking to find out specific information about the relationship between metadata and its structures. Explore and test queries against the Metadata API using an interactive in-browser tool called [GraphiQL](https://help.tableau.com/current/api/metadata_api/en-us/docs/meta_api_start.html#explore-the-metadata-api-schema-using-graphiql). (Note: Tableau Cloud requires Data Management to access the Metadata API and GraphiQL, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027.) [Skip to main content](#main-content) # About Tableau Content Migration Tool This set of articles guides you through setting up, using, and maintaining the Tableau Content Migration Tool. **Note**: The Tableau Content Migration Tool is not recommended for migrations when moving from Tableau Server to Tableau Cloud. To migrate from Tableau Server to Tableau Cloud, use the [Tableau Migration SDK](https://help.tableau.com/current/api/migration_sdk/en-us/index.html). For Tableau Content Migration Tool recommended use cases, see [Tableau Content Migration Tool Use Cases](https://help.tableau.com/v0.0/server-linux/en-us/cmt-use-cases.htm#cmt-use-cases) ## What is Content Migration Tool? The Content Migration Tool provides an easy way to copy or migrate content between Tableau Server sites. You can do this between sites on a single Tableau Server installation, or if you have user-based licensing, between sites on separate installations (for example, between a development instance of Tableau Server and a production installation). The Content Migration Tool user interface walks you through the steps necessary to build a "migration plan" that you can use once or as a template for multiple migrations. Before migrating content, we recommend reviewing the [Content Governance](https://help.tableau.com/current/blueprint/en-us/bp_governance_in_tableau.htm#content-governance-in-tableau) section in Tableau Blueprint. ## Help and Support If you have problems that you cannot solve with this documentation, contact [Tableau Technical Support](http://www.tableau.com/support/request). ## Other articles in this section [Skip to main content](#main-content) # About Tableau Enterprise Tableau Enterprise is our advanced software package to help you explore and manage data faster with Tableau Server. It also makes it easier to purchase the capabilities needed by organizations that require advanced data and deployment management options. ## Tableau Enterprise Licensing As of March 2026, Tableau Enterprise is sold in the following models: - **Tableau Server or Tableau Cloud Role-Based Edition** The role-based edition is sold on a per-User role-based licensing model, including Creators, Explorers, and Viewers. This model is structured around the specific roles within an organization, each requiring different levels of functionality. With Tableau Enterprise, each role-based license includes Data Management, Advanced Management, and eLearning for Creators and Explorers. Available for Tableau Server or Tableau Cloud. - **Tableau Server Core Edition** The core edition is capacity-based and sold in 8-core increments, and bundles Advanced Management and Data Management into the license. Available only for Tableau Server. ## Tableau Enterprise Feature Table The following table lists the features that are included with the Tableau Enterprise license edition. Feature availability below is noted for Creator. There are differences in available functionality between Creator, Explorer, and Viewer.

Feature	Description
Tableau Authoring	Use Tableau Desktop or Tableau web authoring on Tableau Server to create, collaborate, and share insights about your data. Tableau provides you a way to identify and solve problems, or highlight key findings in a visual and easily understandable way.
Tableau Prep	Tableau Prep is a data preparation tool for cleaning, shaping, and combining data for analysis.
eLearning	Role-based training Tableau Learning Paths provide a clear track to proficiency with the most up-to-date Tableau training content. Assessments help you evaluate where you are in your learning path and give you confidence in your new skills. Accelerate the onboarding process for new employees and help more experienced users get the most out of Tableau capabilities.
About Data Management	Data Management is a collection of features and capabilities that helps customers manage Tableau content and data assets in their Tableau Server environment.
About Tableau Advanced Management on Tableau Server	Advanced Management is a collection of features and capabilities designed to provide enhanced security, manageability, and scalability for Tableau Server.

[Skip to main content](#main-content) # About Tableau Server+ Tableau Server+ is our advanced software package to help you explore and manage data faster with Tableau Server. Tableau Server+ includes Tableau Agent in authoring, Premier Success, and expanded deployments (one production environment and up to six additional non-production environments for testing). It also makes it easier to purchase the capabilities needed by organizations that require advanced data and deployment management options. ## Tableau Server+ Licensing As of July 2026, Tableau Server+ is sold in two models: - Tableau Server Role-Based Edition The role-based edition is sold on a per-User role-based licensing model, including Creators, Explorers, and Viewers. This model is structured around the specific roles within an organization, each requiring different levels of functionality. With Tableau Server+, each role-based license includes Data Management, Advanced Management, and eLearning for Creators and Explorers. - Tableau Server Core Edition The core edition is capacity-based and sold in 8-core increments, and bundles Advanced Management and Data Management into the license. ## Tableau Server+ Feature Table The following table lists the features that are included with the Tableau Server+ license edition. Feature availability below is noted for Creator. There are differences in available functionality between Creator, Explorer, and Viewer.

Feature	Description
Tableau Authoring	Use Tableau Desktop or Tableau web authoring on Tableau Server to create, collaborate, and share insights about your data. Tableau provides you a way to identify and solve problems, or highlight key findings in a visual and easily understandable way.
Tableau Agent in Dashboards	Use Tableau Agent in Dashboards to analyze your dashboards and create a summary overview. Agent can create a summary of insights based on the charts in the dashboard, enabling you to ask questions about your data using natural language. For information about configuring Tableau Agent in Dashboards, see Turn On AI in Your Tableau Server Site.
Tableau Prep	Tableau Prep is a data preparation tool for cleaning, shaping, and combining data for analysis.
eLearning	Role-based training Tableau Learning Paths provide a clear track to proficiency with the most up-to-date Tableau training content. Assessments help you evaluate where you are in your learning path and give you confidence in your new skills. Accelerate the onboarding process for new employees and help more experienced users get the most out of Tableau capabilities.
About Data Management	Data Management is a collection of features and capabilities that helps customers manage Tableau content and data assets in their Tableau Server environment.
About Tableau Advanced Management on Tableau Server	Advanced Management is a collection of features and capabilities designed to provide enhanced security, manageability, and scalability for Tableau Server.
Tableau Server Pre-Built Docker Image	Take advantage of pre-build Docker images for Tableau Server in a Container. Instead of building an image yourself with the setup tool and the Tableau Server installer, you can download these images directly. (Available only for Server on Linux.)
Premier Success	The Premier Success Plan helps you start strong, grow your business, and get more value from Salesforce with expert guidance and expedited support.

[Skip to main content](#main-content) # About the Flow Workspace After you publish your flow you can schedule tasks or linked tasks (version 2021.3 and later) in Tableau Server to automatically run your flows on a regular basis to keep your output data fresh. You can also run your flows manually at any time (no Data Management required). Tableau Prep Conductor leverages much of the same functionality for managing flows that you might see when managing workbooks or data sources from Tableau Desktop in Tableau Server . For example, just like extract refreshes, scheduled flow tasks and on-demand flow runs are queued as background tasks. But when it comes to working with flows, there are a few differences. ## Flow Overview page The flow Overview page is the main landing page where you can view data about your flow and schedule, monitor, and maintain the flow. If you don't have the Data Management, you will have different options. Open the flow Overview page by clicking on a flow in your list. You can navigate there from Content > Explore > All Flows or by opening the project that contains your flows. ![The Tableau Prep Flow Overview page.](/tableau/next/en-us/server-linux/en-us/Img/prep_parameters_flow_overview.png) 1. The header lists the name of the flow, the flow owner and the date that the flow was last modified. Starting in version 2020.4, click Edit to edit existing flows. Add a flow to your favorites, or from the More actions![The More Options menu option represented by 3 dots.](/tableau/next/en-us/server-linux/en-us/Img/prep_server_rmoremenu.png)menu you can also edit, run, download the flow, set permissions, change the flow owner, restore previous flow versions, and more. 2. View and edit the flow description and set tags to help others find the flows they are looking for. 3. View the output steps for a flow along with any parameters applied to the flow (version 2021.4 and later), the status of the last update, any schedule the output is assigned to, and any errors from the last flow run. You can also click the Run ![The Run Flow button shown as a right facing arrow point in a circle.](/tableau/next/en-us/server-linux/en-us/Img/prep_server_run_button.png)button to run all output steps or individual output steps on-demand.

Parameters	If the flow includes user parameters, the parameter value last run in the flow is shown and you can see all generated outputs in the Output column. When the flow is run, you'll be prompted to enter the parameter values. System parameters (version 2023.2 and later) are automatically generated at flow run time and the type of system parameter is shown in the Parameters column. To see the last system parameter value applied to the flow, edit the flow. For more information about using parameters in flows, see Create and Use Parameters in Flows in the Tableau Prep help.
Status	After a flow has run successfully, outputs that are data sources become links that you can click to open the Data Source page to view more information about the data source or edit the flow input connection.
Schedule	In the Schedule field, view the scheduled tasks that the output step is assigned to. A flow output can be assigned to one or more tasks. If no schedule has been assigned yet, click Create new task to add the output step to a schedule. To immediately run the flow to update a specific output step, click the Runbutton on the left-hand side of the row.
Errors	If the flow has errors, the flow run will fail. Connectivity errors can be resolved directly by navigating to the Connections tab for the flow and editing the input connections. To resolve any other flow errors, edit the flow then republish it and try running the flow again. If you are using an earlier version of Tableau Prep Builder, from the More actionsmenu, you can also download and open the flow in Tableau Prep Builder, then republish it and try running the flow again.

4. View an image of the flow. ### Flow Overview page without the Data Management If you don't have the Data Management installed on your server, you can still publish flows to Tableau Server , but you will see fewer options to manage your flow. ![Tableau Prep connections.](/tableau/next/en-us/server-linux/en-us/Img/prep_webauth_no_dm_addon.png) ## Flow Connections page View both the input and output locations for a flow, connection types, authentication settings, input and output steps and any connectivity errors. You can set authentication settings when publishing a flow. For more information, see [Publish a Flow](https://help.tableau.com/current/prep/en-us/prep_conductor_publish_flow.htm). For database input types, click the More actions![The More Options menu option represented by 3 dots.](/tableau/next/en-us/server-linux/en-us/Img/prep_server_rmoremenu.png) menu for an input connection to edit the connection and change the server name, port, user name and password. ![A table of connection types and their sources in Tableau Prep.](/tableau/next/en-us/server-linux/en-us/Img/prep_serverconnections.png) ## Flow Scheduled Tasks page (Data Management required) View any schedules that the flow is assigned to, the outputs that are included in those schedules, and any parameters applied to the flow (version 2021.4 and later). As an administrator, you can click the schedule link to open the Schedules page and see a list of flows that are assigned to that schedule. For more information about assigning flows to a schedule, see Schedule Flow Tasks in the [Tableau Cloud](https://help.tableau.com/current/online/en-us/prep_conductor_online_schedule_flow_task.htm) or [Tableau Server](https://help.tableau.com/current/server/en-us/prep_conductor_schedule_flow_task.htm) help. To view the outputs on a schedule or the tasks assigned to a linked task (version 2021.3 and later), click the links in the Schedule type column. You can also add new tasks or manage existing ones from this page. To take action on an existing task, select the check box on a task card then click the Actions drop-down menu to run, edit, or delete the task. If the flow fails to run after a configured number of consecutive attempts, the flow is automatically suspended. You can see that status on the Overview tab as well as this tab. You can resume suspended tasks from this menu. For information about how to set the threshold for suspended flow tasks, see [Step 5: Optional Server Configurations](https://help.tableau.com/current/server/en-us/prep_conductor_config_server_optional.htm). For more information about suspended flow tasks, see [View and resolve errors](https://help.tableau.com/v0.0/server-linux/en-us/prep_conductor_monitor_flow.htm#View_Errors). **Note**: The Scheduled Tasks page for flows was redesigned in version 2021.3. Your view may look different depending on your server version. ![The Flow page with the Scheduled Tasks tab selected](/tableau/next/en-us/server-linux/en-us/Img/prep_parameters_scheduled_tasks.png) ## Schedules page On the Schedules page, you can view the flows assigned to a schedule and the details about the flow runs. If the schedule includes linked tasks (version 2021.3 and later) the number of flows included in the linked tasks is shown. You can run the schedule on-demand and run all flows assigned to it. You can also select one or more flows, then use the Actions menu to change the flow schedule or priority, delete selected flows from the schedule or resume suspended flows. For information about how to set up a schedule, see [Step 3: Create Schedules for Flow Tasks](https://help.tableau.com/current/server/en-us/prep_conductor_create_schedule_definitions.htm). ![A table that shows flow details, including priority, status, last run, next scheduled run, and errors.](/tableau/next/en-us/server-linux/en-us/Img/prep_server_schedules_page.png) ## Flow Run History (Data Management required) See, search, and sort through a list of historical runs for a flow. This page also includes details about the flow run such as run type, parameter values applied to flows included in each flow run (version 2021.4 and later), duration and number of rows that were generated. If the flow output has an error, hover over the error to view the messages. If applicable, click the Go to Connections link in the error message to navigate to the Connections page to fix connectivity errors. You can also edit the flow directly to fix any errors, or click Download the flow to download and fix flow errors in Tableau Prep Builder, then republish the flow to continue to manage it using Tableau Prep Conductor. **Note**: The run history for a flow will persist unless the flow is deleted. ![The Run History tab is chosen, and the Errors column displays a message about the errors.](/tableau/next/en-us/server-linux/en-us/Img/prep_parameters_run_history.png) ## Flow Revision History If you need to revert a flow to a previous version, from the More actions![The More Options menu option represented by 3 dots.](/tableau/next/en-us/server-linux/en-us/Img/prep_server_rmoremenu.png) menu for the flow, select Revision History. On the Revision History dialog, select the flow version from the list that you want to revert to. ![A table of Revision History with the option to restore a revision.](/tableau/next/en-us/server-linux/en-us/Img/prep_server_revisionhistory.png) ## Who can do this Server Administrators can activate Data Management license keys. Server administrators can enable Tableau Prep Conductor. Creators can create, edit, and run flows manually. If the Data Management is installed, creators can run flows on a schedule. [Skip to main content](#main-content) # About the Identity Migration Beginning in version 2022.1, Tableau Server stores and manages identity information using the Identity Service. Identity migration is a prerequisite for configuring and using [identity pools](https://help.tableau.com/v0.0/server-linux/en-us/identity_pools.htm). > [!WARNING] > > **Important:** If you don't plan to use the identity pools capability, we recommend that you don't run the identity migration. Running the identity migration without plans to use identity pools won't provide benefits to your Tableau Server deployment. For existing deployments, if upgrading Tableau Server to version 2022.1 (or later) and restoring a backup of Tableau 2021.4 (or earlier), you can start the identity migration after Tableau Server upgrade completes to populate the new Identity Service. The identity migration populates supplemental Identity Service tables for all Tableau Server users, which are then used to authenticate users through the Identity Service. The migration runs in the background and won’t interrupt or interfere with your users' use of Tableau Server. As an administrator, you can monitor and manage the migration, including changing when the migration runs or resolving any potential migration conflicts, through a dedicated **Identity Migration** page available from Tableau Server’s Users page. This page is available for the duration of the migration process. ## Summary of steps for existing deployments For new and existing deployments, you must configure Tableau Server to use the Identity Service after the migration completes to take advantage of the identity structure improvements and configure identity pools. > [Step 1: Before you begin](#step1) > > [Step 2: Enable new schema and sign-in capability](#step2) > > [Step 3: Start the identity migration](#step3) > > [Step 4: Complete the identity migration](#step4) > > [Step 5: Configure Tableau Server to use the Identity Service](#step5) > > [Step 6: Enable identity pools](#step6) ### Key terms - **Identity Service** - a service in Tableau Server 2022.1 (and later) that is responsible for the administration of user identities, including authentication and provisioning. The service uses an identity schema where user identities are represented by Identity Service tables and the legacy "system\_users" table. - **Identity pools** - an identity management tool that uses provisioning and authentication information to enable user access to Tableau Server. Identity pools enable a more centralized and flexible identity management workflow built on the Identity Service for the storage and management of user identities in Tableau Server. - **Legacy identity store mode** - a limited identity schema used by Tableau Server 2021.4 (and earlier), where user identities are only represented by the legacy "system\_users" table. - **Identity migration** - the auditing process that evaluates existing Tableau Server user identities, queries the upstream external identity stores for additional identity information (as appropriate), and imports that additional identity information to the Identity Service. - **External identity store** - an identity store type external and upstream to Tableau Server where all identity information is stored and managed by an external directory service (Active Directory (AD) or LDAP). If configured, Tableau Server synchronizes to the external directory so that a copy of the identity information exists in Tableau Server. - **Local identity store** - an identity store type provided by Tableau Server. If configured, Tableau Server stores and manages identity information in the Tableau Server repository without any configured external directory for this information. - **System user** - a Tableau Server user. A user corresponds to a sign-in record ("system\_users") in both the Identity Service (through the "system\_users\_identities" table) and legacy identity store mode. A "system\_users" record can potentially have multiple user identities associated with it and enabled to sign in to multiple sites. The link between a "system\_users" record and sites is defined in the "users" table. ### Purpose of the identity migration When you create a Tableau Server backup, identity information is saved in the identity schema used by the version of Tableau Server the backup was created for. The migration is necessary to populate identity information from the identity schema used in the backup to the identity schema used by the Identity Service. **Identity schema of Tableau Server 2021.4 and earlier** ![A diagram of an application service with two boxes labeled "system\_users" and "domains."](/tableau/next/en-us/server-linux/en-us/Img/id_mig_tables_legacy.png) The identity schema used by the legacy identity store mode consists of two tables, "system\_users" and "domains." **Identity schema of Tableau Server 2022.1 and later** ![A diagram that illustrates the database tables for the identity service.](/tableau/next/en-us/server-linux/en-us/Img/id_mig_tables.png) The identity schema used by the Identity Service includes the legacy "system\_users" tables and supplemental Identity Service tables (\*\_identity\_stores and \*identities) that capture more identity information. The additional tables help reduce issues that can be caused by upstream changes in the external identity stores. ### What happens during the identity migration When information about user identities are migrated, identity information stored in the legacy "system\_users" table are supplemented with the Identity Service tables. The type of Identity Service tables that the identity information is supplemented with depends on which identity store type Tableau Server is configured for: local, Active Directory (AD), or Lightweight Directory Access Protocol (LDAP). - For **AD** identity store types, Identity Service tables only inherit unambiguous attributes or attributes that are not stored in the same database record. For example, sAMAccountNAme and userPrincipalName (UPN) can be stored in the same name record of a legacy "systems\_users" table, which can occur as a result of a complex series of rules. In most cases, the migration is able to correctly interpret and successfully migrate the user identity. However, if the migration produces ambiguous results, you must either manually acknowledge the ambiguity or manually resolve the conflict using the dedicated Identity Migration page. For more information, see [Resolve Identity Migration Conflicts](https://help.tableau.com/v0.0/server-linux/en-us/identity_migration_conflicts.htm). - For **LDAP** identity store types, like AD identity store types, Identity Service tables only inherit unambiguous attributes. In most cases, the migration is able to correctly interpret and successfully migrate the user identity. However, if the migration produces ambiguous results, you must either manually acknowledge the ambiguity or manually resolve the conflict using the dedicated Identity Migration page. For more information, see [Resolve Identity Migration Conflicts](https://help.tableau.com/v0.0/server-linux/en-us/identity_migration_conflicts.htm). - For **Local** identity store types, Identity Service tables inherit the user and domain fields directly. This means, no additional information or manual resolution is required from you. When Tableau Server is configured for this type of identity store, migration of users identities happens after the Tableau Server backup restore process. ## Perform the identity migration ### Step 1: Before you begin Before you begin, identify your Tableau Server version and upgrade method (if applicable) below to determine next steps in the identity migration.

Upgrading From	Upgrading To	Upgrade Method	Next Steps
n/a	Tableau Server versions: 2022.1.0 (and later), 2022.3.0 (and later), 2023.1 (and later), and later	New installation	Go to Step 2.
Tableau Server versions: 2022.1-2022.1.7, 2022.3-2022.3.9, or 2023.1-2023.1.5	Tableau Server versions: 2022.1.8 (and later), 2022.3.10 (and later), 2023.1.6 (and later), and later	n/a	Have you enabled the new schema for sign in (i.e., `wgserver.authentication.legacy_identity_mode.enabled -v false`)? If no, go to Step 2. If yes, go to Step 6.
Tableau Server versions: 2021.4.x or earlier	Tableau Server versions: 2022.1.8 (and later), 2022.3.10 (and later), 2023.1.6 (and later), and later	n/a	Go to Step 2.
Tableau Server versions: 2021.4.x or earlier	Tableau Server versions: 2022.1.0-2022.1.7, 2022.3.0-2022.3.9, or 2023.1.0-2023.1.5	If you’re performing a Blue/Green upgrade or manually upgrading Tableau Server by 1) installing Tableau Server on a new machine and then 2) backing up and restoring Tableau Server using the tsm maintenance (backup and restore) commands, you’re required to take some additional steps to initiate the migration.	Go to Troubleshoot Issues with the Identity Migration.
		If you’re doing an “in-place” single-server or multi-node upgrade of Tableau Server using the method described here, there are no additional steps required from you to initiate the migration. The migration initiates after Tableau Server upgrade to version 2022.1 (or later) is complete.	Go to Step 2.
		If you’re manually upgrading Tableau Server by 1) installing Tableau Server on a new machine and then 2) exporting and importing configuration and topology information using tsm settings (export and import) commands, there are also no additional steps required from you to initiate the migration. The migration initiates after the import process completes on the new Tableau Server machine.	Go to Step 2.

### Step 2: Enable new schema and sign-in capability Before starting the identity migration, the new identity schema must be enabled by the tsm command [features.NewIdentityMode](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#identity_mode_new); and to continue allowing sign-in to Tableau Server while the identity migration process takes place by the [wgserver.authentication.legacy\_identity\_mode.enabled](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#legacy_identity_mode) or [tsm authentication legacy-identity-mode ](https://help.tableau.com/v0.0/server-linux/en-us/cli_authentication_tsm.htm#tsm_identity_mig_legacy) tsm commands. 1. Open a command prompt as admin on the initial node (where TSM is installed) in the cluster. 2. Run the following command: ``` tsm configuration set -k features.NewIdentityMode -v true ``` 3. Run the following commands depending on the version of Tableau Server you're running: - For Tableau Server versions 2022.1.8 (and later), 2022.3.10 (and later), 2023.1.6 (and later), and later: ``` tsm configuration set -k wgserver.authentication.legacy_identity_mode.enabled -v true tsm pending-changes apply ``` - For Tableau Server versions 2022.1.0-2022.1.7, 2022.3-2022.3.9, or 2023.1-2023.1.5: ``` tsm authentication legacy-identity-mode enable tsm pending-changes apply ``` **Note:** Running these commands causes Tableau Server to restart. ### Step 3: Start the identity migration **Note:** If you’ve upgraded to Tableau Server versions 2022.1-2022.1.7, 2022.3-2022.3.9, or 2023.1-2023.1.5, the identity migration starts by default and you can skip to [Step 4: Complete the identity migration](#step4) below. To start the identity migration, you must enable the identity migration capability by using the tsm command [features.IdentityMigrationBackgroundJob](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#identity_migration). 1. Run the following command: ``` tsm configuration set -k features.IdentityMigrationBackgroundJob -v true ``` After the identity migration begins, you’ll see a notification in Tableau Server that links you to the Identity Migration page. The Identity Migration page is where you can monitor the status of the identity migration and identity conflicts that need to be resolved. ### Step 4: Complete the identity migration **Note**: Skip this step for new installations. To complete the identity migration, all identity conflicts must be resolved or acknowledged before you can enable the Identity Service for Tableau Server. 1. Sign in to Tableau Server as an administrator. 2. From the left navigation pane, select Users (or All Sites > Users for a multi-site Tableau Server) and then click the Identity Migration page to verify the migration has started. You can monitor and manage its progress using the dedicated Identity Migration page available from Tableau Server’s Users page. For more information, see [Manage the Identity Migration](https://help.tableau.com/v0.0/server-linux/en-us/identity_migration_manage.htm). 3. Resolve or acknowledge all identity conflicts as described in [Resolve Identity Migration Conflicts](https://help.tableau.com/v0.0/server-linux/en-us/identity_migration_conflicts.htm) so that All failures tab displays "0" like in the image below. ![Identity migration summary showing zero failures.](/tableau/next/en-us/server-linux/en-us/Img/id_mig_failures_acknowledge.png) 4. Do _one_ of the following: - To run the identity migration job now, next to the Migration Overview heading, click the Edit Schedule drop-down arrow, and then select Run Now. ![Dropdown menu for editing the migration schedule with options to disable or run now.](/tableau/next/en-us/server-linux/en-us/Img/id_mig_overview_runnow.png) - Alternatively, you can wait for the migration job to run during the next scheduled time. 5. After the migration completes, from the Identity Migration page, validate that the Migration Overview shows 100% complete. ![Identity migration progress bar indicating 100% completion.](/tableau/next/en-us/server-linux/en-us/Img/id_mig_complete.png) ### Step 5: Configure Tableau Server to use the Identity Service After the identity migration is complete, configure Tableau Server to use the Identity Service. 1. Open a command prompt as an administrator on the initial node (where TSM is installed) in the cluster. 2. Run the following commands depending on the version of Tableau Server version you are running: - For Tableau Server versions 2022.1.8 (and later), 2022.3.10 (and later), 2023.1.6 (and later), and later: ``` tsm configuration set -k wgserver.authentication.legacy_identity_mode.enabled -v false ``` - For Tableau Server versions 2022.1-2022.1.7, 2022.3-2022.3.9, or 2023.1-2023.1.5: ``` tsm authentication legacy-identity-mode disable ``` **Note:** After running one of the commands above, the dedicated Identity Migration page is removed and no longer accessible. The page is accessible only when `tsm configuration set -k wgserver.authentication.legacy_identity_mode.enabled` is `true` or `tsm authentication legacy-identity-mode` is enabled. After Tableau Server is configured to use the Identity Service, when users sign in to Tableau Server, Tableau Server searches for their user identities using their identifiers in the configured identity store. From the identifiers, the universal unique identifiers (UUID) are returned and used to match existing Tableau Server user identities. This process then generates sessions for the users and completes the authentication workflow. ### Step 6: Enable identity pools When you’ve completed the identity migration and enabled the Identity Service, enable the identity pools capability in preparation for configuring [identity pools](https://help.tableau.com/v0.0/server-linux/en-us/identity_migration_manage.htm). 1. Run the following commands: ``` tsm configuration set -k features.IdentityPools -v true tsm pending-changes apply ``` **Note:** Running these commands causes Tableau Server to restart. ## Other articles in this section [Skip to main content](#main-content) # About the Tableau Server Data Dictionary The Tableau Server Data Dictionary includes information about the tables and views in the "workgroup" PostgreSQL database of the Tableau Server repository. This database provides persistent storage for Tableau Server and is primarily intended to support that application. The Data Dictionary is not a complete description of all tables and fields in the database, and is provided for customers who want to query the database for information about usage on Tableau Server. Because the database and its contents are intended to support Tableau Server, the structure and contents may change without warning. This means any custom views you build from directly querying the database could break. > [!IMPORTANT] > > The Data Dictionary is provided with an **As-Is** level of support. For assistance creating reporting based on the dictionary, including writing queries to the database or updating broken workbooks, please engage with the Tableau Community forums. [Open the Data Dictionary](https://tableau.github.io/tableau-data-dictionary/2026.3/data_dictionary.htm "Data Dictionary"). [Skip to main content](#main-content) # About the Virtual Connection Editor Centralize and manage data access for your organization using these features: - **Virtual connections** – Reusable, managed data access points. - **Data policies** – Use to set row-level security. - **Centralized extracts** – Reuse the same extract multiple times. Use the virtual connection editor to create virtual connections and data policies. The following diagram shows the process: ![Diagram outlines the process of creating a virtual connection and data policy](/tableau/next/en-us/server-linux/en-us/Img/dm_vconn_workflow_diagram.png) To get started, select a database, if required. Then, select and drag a table to the Tables tab. [Read full topic](https://help.tableau.com/current/server-linux/en-us/dm_vconn_overview.htm) ## Related tasks [Add Tables to the Connection](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_add_tables.htm) [About Data Policies](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_about_data_policy.htm) [Create and Test Data Policies](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_create_data_policy.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) # About Virtual Connections and Data Policies Virtual connections are a Tableau content type, along with data sources, workbooks, and flows, to help you see and understand your data. Virtual connections provide a central access point to data. Another key feature introduced with virtual connections is data policies, which support row-level security at the connection level, rather than the workbook or data source level. Row-level security data policies are applied to any workbook, data source, or flow that uses the virtual connection. A virtual connection can access multiple tables across several databases. Virtual connections let you manage extracting the data and the security in one place, at the connection level. ![Diagram shows how virtual connections centrally manage the connection and security](/tableau/next/en-us/server-linux/en-us/Img/dm_vconn_diagram_centralized.png) For information about row-level security options, see an [Overview of Row-Level Security Options in Tableau](https://help.tableau.com/v0.0/server-linux/en-us/rls_options_overview.htm). Not every virtual connection has an associated data policy. You can also use a virtual connection simply as a central place to manage connection credentials. ## Key terms - Virtual connection. A sharable resource that provides a central access point to data. - Connection. The server name, database, and credentials you use to access data. A virtual connection has one or more connections. Each connection accesses one database or file. - Virtual connection table. A table in a virtual connection. - Data policy. A policy that's applied to one or more tables in a virtual connection to filter data for users. For example, use a data policy to apply row-level security to tables in a virtual connection. - Policy table. A fact or data table in a data policy that is filtered. - Policy column. A column that's used to filter the data in the policy tables. A policy column can be in a policy table or in an entitlement table. - Entitlement table. A table that includes both a policy column you can use to filter policy tables and another column you can relate (map) to a column in a policy table. - Policy condition. An expression or calculation that is evaluated for every row at query time. If the policy condition is TRUE, then the row is shown in the query. ## License virtual connections and data policies Virtual connections and data policies are licensed through Data Management. For information about how Data Management licensing works, see [License Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_license.htm). ## Enable virtual connections and data policies Virtual connections and data policies are automatically enabled on Tableau Server and Tableau Cloud with Data Management. ## Permissions Permissions for virtual connections work much like the permissions for other Tableau content. After you publish a virtual connection, anyone can view the connection. However, only the connection creator and administrators can access data using the connection, until the connection creator explicitly grants more permissions. When you create a virtual connection, you must set the permissions for the Connect capability to enable other users to connect to data using the virtual connection. The Connect capability allows you to share a virtual connection and allows users to query it. With connect permissions, a user can view the tables in a virtual connection and create content using the tables. For more information, see [Set permissions on a virtual connection](https://help.tableau.com/v0.0/server-linux/en-us/dm_vconn_publish_save.htm#set-perms). ### Permissions vs. data policies Permissions define what a person can or can't do with a piece of content in Tableau. Permissions are made up of capabilities—the ability to do things like view content, web edit, download data sources, or delete content. Permission rules define which capabilities are allowed or denied for a user or group on a piece of content. The interplay between license level, site role, and potentially multiple permission rules factor into the final determination of what a person can or can't do—their effective permissions. See [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm) for details. Data policies filter the data in a virtual connection, making sure that people see only the data they're supposed to see. A data policy is applied and filters the data when it's viewed in the Tableau content (for example, a workbook or flow). The policy condition in a data policy is a calculation or expression that defines access to the data. User functions are often used to limit access to users or groups. Access can be based on the user name, the group a user belongs to, or a region value. See [Create a Data Policy for Row-Level Security](https://help.tableau.com/v0.0/server-linux/en-us/dm_vconn_create_rlspolicy.htm) for details. Both permissions and data policies govern access. Simply put, permissions determine which _content_ you can see, access, use, or create; data policies determine which _data_ you can see. #### How permissions and data policies work together Tableau permissions are applied to Tableau content first. People can only do the things they have the capabilities to do with Tableau content—data policies don't override Tableau permissions. After permissions are evaluated, the data policy is applied to determine which data in the virtual connection the person can see based on the policy condition. The following example describes the effects of permissions and data policies on a virtual connection that contains salary data: - The virtual connection is in the HR project, which is restricted to Tableau users in the HR group. Anyone outside the HR group can't see content in the HR project, which means they can't browse to, connect to, or view the virtual connection. - The virtual connection has Connect permissions granted only to members of the HR Business Partners group. All others in the HR group can see that the virtual connection exists, but they can't view the data it contains. When they view a workbook that uses that virtual connection, they can't see any data. - The virtual connection also contains a data policy that filters the salary data based on the individual user, so HR Business Partners can see only rows that pertain to employees in their business unit. When they view a workbook that uses that virtual connection, they see data only for their business unit. ## Features and functionality For the manager of data, virtual connections provide: - **Securely managed service accounts.** If you use a 'service account' model, now instead of having to share that service account information with any user who wants to access that data, you can give the service account credentials to the few analysts who are empowered to create virtual connections. - **Agile physical database management.** You must make database changes (for example, a field is added or table name is changed) only one time in the virtual connection, rather than in every piece of content where the data is used. - **Reduced data proliferation.** By centrally managing extract refresh schedules, refreshes are scheduled once, ensuring that anyone who accesses the data from that virtual connection is seeing fresh data. - **Centralized row-level security.** You can create data policies that apply row-level security to both Tableau extracts and live queries at the connection level. The data policies are applied to any workbook, data source, or flow that uses the virtual connection. **Note:** Data policies are valid for flow input data, but not for flow output data. Users with access to flow output data will see all of the data, and not only a subset of it that pertains only to them. As the user of data, you benefit from virtual connections knowing that you have: - **Appropriate access** to only the data you should see, because row-level security is already applied to the data. - **Flexibility** to use data that's been curated and secured. The virtual connection stores and shares the connection information. All you have to do is create a data source with a data model specific to your needs. - **Trust** that data is fresh because the extract refresh schedule has already been set. - The ability to **share** content freely, assured that you won't put security at risk because data policies are always enforced. ## Virtual connection editor workflow The virtual connection editor enables you to create: - Virtual connections, which are a Tableau content type that provides a sharable central access point to data. - Data policies that support row-level security at the connection level. After you create a virtual connection and its associated data policies, you can publish it and set the permissions to share with other users. You can also schedule extract refreshes so that all content that uses the virtual connection is accessing fresh data. The following diagram shows the workflow to create a virtual connection. At any time during the process, you can publish or save a draft of your connection, but the connection must be published before you can schedule extract refreshes or use (or edit) a virtual connection. You must also set permissions before others can use the connection. ![Workflow diagram for creating a virtual connection](/tableau/next/en-us/server-linux/en-us/Img/dm_vconn_workflow_diagram.png) Click a step in the process to go to that help topic. ## Next step The first step is to [Create a Virtual Connection](https://help.tableau.com/v0.0/server-linux/en-us/dm_vconn_create_conn.htm). ## Other articles in this section [Skip to main content](#main-content) # Access Scopes for Connected Apps Starting with Tableau Server version 2022.3, using Tableau connected apps, you can programmatically call and access the Tableau REST API through your custom application on behalf of Tableau Server users. Access to the REST API is enabled by a JSON Web Token (JWT) defined as part of the initial Sign In request. The JWT must contain scopes that define the REST API methods that are available to your custom application and its users through the connected app. Authorize access to the REST API using connected apps to: - Enhance security—using a JWT as a bearer token is inherently more secure than storing and managing admin user passwords through .env files in vaults - Enhance efficiency—using a JWT as a bearer token enables a simplified impersonation with one request to the Sign In endpoint instead of two requests - Extend and automate complex Tableau integrations and backend queries—such as dynamic content retrieval and advanced filtering ## Scope actions Connected apps use scopes that grant access to content or administrative actions through the [REST API methods that support JWT authorization](#scopes) (below). A scope is a colon-separated string that starts with the namespace `tableau`, followed by the Tableau resource that access is being granted to, such as `datasources`, and ends with the action that is allowed on the resource, such as `update`. The action a scope can take include: - `create` - `read` - `run` - `update` - `download` - `delete` For example, a scope that allows your custom application to call the [Update Data Source](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_data_sources.htm#update_data_source) method looks like: `tableau:datasources:update` ## Scope types The type of scope you use depends on the content or administrative action that you want to enable. Scopes generally fall into one of the following types: content read, individual, wildcard, and cross-category. - **Content read scope:** The content read scope, `tableau:content:read`, enables supported GET methods for Tableau content. When you use this scope, you enable actions across REST API categories. More specifically, using this scope you enable GET methods for data sources, metrics, views, workbooks, projects, and sites. Starting in Tableau Server 2023.3, you also specify this scope in a JWT that will be used to create a credentials token for use with the [Metadata API](https://help.tableau.com/current/api/metadata_api/en-us/docs/meta_api_auth.html). Starting in Tableau Server 2025.1, you also specify this scope in a JWT that will be used to create a credentials token for use with the [VizQL Data Service](https://help.tableau.com/current/api/vizql-data-service/en-us/index.html). **Note:** To enable GET methods for administrative actions, like users and groups, you can use their individual scopes. - **Individual scopes:** To enable supported content and administrative actions, you can use their individual scopes. An individual scope is generally associated with a single method and REST API category. Examples: - To enable publish or update a data source action, you can use the individual `tableau:datasources:create` or `tableau:datasources:update` scope, respectively. - For administrative actions like add or remove users, you can use the individual `tableau:users:create` or `tableau:users:delete` scope, respectively. **Note:** There are some individual scopes that can enable actions across REST API categories. For example, `tableau:views:download` enables actions in the view data and workbooks REST API categories. - **[Wildcard (\*) scopes:](#wildcard)** For certain scopes, you can replace the action with the wildcard character (\*) to enable supported actions within a specific REST API category. Examples: - You can use the `tableau:projects:*` wildcard scope to enable the create, delete, update actions in the projects REST API category. - You can use the `tableau:users:*` wildcard scope to enable the get/list, add, delete, update actions in the users REST API category. - You can use the `tableau:tasks:*` wildcard scope to enable the get/list, add, delete, update and run actions of extract and subscriptions REST API categories. In addition, this scope enables update data source (if an extract) and update workbook. - **[Cross-category scopes:](#cross)** In addition to the content read scope, there are a few additional scopes that, if used, enable supported actions across different REST API categories. Examples: - If using the `tableau:tasks:run` scope, you enable actions in the data sources and workbooks REST API categories. - Again, if using the `tableau:views:download` scope, you enable actions in the view data and workbook REST API categories. - If using permissions scopes like `tableau:permissions:update` or `tableau:permissions:delete`, you enable actions in the data sources, workbooks, and projects REST API categories. ## Summary of how to authorize REST API access The following list summarizes the steps to request access to the REST API through a JWT: 1. **Create a connected app** using one of the following methods: - [Configure Connected Apps with Direct Trust](https://help.tableau.com/v0.0/server-linux/en-us/connected_apps_direct.htm) - [Configure Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/v0.0/server-linux/en-us/connected_apps_eas.htm) 2. **Generate a valid JWT**—at runtime your custom application will generate a valid JWT, configured with the scopes you have included 3. **Make a [Sign In](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_in) request**—your custom application will make a Sign In request using the JWT to return a Tableau credentials token and site ID (LUID) 4. **Use the Tableau access token in subsequent requests**—in subsequent REST API calls, use 1) the Tableau credentials token as the [`X-Tableau-Auth`](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm#using_auth_token) header value and 2) the site ID (LUID) in the request URI ### Example For example, suppose you create a connected app using direct trust. Using direct trust, your custom application that calls the REST API generates a valid JWT using the client ID and client secret generated by the connected app. **Scopes in the JWT** To successfully authorize access to the REST API, the JWT must also contain the scopes that define the REST API capabilities. For example, to enable various data source-related methods, you might include the following scopes in the JWT: `"tableau:content:read","tableau:datasources:create","tableau:datasources:update","tableau:datasources:download","tableau:tasks:run"` Or `"tableau:content:read","tableau:datasources:*","tableau:tasks:run"` **Note:** Scope values must be passed as a list type. **Sign In Request URI** To make a call to the REST API, your custom application must first make a Sign In request to generate a Tableau credentials token. ``` POST https://myco/api/3.17/auth/signin ``` **Request body** To authorize REST API access using a JWT, the Sign In request body must contain the valid JWT like the example below. ``` ``` **Response body** The Sign In request produces the following response body, which includes the Tableau credentials token. ``` ``` After the Tableau credentials token is generated, add it to the header of all subsequent REST API requests. **Header** X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd All subsequent REST API requests using the Tableau access token are then bounded by the scopes in the JWT. ## REST API methods that support JWT authorization Scopes for connected apps grants your custom application access to Tableau REST API capabilities on users' behalf ### How to find scopes You can find the required scope for a JWT-supported method in its properties block in the [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api.htm) Help. If a scope is not listed in the method’s properties block, access to that method can’t be controlled by a JWT. For example, a scope that allows you to call the [Query Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#query_site) method in the Tableau REST API is `tableau:sites:read`. **Notes:** - Both the [Sign In](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_in) and [Sign Out](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_out) methods are supported by JWT authorization but do not require scopes to use beginning in Tableau Server 2023.3. - For scopes supported by the Embedding API v3, see one of the following: - [Configure Connected Apps with Direct Trust](https://help.tableau.com/v0.0/server-linux/en-us/connected_apps_direct.htm) - [Configure Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/v0.0/server-linux/en-us/connected_apps_eas.htm) - Starting in Tableau Server 2025.3, a subset of listed scopes also support REST API authorization through unified access tokens (UATs). This means connected apps and UAT scopes are the same. ### Type of scopes #### About wildcard (\*) scopes Wildcard scopes use the wildcard character (\*) instead of a specific action, to enable multiple supported actions within a specific Tableau REST API category. #### Examples

Scope	Methods enabled
`tableau:datasources:*`	Enables create, update, and update connection data source methods.
`tableau:metrics:*`	Enables query, update, and delete metrics actions.
`tableau:workbooks:*`	Enables publish, update, download, and preview image workbook actions.
`tableau:groups:*`	Enables create, query, update, and delete groups actions.
`tableau:projects:*`	Enables create, delete, and update projects methods.
`tableau:users:*`	Enables get/list, add, delete, and update users methods.
`tableau:tasks:` Note:* This scope is also cross-category.	Enables get/list, add, delete, update and run methods for extracts and subscription tasks. Enables update methods for data sources for workbooks.

#### About cross-category scopes Cross-category scopes enable multiple supported actions across multiple Tableau REST API categories. #### Examples

Scope	Methods enabled
`tableau:content:read`	Enables read/list methods for Tableau content, including data sources, metrics, views, workbooks, projects, and sites.
`tableau:tasks:run`	Enables run methods for data sources, workbooks, and extracts.
`tableau:views:download`	Enables download methods for view data and workbooks.
`tableau:tasks:` Note:* This scope is also wildcard.	Enables get/list, add, delete, update and run methods for extracts and subscription tasks. Enables update methods for data sources for workbooks.

## Troubleshoot scopes ### 401001 - signin error If you encounter error 401001, the **Sign In** response body is appended with one of the following additional connected apps-specific error codes: 16, 10084, or 10085. For example, in the following response body, "10084” is the connected apps error code you can use to help troubleshoot issues with signing in to Tableau Server using a JWT for REST API authorization. "summary": "Signin Error", "detail": "Error signing in to Tableau Cloud (10084)" To help resolve the issue, refer to the description of the applicable error code and its potential causes. - **16: Could not find user**—this error can occur because the incorrect "`sub`" (user name) was specified - **10084: Could not parse access token**—this error can occur for the following reasons: - JWT is invalid or there was an unexpected problem - Incorrect "`aud`" (audience) was specified - For direct trust, there was a problem with signing the secret - **10085: Could not fetch secret to verify signature for client ID**—this error can occur for the following reasons: - Incorrect client ID in "`iss`" specified - For direct trust, incorrect "`kid`" (secret ID) was specified - For EAS, unable to fetch keys from the JWKSource ### 401002 - unauthorized access error If you encounter error 401002 and have confirmed that you have the appropriate permissions to make the request, ensure the scope included in the JWT is correct and matches the request you're trying to make. For a list of endpoints and supported scopes, see the [REST API methods that support JWT authorization](#scopes) section above. [Skip to main content](#main-content) # Access Sites from Connected Clients By default, Tableau Server allows users to access a site directly from a Tableau _client_. It allows this access after the user provides credentials the first time they sign-in from the client. A client in this case is a Tableau application or service that can exchange information with Tableau Server. Examples of Tableau clients include Tableau Desktop, Tableau Prep Builder, and Tableau Mobile. Tableau Server establishes a _connected client_ by creating a secure refresh token that uniquely identifies a user when the user signs in from the client. [Skip to main content](#main-content) # Access Status Remotely **Note**: The information in this article refers to the Tableau Server status page. For information about the Tableau Server status page and the TSM status page, see [View Server Process Status](https://help.tableau.com/v0.0/server-linux/en-us/service_viewstatus.htm). You must be a Tableau Server administrator to see the Server Status page, but you can grant remote access to other computers to allow access to a machine-readable (XML) version of the Status table by non-admin users and by computers other than the initial Tableau Server node. One reason you might do this is as part of a remote monitoring process. To grant remote access to Tableau Server status: 1. Open a command prompt as an administrator and type the following: ``` tsm configuration set -k wgserver.systeminfo.allow_referrer_ips -v ``` In the above command, `` is the IPv4 address of the computer for which you want to enable remote access to the Tableau Server status XML. For example: ``` tsm configuration set -k wgserver.systeminfo.allow_referrer_ips -v 10.32.139.31 ``` If you are enabling remote access for more than one computer, use commas to separate each IP address. ``` tsm configuration set -k wgserver.systeminfo.allow_referrer_ips -v 10.32.139.31,10.32.139.35 ``` 2. Commit the configuration change: tsm pending-changes apply If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). Now, users of computers with the IP addresses that have been added can view Tableau process status by entering the URL `http:///admin/systeminfo.xml` in a browser or from a command line (for example, `curl http://jsmith/admin/systeminfo.xml`). If Tableau Server has been configured to work with a load balancer or proxy server, use the hostname or IP address of the initial Tableau Server node to access the XML version of the status page. For details on the XML that is returned, see [Get Process Status as XML](https://help.tableau.com/v0.0/server-linux/en-us/service_status_xml.htm). [Skip to main content](#main-content) # Access Tableau Content in Microsoft 365 The Tableau app for Microsoft 365 is available in Teams, Word, and PowerPoint. With the Teams app, you can interact with views (visualizations) and metrics and share them in messages, channels, and meetings. With the Word and PowerPoint add-ins, you can add image snapshots of views and metrics to your documents and slides and refresh those snapshots to keep them up to date. With the Excel add-in, you can export data from Tableau views and published data sources into a worksheet, refresh it on demand, and publish Excel data back to Tableau Cloud. For the Tableau app to be available in Microsoft 365, your admin must deploy it and connect it to your Tableau site. For information about installing the Tableau app as an admin, see [Set Up the Tableau App for Microsoft 365](https://help.tableau.com/v0.0/server-linux/en-us/teams_set_up.htm). Note: If you've set the language in Tableau or Microsoft 365 to a Tableau-supported language other than English (US), you might see text in English that isn't localized. ## Use the Teams app If your admin didn’t pre-install the app for you but has deployed it for your organization, you can install the app yourself. To learn how, see [Add an app to Microsoft Teams](https://support.microsoft.com/en-us/office/add-an-app-to-microsoft-teams-b2217706-f7ed-4e64-8e96-c413afd02f77) in the Microsoft Teams documentation. The Teams app has three tabs: Tableau, Pulse, and Configuration. The Tableau tab shows the views that you’ve added as favorites. The Pulse tab shows the metrics that you follow and a summary of insights about those metrics. Be aware that the Pulse tab appears only for Tableau Cloud sites. The Configuration tab lets you set the site that Microsoft Teams checks when you search for content and, if you’re a Tableau admin, add and remove site configs. If you don’t have any favorite views or followed metrics, you won’t see any content in the app. Sign in to your Tableau site directly to add views as favorites and to follow metrics. For more information, see [Mark Favorites](https://help.tableau.com/current/pro/desktop/en-us/favorites.htm) and [Follow Metrics](https://help.tableau.com/current/online/en-us/pulse_explore_metrics.htm#follow-metrics). Though it's possible to add other types of content as favorites, none of your favorite content besides views appears in the Tableau app. If you want to see all of the views in a workbook, add each individual view to your favorites. ### Explore content in Teams On the Tableau or Pulse tab, click on the card for a view or metric to open the full interactive version. The interactive view or metric allows you to see more details about the data and filter the data based on different dimensions or time ranges. #### Search for content If you know the name of a view or metric, you can search for it in the Tableau app. You can also enter the URL to a view in the search bar to access specific content or custom views. 1. On the Tableau or Pulse tab, select the search icon. ![Tableau app search entry point](/tableau/next/en-us/server-linux/en-us/Img/teams_app_search.png) 2. Enter the name of the view or metric. 3. Select the open button next to the view or metric name to go to the interactive version. #### Follow a metric Each metric represents a unique set of filters. When you filter an existing metric, you create a new metric if one doesn’t already exist with those filters. Follow the new metric to see it on your Pulse tab and in your insight summary. 1. On a metric, select the follow (subscribe to this metric) icon. ![Follow icon on a metric](/tableau/next/en-us/server-linux/en-us/Img/teams_app_follow.png) You can unfollow the metric by selecting the button again. #### Share content 1. On a view or a metric, select the share icon. ![Share icon](/tableau/next/en-us/server-linux/en-us/Img/teams_app_share.png) 2. Select the person, group chat, or channel to share with. 3. Select Share. #### Switch sites 1. On the Tableau or Pulse tab, select the site name from the breadcrumb menu. If more than one site is connected to the Tableau app, you see a list of sites. ![Site switch options](/tableau/next/en-us/server-linux/en-us/Img/teams_app_switch_site.png) 2. Select the site that you want to switch to. ### Add Tableau content to channels and meetings #### Pin content in a channel tab 1. In the channel where you want to pin Tableau content, select the + icon to add a tab. ![Add a channel tab options](/tableau/next/en-us/server-linux/en-us/Img/teams_app_channel_tab.png) 2. From the list of apps, select the Tableau app. 3. Select the content to pin. To pin a custom view, select the search button and enter the view URL. You can pin one view and up to five metrics per tab. To pin more Tableau content, add a second tab. ![Tableau views and metrics to pin](/tableau/next/en-us/server-linux/en-us/Img/teams_app_pin_content.png) 4. Select Save. 5. Optionally, to rename the tab, select the dropdown menu on the tab, then select Rename. ![Rename option for the Tableau tab](/tableau/next/en-us/server-linux/en-us/Img/teams_app_rename_tab.png) #### Add Tableau content to a meeting You must first create a meeting and then add Tableau content. You can't add third-party apps during the creation of a meeting. 1. In the Calendar app, find the meeting that you want to add Tableau content to, then select Edit. 2. Select More options. 3. From the toolbar, select Apps. 4. From the list of apps, select the Tableau app. 5. Select the content to pin. 6. Select Save. 7. Save the changes to the meeting. 8. After you start the meeting, select the Tableau tab. This opens the Tableau content in a side panel, which is visible to only you. 9. On the side panel, select the share to stage button. This makes the content visible to others in the meeting. Be aware that the content that you share appears to others as you see it, similar to how screen sharing works. If there's row-level security on the data, everyone in the meeting sees your view of the data. ### Share Tableau content in messages If you know the URL for a view or metric, you can quickly share that content by pasting the URL into a message. The Tableau message extension turns the link into a card that shows the content title and a thumbnail, with a button to open the full interactive view or metric. If you don’t know the URL of the content that you want to send, you can search for content to share. 1. On a message, select the + (Actions and apps) icon. 2. Select the Tableau app. 3. Search your Tableau site for the view or metric that you want to share. 4. Select the view or metric. It takes a moment to generate the card for this content. ![Metric card in a Teams message](/tableau/next/en-us/server-linux/en-us/Img/teams_app_metric.png) 5. Send the message. ## Use the Word and PowerPoint add-ins The Tableau add-in appears on the Home tab in Microsoft Word and PowerPoint. To learn how to access an add-in, see [Start using your Office Add-in](https://support.microsoft.com/en-us/office/start-using-your-office-add-in-82e665c4-6700-4b56-a3f3-ef5441996862) in the Microsoft documentation. Note that for the Tableau app to be available for you to use, your Microsoft 365 admin must first deploy it and connect it to a Tableau site. ### Add a visualization or metric to documents and slides With the Tableau add-in, you can add an image snapshot of a visualization or metric to your documents and slides. Note that Tableau Pulse metrics are available only for Tableau Cloud. These images show the time at which they were added and the user who added them, and the image links to the content in Tableau Cloud or Tableau Server. The image is the same for all users, so if there’s row-level security applied to the data, the image shows the view of the data that’s specific to the user who added the image. If other users open the image link in Tableau Cloud or Tableau Server, those users see the interactive view or metric with their credentials applied. 1. From the Home tab, select the Tableau add-in. 2. Select Insert Viz Image or Insert Pulse Image. ![Insert viz or metric options for Microsoft 365 add-in](/tableau/next/en-us/server-linux/en-us/Img/microsoft_365_add_in.png) 3. Either search for the name of the view or metric that you want to add, or select from your favorite views or followed metrics. 4. On the preview of the view or metric, select Insert Image. If you have the Tableau site URL of the content that you want to add, you can instead choose Insert Content from URL. #### Use a custom view to show filtered data To add a filtered view of the data, insert a custom view. 1. Open the view in Tableau Server or Tableau Cloud. 2. Filter the view to show the data that you want to include in the snapshot, then create a custom view. For more information, see [Use Custom Views](https://help.tableau.com/current/server/en-us/customview.htm). 3. Open the Tableau add-in in Word or PowerPoint. 4. Select Insert Content from URL, then paste in the URL for the custom view. ### Refresh a visualization or metric The image is a snapshot taken at the time that you add it. If the image no longer represents the latest data, refresh it. 1. From the Home tab, select the Tableau add-in. 2. Select Refresh Data. The Tableau add-in identifies all of the Tableau images in your document or slides. 3. Select the content that you want to refresh, then select Refresh Selected. ## Use the Excel add-in The Tableau add-in for Microsoft Excel lets you move data between Tableau and your workbooks. You can pull data from Tableau views and published data sources into a worksheet, refresh it on demand, and publish Excel data back to Tableau Cloud. The add-in appears on the Home tab in Microsoft Excel and opens in a task pane, the same way the Word and PowerPoint add-ins do. Note: Importing data into Excel and publishing Excel data are supported on Tableau Cloud. Publishing to Tableau Cloud from Excel is not supported on Tableau Server. To get started, select the Tableau add-in on the Home tab, choose your Tableau site, and then choose whether to import data from Tableau or export your Excel data to Tableau Cloud. ### Import data from Tableau 1. Open Excel and select the Tableau add-in on the Home tab to open the task pane. 2. Choose your Tableau site. 3. Choose a data source type. There are two import paths: **Published data source imports** offer a full query builder with field selection and aggregation controls **Tableau View and URL imports** bring in the data as-is with no additional filtering. #### From a worksheet or view 1. Search by name or paste a URL. 2. Preview the data. 3. Choose which rows to import. Imports are subject to standard Excel worksheet limits. Data beyond that limit is truncated. For more information about Excel worksheet limits, see [Excel specifications and limits.](https://support.microsoft.com/en-us/excel/excel-specifications-and-limits) Row options include: - Autofit to capacity — fills up to the standard Excel worksheet limits. - First N rows - Last N rows **Note**: Dashboards only expose their first sheet for import. To import a specific worksheet, navigate directly to that worksheet instead. #### From a URL 1. Paste the URL and select Search. 2. Preview the data, then select Import Data from Tableau. 3. Select OK to confirm. #### From a published data source 1. Confirm the source is tagged `Excel`. Only tagged sources appear. 2. Pick the source and select Build new query. 3. Choose fields with the field selector (Select All or Select None). 4. Optionally, select Disaggregate Data for row-level detail. This may take a while or cause a timeout, and once aggregation is applied, disaggregation is no longer available. 5. Adjust field types and aggregation as needed. 6. Select Configure Import. 7. Preview, then select Import Data from Tableau. Large field sets may trigger a truncation warning. If this happens, create a smaller published data source that contains only the fields you need. #### Manage large imports Because the standard Excel limits apply broadly, filter your fields in Tableau, trim fields, or use aggregation instead of row-level detail to stay within the limits. Measures receive default aggregations based on your selections in the field picker, unless you choose disaggregation first. Large data sets are refreshed in incremental segments rather than through one large request, which avoids timeouts; progress is visible in the task pane. If a query takes longer than 30 seconds to run, a notification appears and the process continues in the background. ### Refresh data - Choose Update Data from the add-in menu. - Select the items to refresh. - Select a destination for refreshed data. You can choose to Refresh in a new sheet, or to Refresh in current sheet, which overwrites your data. - Select Refresh Data. The outcome of each refresh (user, timestamp, and status) is shown in the add-in task pane. ### Export Excel data to Tableau Cloud Exporting Excel data to Tableau Cloud relies on the Explore in Tableau API to preload a web authoring session with your worksheet data. 1. Open the add-in in Excel. 2. Choose your Tableau Cloud site. 3. Select Export Data 4. Select the sheets to export and then select Export to Tableau Cloud. 5. To complete the export process, review the data within Tableau Cloud by selecting View Data on Tableau Cloud. 6. From Tableau Cloud, select Publish to save your new workbook. **Note**: PivotTables, merged cells, and images from Excel aren't compatible with Tableau Cloud. Incompatible content is grayed out and blocks export until you remove it. #### Sharing considerations Sharing a workbook that contains embedded Tableau content doesn't carry over Tableau permissions. Each user who wants to refresh Tableau images or re-import data must have the appropriate permissions on the relevant data source or view. The underlying Tableau data permissions always apply, regardless of whether the workbook has been shared. [Skip to main content](#main-content) # Actions by All Users The Actions by All Users view gives you insight into how your Tableau Server installation is being used. You can filter the view by actions and by time range. Server administrators can filter by site. The Total Users count shows the number of users who have performed an action. This value is not affected by any filtering. The Active user count shows the number of active users who have performed one of the selected actions. ![A line chart displays the actions taken by users on a server over a seven-day duration.](/tableau/next/en-us/server-linux/en-us/Img/adminview_user_access.png) Up to three separate groups of time lines show you how users are using Tableau Server over a time range you specify (the default is the last 7 days). If no actions are selected for a particular group, that group does not display. Possible groups are: - Access & Interactions—This shows you sign in (log on) activity, view access and data source use. - Publish & Download—This shows publishing and downloading of flows, workbooks and data sources. - Subscriptions—This shows counts of subscription email sent for workbooks and views. It also shows the counts of flow runs. Use the legend at the bottom to view a subset of the displayed actions. Click a single action to highlight the line for the action, or **Ctrl + Click** on multiple actions to highlight more than one. To clear the selection and display all the selected actions, click on any action in the legend. [Skip to main content](#main-content) # Actions by Recent Users The Actions by Recent Users view shows you which signed-in users have been active on Tableau Server over the past 24 hours. This can be useful if you need to perform some maintenance activity and want to know how many and which users this will affect, and what they are doing on Tableau Server. The view Active, Recently Active, and Idle users that are currently signed in to Tableau Server. For this view, an active user is one who took an action in the last 5 minutes, a recently active user is one who last took an action within 30 minutes, and an idle user is one who last took an action more than 30 minutes ago. The actions are displayed in the lower section of the view. ![A table with two sections. The first section contains a list of users, their associated site names, and the time of their last activity. The second section displays a scatter plot of user actions over time.](/tableau/next/en-us/server-linux/en-us/Img/adminview_recentuser.png) Select a user to see only the actions that user performed recently. Hover over an action to see details of the action. ![Tooltip shows the type of action that a user last performed and when the action happened.](/tableau/next/en-us/server-linux/en-us/Img/adminview_user_recent01.png) [Skip to main content](#main-content) # Actions by Specific User The Actions by Specific User view gives you insight into how individual users are working in your Tableau Server installation. You can filter the view by user name, actions, and time range. Server administrators on multi-site installations can filter by site. ![Viz displays a user's server actions over the past week, with distinct lines for each type of action, including access and interactions, publish and downloads, and subscriptions.](/tableau/next/en-us/server-linux/en-us/Img/adminview_user_specific.png) Up to three separate groups of time lines show you how a selected user is using Tableau Server over a time range you specify (the default is the last 7 days). If no actions are selected for a particular group, or if no actions were taken, that group does not display. Possible groups are: - Access & Interactions—This shows you sign in (log on) activity, view access and data source use. This means any interaction with a Data Source by the selected user, including extract refreshes scheduled by that user, or the user accessing a workbook that is associated with that data source. - Publish & Download—This shows publishing and downloading of flows, workbooks and data sources. - Subscriptions—This shows counts of subscription email sent for workbooks and views. It also shows the counts of flow runs. A bar graph at the bottom of the view shows which items the selected user is using. Use the legend at the bottom to view a subset of the displayed actions. Click a single action to highlight the line for the action, or **Ctrl + Click** on multiple actions to highlight more than one. To clear the selection and display all the selected actions, click on any action in the legend. [Skip to main content](#main-content) # Activate and Register Tableau Server Before you can use Tableau Server, you must activate and register it. Tableau Server requires at least one product key that both activates the server and specifies the number of license levels you can assign to users. You can access your product keys from the [Customer Portal](https://customer.tableau.com/). If you need to activate Tableau Server on a computer that is offline, see [Activate Tableau Server Offline](https://help.tableau.com/v0.0/server-linux/en-us/activate_off.htm). If you need to activate additional product keys to add capacity to an existing Tableau Server installation, see [Add Capacity to Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/capacity_add.htm). ## Prerequisite Before proceeding with the procedures in this topic, complete the following prerequisites as outlined in [Install and Configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm): - [Install and Initialize TSM](https://help.tableau.com/v0.0/server-linux/en-us/setup.htm) - TSM uses port 8850. If you are running a local firewall, open port 8850. See [Configure Local Firewall](https://help.tableau.com/v0.0/server-linux/en-us/config_firewall_linux.htm). 1. [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/v0.0/server-linux/en-us/sign_in_tsm.htm). The account you use must have administrative privileges on the computer where TSM is installed. 2. On the **Activate** page, Enter or paste your product key and click **Activate Product Key**. **Note:** In versions prior to 2023.3.0 an option to activate a trial license displays. This option was retired (removed) starting version 2023.3.0. To learn about options for trying Tableau Server, contact your account representative. After your product key is activated, it appears under **Activated Product Keys**. ![A Tableau Server activation screen, featuring a field for the 20-character license product key entry.](/tableau/next/en-us/server-linux/en-us/Img/install_01_activate.png) 3. To activate another product key, type over they key you just entered to add the new product key, and then click Activate Product Key. After your product key is activated, it appears under Activated Product Keys. Continue adding product keys in this manner until you're done. 4. When you're finished activating product keys, click Next. **Note:** If the product keys you have activated don't have the necessary capacity, such as not enough cores or only a Viewer role product key, Tableau Services Manager displays the Insufficient licenses applied dialog box. Click Activate Another Product Key to add another product key and increase capacity on your Tableau Server installation. ![A notification that the activation of product keys for Tableau Server deployment is insufficient.](/tableau/next/en-us/server-linux/en-us/Img/install_01_insufficient_product_keys.png) 5. On the Register page, enter your information into the fields and click Register. ![Registration step of Tableau Server activation wizard, with required fields for populating contact information, company information, and regional details.](/tableau/next/en-us/server-linux/en-us/Img/install_02_register.png) ### Activate Tableau Server To activate Tableau Server for production use, you must have a product key. To activate a product key, run the following command: ``` tsm licenses activate -k ``` To activate a two-week trial, run the following command: ``` tsm licenses activate -t ``` If you are unable to activate Tableau, for example, if you get an error like this: License Server not available see [Activate Tableau Server Offline](https://help.tableau.com/v0.0/server-linux/en-us/activate_off.htm). **What if I get an access denied error when I attempt to run TSM commands?** The account that you use to configure the rest of the installation must be a member of the `tsmadmin` group that was created during initialization. To view the user accounts in the `tsmadmin` group, run the following command: `grep tsmadmin /etc/group` If the user account is not in the group, run the following command to add the user to the `tsmadmin` group: `sudo usermod -G tsmadmin -a ` ### Register Tableau Server After activation, you need to register Tableau Server. To do this, create a registration file and then pass it as an option with the `tsm register` command. 1. Generate a template that you can edit by running the following command: `tsm register --template > /path/to/.json` 2. Edit the template file to create your completed registration file. Here is an example of a registration file in the required format: ``` { "first_name" : "Andrew", "last_name" : "Smith", "phone" : "311-555-2368", "email" : "andrew.smith@mycompany.com", "company" : "My Company", "industry" : "Finance", "company_employees" : "500", "department" : "Engineering", "title" : "Senior Manager", "city" : "Kirkland", "state" : "WA", "zip" : "98034", "country" : "United States", "opt_in" : "false", "eula" : "accept" } ``` **Notes:** - The `opt_in` field indicates your preference for receiving marketing communications from Tableau. The default value is `false` for many countries. Country-specific laws can impact the default for this field. For more information, see [Privacy Information](https://www.salesforce.com/ap/company/privacy/) on the Salesforce website. - The `eula` field confirms you accept the End User License Agreement (EULA). The default value is `accept`. You must accept the EULA to use Tableau Server. If you don't accept, you can't run Tableau Server. 3. After saving changes to the file, pass it with the `--file` option to register Tableau Server: `tsm register --file /path/to/.json` For example: `tsm register --file /usr/share/tableau-reg-file.json` If you have a product key for Data Management or Advanced Management, you must activate that key to use the additional functionality. Product keys for these licenses should only be activated after at least one capacity product key has been activated on the server. - For license information on Tableau Data Management, see [License Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_license.htm). - For license information on Tableau Advanced Management, see [About Tableau Advanced Management on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm). ## Next step - [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm) ## Other articles in this section [Skip to main content](#main-content) # Activate Tableau Server Offline When you install Tableau Server, you have to activate at least one product key, but we recommend that you activate all Tableau Server licenses found in the Tableau Customer Portal. Doing this activates the server, and specifies the number of license levels you can assign to users. For offline activations on Tableau Server with ATR, you can use either the Offline Activation ID or Product Key Name listed in the Offline Activation Id field in the Tableau Customer Portal. For information about finding the right key, see the [Find the Correct Key to Activate on Tableau Server](https://help.salesforce.com/s/articleView?id=001464376&type=1) Knowledge Article. There are also times you may need to activate licenses after Tableau Server is installed, for example, if you add capacity to your server, or get a new product key. If you don't have your product key, you can get it from the [Tableau Customer Account Center](http://myaccount.tableau.com/). **Note:** Activating any product key after Tableau Server has already started will require a Tableau Server restart for the changes to take effect. In most cases, you can activate your key directly from Tableau Server, either during installation, or later, using the Tableau Services Manager (TSM) Licenses page, but there are some circumstances that don't allow you to do this. If your computer is not connected to the internet for example, or has a firewall that restricts access outside your intranet. In these cases you need to do an offline activation. Tableau Server in a Container only supports license activation using Server ATR. Offline activation is not supported. ### Offline activation and login-based license management (LBLM) Beginning in Tableau Server version 2023.1.0, offline activation is supported for LBLM when your server is configured to use the Authorization-to-Run (ATR) service. You can only configure Tableau Server to use the ATR service during a new install. Upgrading customers with existing server installations need to install a new instance of Tableau Server version 2023.1.0 or later and restore a backup of their existing installation to that new instance. For information on this process, see [Using a Blue/Green approach for upgrading Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/server-upgrade-blue-green.htm). For more information about ATR service, see [Activate Tableau Server Using the Authorization-To-Run (ATR) Service](https://help.tableau.com/v0.0/server-linux/en-us/atr_service.htm). ### Offline activation and updatable subscription licenses (USL) Offline activation of updatable subscription licenses requires special steps. For details, see [Activating USL in Offline or Disconnected Environments](https://help.tableau.com/v0.0/server-linux/en-us/license_usl.htm#USLActivatingOffline). There are two scenarios in which you may need to do an offline activation: - Offline activation during install—To complete an offline activation when you are installing Tableau Server. - Offline activation of licenses after install—To complete an offline activation after your server is installed and running. ## Offline activation overview Offline activation of Tableau Server depends on your method of activation (with or without the Authorization-to-Run service, ATR). **Note**: When using ATR and activating a USL license for Tableau Server, you can use either the Product **Key Name** or the **Offline Activation ID**. We recommend using the Key Name because you do not need to determine the Offline Activation ID. Offline activation _without_ ATR involves the following steps: 1. Generate an offline activation request file. 2. Copy the offline activation request file to a computer with internet access. 3. Upload the offline activation request file to the [Tableau activation website](https://www.tableau.com/support/activation). 4. Download the resulting offline activation response file from the website. You'll use this file to activate Tableau Server ### Offline activation file name changes Beginning in Tableau Server version 2023.1, the Tableau licensing system supports two underlying licensing technologies. From an administrative perspective, the only configuration difference between the two systems is the file types that are generated and consumed for offline activation. The licensing technology is determined during the initial installation of Tableau Server, and cannot be changed after install. We refer to the legacy (and still supported) version of licensing technology as FlexNet. The latest version of the technology is referred to as ATR. For more information, see [Activate Tableau Server Using the Authorization-To-Run (ATR) Service](https://help.tableau.com/v0.0/server-linux/en-us/atr_service.htm). The following table describes the file naming nomenclature for each technology. The table also includes the generic reference.

Generic file name	Server ATR file names	FlexNet file names
OfflineActivationRequest	OfflineActivationRequestFile_yyyyMMdd.hhmmss.json	TableauOfflineActivationRequest.tlq
OfflineActivationResponse	OfflineActivationLicensingAtrs.zip	activation.tlf

**Note:** Since this documentation supports multiple versions of Tableau Server, we will use the generic file name references (OfflineActivationRequest and OfflineActivationResponse) for the rest of this topic. You can identify the licensing technology your Tableau Server installation uses according to the file type that generated in the steps that follow. If you attempt to activate your product key from the TSM licenses page and see a dialog that says online activation is unavailable, you can activate the key offline. The offline activation process must be completed once for each product key. 1. Click Activate License Offline. ![A dialog box that states online activation is not available and offers troubleshooting methods.](/tableau/next/en-us/server-linux/en-us/Img/server_setup_offline_activate02.png) 2. Create an offline activation request file (OfflineActivationRequest) for the product key. Create an OfflineActivationRequest file you will upload to the Tableau activation website. If your product key is not pre-filled in the form, enter your key and click Create Offline File to generate an OfflineActivationRequest file on the local computer. ![How to create, upload, and submit an offline file.](/tableau/next/en-us/server-linux/en-us/Img/server_setup_offline_activate04.png) Copy the OfflineActivationRequest file to a computer with internet access. You need to upload this file to the Tableau activation website to generate an activation response file. 3. Upload and submit the OfflineActivationRequest file. You will upload and submit the OfflineActivationRequest file to the Tableau activation website. This automatically generates an activation response file (OfflineActivationResponse) that you can download and copy back to the Tableau Server computer. 1. On the computer where you copied the OfflineActivationRequest file, open a browser and go to [http://www.tableau.com/support/activation](http://www.tableau.com/support/activation) to open the Tableau Support Activation page. 2. On the Offline Activation page, click Choose File to select the OfflineActivationRequest file. 3. Click Upload Activation File to submit the file to the Tableau activation website. 4. Click the `here` link to download the OfflineActivationResponse file to your computer. ![Offlice activation success message.](/tableau/next/en-us/server-linux/en-us/Img/server_setup_offline_activate08.png) 5. Copy the OfflineActivationResponse file to the computer where Tableau Server is installed. 4. Upload the OfflineActivationResponse file. On the Tableau Server computer, click Upload Activation File to upload the OfflineActivationResponse file to Tableau Server. When you do this successfully, the Activate Product Key button is enabled. ![A form that guides you to upload an activation file.](/tableau/next/en-us/server-linux/en-us/Img/server_setup_offline_activate09.png) 5. Click Activate Product Key to complete the offline activation. 6. (Skip this step if you are installing Tableau Server for the first time.) Restart Tableau Server for licensing changes to take effect. ### Step 1. Log in to Tableau Services Manager Before you can proceed you must log in to Tableau Services Manager (TSM). To log in to TSM, run the following command: `[tsm login](https://help.tableau.com/v0.0/server-linux/en-us/cli_login.htm) -u ` #### What if I can't log in? The account that you use to configure the rest of the installation must be a member of the `tsmadmin` group that was created during initialization. To view the user accounts in the `tsmadmin` group, run the following command: `grep tsmadmin /etc/group` If the user account is not in the group, run the following command to add the user to the `tsmadmin` group: `sudo usermod -G tsmadmin -a ` After you have added the user to the `tsmadmin` group, run the `tsm login` command. ### Step 2. Generate an offline activation request file 1. On the initial node, open a terminal session. 2. Type this command to get your offline activation file: `tsm licenses get-offline-activation-file -k -o ` You can get your product key from the [Tableau Customer Portal](http://customer.tableau.com). The target directory must already exist. To identify which key to use for offline activations, see the [Find the Correct Key to Activate on Tableau Server](https://help.salesforce.com/s/articleView?id=001464376&type=1) Knowledge Article. **Note**: When using ATR and activating a USL license for Tableau Server, you can use either the Product **Key Name** or the **Offline Activation ID**. We recommend using the Key Name because you do not need to determine the Offline Activation ID. 3. Copy the offline activation file (OfflineActivationRequest) from the target directory to a computer that has internet access. ### Step 3. Upload the offline activation request to the Tableau activation website 1. On the computer that has internet access, go to the Tableau [Product Activations](http://www.tableau.com/support/drivers/activation) page. 2. Complete the instructions to upload your OfflineActivationRequest file. This creates an activation response file (OfflineActivationResponse). 3. Download the OfflineActivationResponse file from the Tableau activation website. ### Step 4. Initialize or activate your license 1. Copy the OfflineActivationResponse file to a location accessible from the Tableau Server computer. 2. Run the following command: tsm licenses activate -f **Note:** When using ATR to activate Tableau Server, `` should point to the packaged OfflineActivationResponse `.zip` file. Do not unzip the OfflineActivationResponse file prior to running this command. 3. (Skip this step if you are installing Tableau Server for the first time.) Restart Tableau Server for licensing changes to take effect: tsm restart 4. (Optional) To verify that all licenses are activated, you can run this command: tsm licenses list If you have completed the steps above, you should see a success message: Activation successful. Tableau Server is activated. If you need additional assistance, contact [Tableau Technical Support](http://www.tableau.com/support/request). [Skip to main content](#main-content) # Activate Tableau Server Using the Authorization-To-Run (ATR) Service You can use the Server authorization-to-run (ATR) service to activate Tableau Server deployed in on-premises, cloud, container, or virtual environments without running out of license activations. The ATR service achieves this by providing short-term leases of configurable duration (ATR duration) which ties the license to the device until product key expiration date is met. ATR handles activation capacity tracking so if there is an underlying hardware change, maximum activation errors don't occur. This option is recommended for all Tableau Server installations. If you are activating Tableau Server online (this is the default), Tableau Server connects to various internet locations for licensing purposes. For more information, see [Communicating with the Internet](https://help.tableau.com/v0.0/server-linux/en-us/plan_network.htm). If you are activating Tableau Server offline, you can still use ATR service to activate, however there are slight differences in how ATR duration works with offline activations. For more information, see [ATR Duration for Offline Activations](#ATR2). We recommend using the Server authorization-to-run (ATR) service to simplify server licensing. If you chose not to use Server ATR, you will use the legacy licensing technology which does not provide the dynamic management capabilities of Server ATR. Your choice of activation type will be permanent for this installation of Tableau Server. To change this later, you must backup, remove, and then reinstall Tableau Server. ## How Tableau Server ATR works When ATR service is enabled, Tableau Server periodically contacts a Tableau-hosted authorization-to-run (ATR) service to verify that Tableau is authorized to run, based on its license and the length of the authorization window (ATR duration or lease). As long as this communication is successful, Tableau runs without any impact to the user. When Tableau Server is activated offline and ATR is enabled, Tableau Server can not periodically contact the ATR service to verify Tableau is authorized to run. Instead, Tableau Server internally tracks the ATR Duration from when the product key was first activated offline. ### ATR Duration By default, an instance of Tableau Server is given a 5 day ATR lease (duration) to successfully contact the ATR service for verification. This means that after the initial authorization, Tableau Server could be used for 5 days without network connection before the activation expired. The authorization checks between Tableau Server and ATR service are attempted regularly, and each time a check is successful, the ATR duration is reset to its full length. The authorization check frequency varies, and is dependent on the ATR duration:

ATR duration	Authorization check frequency
< 4 hours	every 15 minutes
< 24 hours	every 1 hour
< 7 days	every 12 hours
> 7 days	every 24 hours

For example: If the ATR duration is 48 hours, Tableau Server will contact the ATR service every 12 hours to complete an authorization check and the ATR duration is reset to 48 hours after each successful authorization check. The ATR duration will then begin to count down to 0 until the next authorization check. If the Tableau Server machine is shut down or there is no internet access, Tableau Server can no longer contact ATR service. If this happens, the ATR duration will not be reset to 48 hours and will continue to count down to 0. If Tableau Server is not started or cannot communicate with the ATR service before the ATR duration reaches 0, the license will expire and you must activate the license again. **Note:** You should keep your Tableau Server running as much as possible. If Tableau Server cannot successfully complete an authorization check within the ATR duration period, ATR service will reclaim the license lease and then you'll need to reactivate your license. To view the ATR duration, see [tsm licenses atr-configuration get](https://help.tableau.com/v0.0/server-linux/en-us/cli_licenses_tsm.htm#TSMAtr-configuration-get). ## Set or change the Server ATR duration When using Server authorization-to-run (ATR) to activate Tableau Server, you can change the ATR duration and use a setting different than the default of 432000 seconds (5 days). If you're creating a test server or virtual machine (VM) that will have a short lifespan, you might want to shorten the ATR duration. Similarly, if you have a server that you plan to keep for a long time, you might want to lengthen the ATR duration. If you start up new VMs frequently, reducing the ATR duration can allow older VMs to release their capacity, allowing it to be used by new VMs. On the other hand, if you increase the ATR duration, renewal cycles will be longer but capacity is not released as often. To change the ATR duration, you use the `tsm licenses atr-configuration set –duration ` command. For more information, see [tsm licenses atr-configuration set](https://help.tableau.com/v0.0/server-linux/en-us/cli_licenses_tsm.htm#TSMAtr-configuration-set).

ATR duration in seconds	Minimum	Maximum	Default
Tableau Server (container)	3600 (1 hour)	2593000 (30 days)	14400 (4 hours)
Tableau Server (non-container)	3600 (1 hour)	7776000 (90 days)	432000 (5 days)

##### Tableau Server on Linux To set ATR duration and manually start the Activation Service, run the following commands: 1. On the initial node, open a terminal session, and then use the following commands: 1. `tsm licenses atr-configuration set -–duration ` 2. `tsm pending-changes apply` 3. `sudo su -l tableau` 4. `systemctl --user stop activationservice_0` 5. `systemctl --user start activationservice_0` 2. Verify that the Activation Service is running by using the `tsm status -v` command. Tableau Server Activation Service should be listed as "is running". If the Activation Service is not started, then run: `systemctl --user restart activationservice_0` ##### Tableau Server in a Container To set ATR duration and manually start the Activation Service, run the following commands: 1. On the initial node, open a terminal session, and then use the following commands: 1. `tsm licenses atr-configuration set -–duration ` 2. `tsm pending-changes apply` 3. `sudo su -l tableau` 4. `supervisorctl -c /var/opt/tableau/tableau_server/supervisord/supervisord.conf stop activationservice_0` 5. `supervisorctl -c /var/opt/tableau/tableau_server/supervisord/supervisord.conf start activationservice_0` 2. Verify that the Activation Service is running by using the `tsm status -v` command. Tableau Server Activation Service should be listed as "is running". If the Activation Service is not started, then run: `supervisorctl restart activationservice_0` **Note:** For Tableau Server running in a container, the TTL Start and TTL End values reflect the current lease being used by Tableau Server. Container leases that are shorter than a day are refreshed hourly, but longer leases can take up to 24 hours to renew. ## ATR Duration for Offline Activations When Tableau Server is activated offline, the ATR duration is set to either one year from the day the product key was activated offline, or to the renewal date of the product key, whichever comes first. Once the ATR duration reaches the set date, the product key will become deactivated. Since Tableau can not communicate with the ATR service in offline environments, there are no authorization checks. If you use the `tsm licenses atr-configuration get` command to view the ATR duration for offline activations, the result will be `0`, which is expected. To view ATR duration for offline activations, use the `ATRDiag -product "Tableau Server"` command instead. For more information, see [ATRDiag.exe Command Line Reference](https://help.tableau.com/v0.0/server-linux/en-us/atrdiag.htm). In the resulting output, the `TTL End` date is the date the ATR duration ends. ### Updating ATR duration in offline environments Because authorization checks are not possible in an offline environment, the ATR duration is set to a fixed value as described above. To avoid unplanned Server downtime, be aware of the ATR duration in your installation, and plan to update the ATR duration before it expires. How you do this depends on if you have a USL key or a non-USL key: - **USL keys:** If you have a USL key, follow the instructions here: [USL offline license entitlement updates](https://help.tableau.com/v0.0/server-linux/en-us/license_usl.htm#USL). - **Non-USL keys:** If you have a non-USL key, offline activation with ATR is not supported. Manual steps must be taken. For more information, [see Tableau Server 2023.1+: Offline License Deactivation with ATR Not Available](https://help.salesforce.com/s/articleView?id=001534333&type=1) knowledge article. ## Move a Server ATR product key to another Tableau Server If you want to stop using your product key on an existing Tableau Server and use it on a new installation of Tableau Server, you can move your Server ATR product key. You might want to move product keys when: - Switching between development or pre-production environments. - Moving Tableau Server to upgraded hardware. - Moving Tableau Server to cloud infrastructure. - Using an ephemeral Tableau Server, such as a virtual machine (VM) or container. ## Deactivate a product key for reuse on another Tableau Server ### Deactivate a product key in version 2021.4 and later You can remove product key(s) that were activated using Server ATR when you want to reclaim license capacity from one Tableau Server installation and use it on another. For more information about reclaiming a product key, see [Deactivate Product Key](https://help.tableau.com/v0.0/server-linux/en-us/license_deactivate.htm). ### Deactivate a product key in version 2021.3 and earlier When ATR service is used to activate a Tableau Server license you cannot manually deactivate the license. You can have one production and two non-production installations per license. If you have unused activations on a license, you can activate the same license on another Tableau Server. If you're out of activations, you can still activate the license after the ATR lease expires by taking the following steps: 1. Disable the existing Tableau Server from refreshing its leased activation. You can do this using any of the following methods: - Shut down your existing Tableau Server. - Uninstall the existing Tableau Server. - Disconnect the existing Tableau Server from the Internet by unplugging the ethernet cable or disconnecting wifi. 2. After the ATR lease expires, you can reuse the license on another Tableau Server. 3. On the new computer, install Tableau Server. When prompted, activate Tableau Server using the same license. [Skip to main content](#main-content) # Activity Log If you have Tableau Server with Advanced Management, Activity Log files are automatically recorded for detailed analysis and auditing. Use these logs to: - **View and analyze event data:** Access detailed event data for Tableau Server, capturing compliance information and tracking activities across your sites. All events include a timestamp and the ID of the actor, and if relevant, the ID of the affected content. - **Audit permissions changes:** Track and audit permissions changes, such as adding or removing users from a group, moving content between projects, and explicitly changing content permissions. This is essential for implementing robust controls for compliance purposes. - **Supplement Admin Views:** Enhance the information provided by Admin Views to track site activity and usage metrics. You can integrate Activity Log data with monitoring tools, such as Splunk or Amazon EventBridge to query log fields and answer questions like the last 10 actions taken by a user, who last performed an event on content, and what the last action on content was. ## Accessing Activity Log events Activity Log events are stored in the `vizportal` and `vizqlserver` folders on the local hard drive. By default, the folders are located at `/var/opt/tableau/tableau_server/data/tabsvc/logs/`. Within each directory, you'll find files named `-cepp-canonical-events_*.log` that record events and operations for your deployment. For a full list of Activity Log events, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/server-linux/en-us/activity_log_schema.htm). ## Other articles in this section [Skip to main content](#main-content) # Activity Log Site Event Type Reference This topic describes the Activity Log site event types and attributes. ## Event type details The following content describes site event types and attributes in Activity Log. Use the alphabetically sorted list of event types on the right, or **ctrl/cmd-f** to go directly to keywords you have in mind. **Note:** Timestamps for events are recorded in ISO 8601 UTC. ## Common attributes The table contains common attributes for all Activity Log site events. For event-specific attributes, review the individual event tables in this topic.

Attribute Name	Type	Description
actorUserId	integer	ID of the user who performed the action that initiated the event
actorUserLuid	string	LUID of the user who performed the action that initiated the event
eventOutcome	string	Represents the final outcome of the operation. Possible values are: success: The attempted operation completed successfully. unauthorized: The initiating user wasn't authorized to perform the operation. client_error: The operation failed due to a cause attributable to the client/caller. For example, invalid API request parameters, client connection timeout, or throttling. internal_error: The operation failed due to an unexpected internal error.
eventOutcomeReason	string	Provides additional details about the event outcome
eventProcessedTime	string	Timestamp of when the event was available in Activity Log. This attribute applies to events written after the Hyperforce migration in March 2026. To see the timestamp for when the event occurred, use the `eventTime` attribute.
eventTime	string	Timestamp when the event occurred
initiatingUserId	integer	ID of the initiating user. This value is usually the same as `actorUserId` and differs only for delegated authentication, such as trusted tickets or impersonation. During impersonation, it's the ID of the administrative user who initiated the session. When the session has no initiating user, or no session exists, `initiatingUserId` uses the value of `actorUserId`.
initiatingUserLuid	string	LUID of the initiating user. For impersonation, it's the LUID of the administrative user who initiated impersonation. For standard login, the value is the same as `actorUserLuid`.
licensingRoleName	string	Name of the user's licensing role when the event occurred
serviceName	string	Name of service that initiated the event, such as vizportal, vizqlserver, or sitesaml.
siteLuid	string	LUID of the Tableau site where the event occurred
siteRoleId	integer	The user's site role ID. The value 0 = SiteAdministratorExplorer, 1 = SupportUser, 2 = ExplorerCanPublish, 3 = Explorer, 7 = Guest, 8 = Unlicensed, 9 = Viewer, 10 = Creator, and 11 = SiteAdministratorCreator.
systemAdminLevel	integer	Indicates if the user is a system administrator. The value 10 = System Admin and 0 = Not a system admin.

## add\_delete\_user\_to\_group The `add_delete_user_to_group` event is logged when a user is added or removed from a group.

Attribute Name	Type	Description
groupId	integer	The ID of the group
groupLuid	string	The LUID of the group
groupOperation	string	Group operation, either add or delete user to a group
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
userId	integer	The ID of the user
userLuid	string	The LUID of the user

## content\_owner\_change The `content_owner_change` event is logged when the content owner changes.

Attribute Name	Type	Description
contentId	integer	The ID of the content that had the owner changed
contentLuid	string	LUID of the content that had the owner changed
contentName	string	Name of the content that had the owner changed
contentType	string	The type of content, such as data source, workbook, or view
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
newOwnerId	integer	The ID of the new content owner
newOwnerLuid	string	The LUID of the new content owner
oldOwnerId	integer	The ID of the old content owner
oldOwnerLuid	string	The LUID of the old content owner

## create\_delete\_group The `create_delete_group` event is logged when a group is created or deleted.

Attribute Name	Type	Description
groupDomain	string	The domain of the group, such as local
groupId	integer	The ID of the group
groupLuid	string	The The LUID of the group
groupName	string	The name of the group that had its permissions changed
groupOperation	string	Group operation, either create or delete
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## create\_permissions The `create_permissions` event is logged when a new explicit permission rule is created. **Note:** Deprecated in October 2024. Use the [set\_permissions](#set-permissions) event instead.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content item
contentName	string	The name of the content that had the permissions updated
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee
granteeType	string	The type of grantee, either user or group
granteeValue	string	The updated permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## delete\_all\_permissions The `delete_all_permissions` event is logged when all explicit permission rules for content are deleted, typically when content is deleted.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content
contentName	string	The name of the content that had the permissions updated
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## delete\_permissions The `delete_permissions` event is logged when an explicit permission rule is removed from a content item through the REST API. For more information, see [Permissions Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_permissions.htm) in Tableau REST API Help. Other ways of removing permissions are logged as different events: - Removing a capability in the Permissions dialog is logged as a `set_permissions` event with a `permissionType` of `unspecified`, because the grantee's entire permission set is replaced. - Deleting content is logged as `delete_all_permissions`. - Deleting a user or group is logged as `delete_permissions_grantee`. To capture all permission removals, monitor `set_permissions`, `delete_all_permissions`, and `delete_permissions_grantee`.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content
contentName	string	The name of the content that had the permissions updated
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The `granteeId` attribute is always present.
granteeType	string	The type of grantee, either user or group
granteeValue	string	The updated permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## delete\_permissions\_grantee The `delete_permissions_grantee` event is logged when all explicit permission rules for a user or group are deleted, typically when the user or group is deleted.

Attribute Name	Type	Description
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The `granteeId` attribute is always present.
granteeType	string	The type of grantee, either user or group
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## display\_sheet\_tabs The `display_sheet_tabs` event is logged when the "Tabbed Views" value is updated on a workbook.

Attribute Name	Type	Description
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
workbookId	integer	The ID of the workbook

## move\_content The `move_content` event is logged when content is moved, for example, moving a workbook between projects.

Attribute Name	Type	Description
contentId	integer	The ID of the content that had the owner changed
contentLuid	string	LUID of the content that had the owner changed
contentName	string	Name of the content that had the owner changed
contentType	string	The type of content, such as data source, workbook, or view
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
newContainerLuid	string	LUID of the new container
newContainerType	string	The new container type, such as a project
oldContainerLuid	string	LUID of the previous container
oldContainerType	string	The previous container type, such as a project

## project\_lock\_unlock The `project_lock_unlock` event is logged when project permissions are locked or unlocked.

Attribute Name	Type	Description
controllingProjectLuid	string	LUID of the project that controls permissions for the nested project
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
projectLuid	string	LUID of the project
projectOperation	string	Project operation, either lock or unlock

## set\_permissions The `set_permissions` event is logged when a permission rule is created or updated for a content item, typically when you save changes in the Permissions dialog. Removing a permission rule is also logged as this event, with a `permissionType` of `unspecified`.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform a certain action on a particular piece of content, such as view, filter, download or delete.
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions set
contentLuid	string	The LUID of the content item
contentName	string	The name of the content that had the permissions set
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The `granteeId` attribute is always present.
granteeType	string	The type of grantee, either user or group
granteeValue	string	The set permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
permissionType	string	The permission type. A value of `explicit` means an Allow or Deny rule was set. A value of `unspecified` means a rule was removed or set to inherited.

## update\_permissions The `update_permissions` event is logged when an explicit permission rule is updated for a content item. **Note:** Deprecated in October 2024. Use the [set\_permissions](#set-permissions) event instead.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content
contentName	string	The name of the content that had the permissions updated
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee
granteeType	string	The type of grantee, either user or group
granteeValue	string	The updated permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
permissionType	string	The permission type, either explicit or unspecified

## update\_permissions\_template The `update_permissions_template` event is logged when a permission template for a project is updated.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content
contentName	string	The name of the content that had the permissions updated
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The `granteeId` attribute is always present.
granteeType	string	The type of grantee, either user or group
granteeValue	string	The updated permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
permissionType	string	The permission type. A value of `explicit` means an Allow or Deny rule was set. A value of `unspecified` means a rule was removed or set to inherited.
templateType	string	The type of permission template used to change permissions, such as workbook or data source

## user\_create\_delete The `user_create_delete` event is logged when a user is created or deleted.

Attribute Name	Type	Description
forUserName	string	The name of the user whose account was either created, updated or deleted
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
siteRole	string	Site role of the user. Determines the maximum level of access a user can have on the site
targetUserId	integer	The ID of the user whose account was either created, updated, or deleted
targetUserLuid	string	The LUID of the user whose account was either created, updated, or deleted
userOperation	string	The action performed on a user, either create, delete, or site role change

[Skip to main content](#main-content) # Add a Load Balancer You can enhance the reliability of Tableau Server by running gateways on multiple nodes, and configuring a load balancer to distribute requests across the gateways. Unlike the repository process, which can be active or passive, all gateway processes are active. If one gateway in a cluster becomes unavailable, the load balancer stops sending requests to it. The load balancer algorithm you choose determines how the gateways will route client requests. - **Kerberos**: If you will be using Kerberos authentication, you need to configure Tableau Server for your load balancer before you configure Tableau Server for Kerberos. For more information, see [Configure Kerberos](https://help.tableau.com/v0.0/server-linux/en-us/config_kerberos.htm). - **Tested load balancers**: Tableau Server clusters with multiple gateways have been tested with Apache and F5 load balancers. If you are using an Apache load balancer and creating custom administrative views, you need to connect directly to the Tableau Server repository. You cannot connect through the load balancer. - **Tableau Server URL**: When a load balancer is in front of a Tableau Server cluster, the URL that's accessed by Tableau Server users belongs to the load balancer, not the initial Tableau Server node. - **Single load balancer endpoint**: You must configure your load balancers for a single URL endpoint. You cannot configure different endpoint hosts to redirect to the same Tableau Server deployment. The single external URL is defined in `gateway.public.host` when you configure Tableau Server, as described in [Configuring Proxies and Load Balancers for Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/proxy.htm). - **Trusted host settings**: The computer running the load balancer must be identified to Tableau Server as a trusted host, as described in [Configuring Proxies and Load Balancers for Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/proxy.htm). ## Configure Tableau Server to work with a load balancer The settings used to identify a load balancer to Tableau Server are the same ones that are used to identify a reverse proxy server. If your Tableau Server cluster requires both a proxy server and a load balancer, both must use a single external URL defined in `gateway.public.host` and all proxy servers and load balancers must be specified in `gateway.trusted` and `gateway.trusted_hosts`. See [Configuring Proxies and Load Balancers for Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/proxy.htm). [Skip to main content](#main-content) # Add a Pop-Up Tableau Data Story to Your Dashboard **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). You can place a Tableau Data Story in a pop-up window that allows your users to open a story, read it, and then close it when they're done. This is a great way to save space being used by already-established dashboards or to reduce the amount of clutter and information on a dashboard. 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/server-linux/en-us/data_stories_create.htm). 2. Set the container to Floating by clicking the menu and selecting Floating. > [!TIP] > > Another way to set the container to Floating is by holding the shift key while dragging the container onto your dashboard. 1. Navigate to the Layout tab in the left-hand column and set the background color to white. ![The Layout pane with the background set to 100% and white.](/tableau/next/en-us/server-linux/en-us/Img/data_stories_white_background.png) 1. Click the menu that is associated with your floating container to show its settings, and select Add Show/Hide Button. This creates an "X" icon that allows you to show or hide your story. ![A Data Story with a large X icon that allows users to hide the story.](/tableau/next/en-us/server-linux/en-us/Img/data_stories_x.png) **Note:** If your story is selected, then your button is partially obscured by the sidebar options that are part of the Data Story object. Click anywhere outside of the story to reveal the button. 1. Hover over the "X" icon to show instructions for opening or closing the story. In this example, you're being prompted to press the Alt key at the same time you click the "X" icon. ![A Data Story object with a large X icon that allows users to hide the story and a tooltip that reads “Hide ‘Data Story’ (Alt+click to hide)](/tableau/next/en-us/server-linux/en-us/Img/data_stories_hide_story.png) 1. Collapse the story by clicking the "X" icon at the same time as pressing the key indicated in your prompt. The story collapses, but the menu remains on the dashboard so that the user can expand the story when needed. You can move your collapsible, floating story around your dashboard as desired. [Skip to main content](#main-content) # Add a Project Image To help distinguish projects you manage on Tableau Server (and help your users find them), you can add an image that appears in the thumbnail. Your image must meet the following requirements: - The image must be accessible using HTTPS protocol. Shared network directory and related protocols (UNC, SMB, AFP, NFS, etc) are not supported. HTTP protocol for project images is not supported by Google Chrome. - All users who access the project must have, at a minimum, "read-only" permission on the target image. - The image must be common internet format: .jpg, png, or gif. ![Custom Explore page with projects sorted into IT, Development, Customer Solutions, and Statistics.](/tableau/next/en-us/server-linux/en-us/Img/custom_projectimage.png) ## Set a project image 1. Sign in to a site on Tableau Server. In the list of Top-level Projects you have access to, select or navigate to the project you want to update. In this example, we'll add an image to the Statistics project folder. If you're not sure where to find a child project, use the Explore drop-down list and select All Projects. 2. Click the Details icon (i), to open the Project details dialog box, and then click Edit. ![Project detail page showing owner, created date, and options to edit, change owner, and delete project.](/tableau/next/en-us/server-linux/en-us/Img/custom_projectimage_2.png) 3. In the About field, you can enter a description for your project (optional), for example "Global and US statistics." At the end of the project description, add the URL for your image using the following syntax: `!http://www.example.com/image.png!` ![Project detail page showing global and US statistics with options for project details and editing.](/tableau/next/en-us/server-linux/en-us/Img/custom_projectimage_3.png) Select Show formatting hints to see how you can format description text. **Note:** Images embedded in project descriptions cannot be resized or positioned. Recommended size is (300 x 184 pixels). Images that are not 300 x 184 pixels may be stretched, shrunk, or cropped to fit the width of the thumbnail. In addition, they must be added at the end of the project description and be enclosed in **!** (exclamation marks), otherwise they will not be displayed as the thumbnail. 4. Click Save. ![Custom Explore page with projects sorted into IT, Development, Customer Solutions, and Statistics.](/tableau/next/en-us/server-linux/en-us/Img/custom_projectimage_4.png) [Skip to main content](#main-content) # Add a Tableau Data Story to a Dashboard **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). After you [Create a Dashboard](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm), you can add the Data Story object to your dashboard to display insights about your viz that are written in natural language. Today, Tableau Data Stories are written in English only and are available in Tableau Cloud, Tableau Server (version 2023.1 and later), and Tableau Desktop. There is no data size limit when creating Data Stories. However, story generation times out after 45 seconds if it's trying to analyze a lot of data. We recommend using Data Stories with visualizations that have 1,000 or fewer data points. **Note:** Tableau Data Stories opens in a pop-up window, so be sure to allow pop-ups. If you're using full screen mode, then Data Stories can open in a new tab. 1. Drag the Data Story object into your Tableau dashboard. If you haven't already, add a sheet to your dashboard to use Tableau Data Stories. ![Data Story object with open book icon found in the dashboard editing pane](/tableau/next/en-us/server-linux/en-us/Img/data_story_object.png) 2. In the Data Story dialog box, configure your story by first choosing the worksheet to write about. When you click **Next**, Tableau sends all associated workbook data to the Tableau Cloud or Tableau Server instance that you are logged in to. ![Configure pane with options to choose which sheet you want to write about](/tableau/next/en-us/server-linux/en-us/Img/data_story_configure_view.png) 3. Choose the dimensions and measures to include in your story. ![Configure pane with the option to drag and drop dimensions and measures that you want included in your story](/tableau/next/en-us/server-linux/en-us/Img/data_story_configure_field.png) 4. Choose the type of story that best describes your data: ![Configure pane with options to choose the type of story that best fits your data: Discrete, Continuous, Percent of Whole, or Scatter Plot](/tableau/next/en-us/server-linux/en-us/Img/data_story_configure_story.png) Discrete is best for qualitative values such as names or dates, such as in bar or column charts. Continuous is best for quantitative values over time, such as a plotted in a line chart. Percent of Whole is best for proportions of a whole, such as a pie chart. Scatter Plot is best for relationships between numerical values, such as a scatter plot chart. 5. Click Done. To filter your Data Story by clicking different sections on your visualization, open the menu on your visualization and click Use as filter. After your story is generated, click Settings at the top of your Data Story object for a guided experience that helps you personalize and contextualize your story. For more information, see [Configure Settings for a Tableau Data Story](https://help.tableau.com/v0.0/server-linux/en-us/data_stories_configure_edit.htm). **Note:** If you experience a discrepancy in your Tableau Data Story (for example, if the numbers in your story are different than in your visualization), it may be caused by way your visualization is set up. Try creating a new visualization on a different sheet, and then add a new Data Story with the [Use a hidden sheet](https://help.tableau.com/v0.0/server-linux/en-us/data_stories_more_data.htm#Use) technique to uncover the underlying issue. [Skip to main content](#main-content) # Add an Administrator Account The final step in activating Tableau Server is to add the initial administrator account. The administrator will have all access to the server including the ability to manage users, groups, and projects. The server must be running when you create the initial admin user. If you have configured the Tableau Server identity store to use LDAP or Active Directory, then the initial administrative user that you specify must be an account in the directory. The initial administrative user is generally distinct from the user account on the Tableau Server computer that you use to run `tsm`. However, these accounts can be the same if you have configured the Tableau Server identity store to use LDAP or Active Directory and the initial admin user is a member of the `tsmadmin` group on the Tableau Server computer. ## Prerequisites Before proceeding with the procedures in this topic, complete the following prerequisites as outlined in [Install and Configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm): - [Install and Initialize TSM](https://help.tableau.com/v0.0/server-linux/en-us/setup.htm) - [Activate and Register Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/activate.htm) - [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm) After Tableau Server is finished initializing, the installation program will display a page to create the Tableau Server administrator. - If you configured a local identity store during setup, then specify a name and password that you want to use. - If you configured a LDAP or Active Directory identity store during setup, then you must specify a user account that is a member of the directory. - The `username` value cannot include an at sign (@) unless the user name suffix matches Tableau Server's primary domain. For example, if Tableau Server connects to domain "myco.com", a user name of "user@example.com@myco.com" cannot be used. If you are installing remotely, then you must sign in to TSM on the physical computer where Tableau Server is installing, or you can access the computer remotely and run the tabcmd [initialuser](https://help.tableau.com/v0.0/server-linux/en-us/tabcmd_cmd.htm#initialu) command from a shell. You must create the initial administrative account for Tableau Server. - If you configured a local identity store during setup, then specify a name and password that you want to use. - If you configured a LDAP or Active Directory identity store during setup, then you must specify a user account that is a member of the directory. - The `username` value cannot include an at sign (@) unless the user name suffix matches Tableau Server's primary domain. For example, if Tableau Server connects to domain "myco.com", a user name of "user@example.com@myco.com" cannot be used. To create the initial user, run the following `tabcmd` command: `tabcmd initialuser --server http://localhost --username ''` For example: `tabcmd initialuser --server http://localhost --username 'tableau-admin'` If you are running the HTTP protocol on a port other than 80, specify the port after the host name, for example: `--server http://localhost:8080`. After you run the command, the shell will prompt for an administrative password. ## Next steps After you have created the Tableau Server administrator account, continue your deployment by working through the configuration topics at [Post Installation Tasks](https://help.tableau.com/v0.0/server-linux/en-us/config_post_install.htm). **Important:** You must install the PostgreSQL driver if you want to use the built-in administrative views. You can find driver links and installation instructions for all the supported connectors on the [Driver Download page](https://www.tableau.com/support/drivers). [Skip to main content](#main-content) # Add Capacity to Tableau Server You may need to add capacity to your Tableau Server installation to allow you to increase the number of users (if you have a user-based license) or the number of cores (if you have a core-based license). Tableau will provide you with a new product key that adds capacity to your existing Tableau Server installation. You need to activate this key and use it together with your existing product key(s) to get the combined capacity you are licensed for. Each feature (e.g., "Data Management") and license type (e.g., "Explorer") requires a key. For more information about the relationship between keys and licenses, see [tsm licenses list](https://help.tableau.com/v0.0/server-linux/en-us/cli_licenses_tsm.htm#TSMLicenseList). Follow the steps below to add a product key to Tableau Server. If your Tableau Server is not connected to the internet, then you must perform an offline activation. See [Activate Tableau Server Offline](https://help.tableau.com/v0.0/server-linux/en-us/activate_off.htm). **Note:** If you have upgraded to Tableau Server version 2021.1 or later, you no longer need to restart Tableau Server when you add capacity. For more information, see [Zero Downtime Licensing](https://help.tableau.com/v0.0/server-linux/en-us/license_zero_downtime.htm). 1. Open TSM in a browser: `https://:8850` 2. Click Licensing on the Configuration tab and click Activate License: ![Licensing configuration page that displays a list of Tableau Server licenses and their expiration dates.](/tableau/next/en-us/server-linux/en-us/Img/licensing.png) 3. Enter or paste your new product key and click **Activate**: ![License activation popup with a field for entering a 20-digit Tableau Server product key.](/tableau/next/en-us/server-linux/en-us/Img/license-activate02_tsm.png) 4. After activating the license, you may be prompted to register with Tableau. On the Register page, enter your information into the fields and click Register. ![Registration step of Tableau Server activation wizard, with required fields for populating contact information, company information, and regional details.](/tableau/next/en-us/server-linux/en-us/Img/install_02_register.png) 1. Copy the product key to your computer. 2. Run the following command: `tsm licenses activate --license-key ` 3. After activating the license, you may need to register Tableau Server. To do this, create a registration file and then pass it as an option with the `tsm register` command. 1. Generate a template that you can edit by running the following command: `tsm register --template > /path/to/.json` 2. Edit the template file to create your completed registration file. Here is an example of a registration file in the required format: { "zip" : "97403", "country" : "USA", "city" : "Springfield", "last\_name" : "Simpson", "industry" : "Energy", "eula" : "yes", "title" : "Safety Inspection Engineer", "phone" : "5558675309", "company" : "Example", "state" : "OR", "department" : "Engineering", "first\_name" : "Homer", "email" : "homer@example.com" } 3. After saving changes to the file, pass it with the `--file` option to register Tableau Server: `tsm register --file /path/to/.json` For example: `tsm register --file /usr/share/tableau-reg-file.json` [Skip to main content](#main-content) # Add More Data to Your Tableau Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). Data Stories currently supports stories with two dimensions and one measure, or one dimension and up to 10 measures. If you'd like to write about data that you don't need to show on your dashboard, then use a hidden sheet to simplify your dashboard. If you'd like to add more than two dimensions to your story, then concatenate dimensions or create multiple data stories and stack them. ## Use a hidden sheet If you have data that you want to include in a Tableau Data Story and don't need to show all the data that drove the insight, you can use a hidden sheet to bring additional measures and dimensions into your story without cluttering the dashboard. 1. Drag the Data Story object to your dashboard to see which worksheets you can write about in the Data Story dialog box. In this example, there are two worksheets available to write about. ![Data Story dialog box showing two available sheets: Tourism by Country/Region and Tourism Over Time.](/tableau/next/en-us/server-linux/en-us/Img/data_story_configure_view.png) 1. Bring in another data source, such as "Population," by navigating to the left-hand menu, selecting Floating, and dragging that sheet onto your dashboard. ![Data Story dialog box showing three available sheets: Population, Tourism by Country/Region, and Tourism Over Time.](/tableau/next/en-us/server-linux/en-us/Img/data_stories_hidden_3.png) The Data Story dialog box updates with the new available data source. 1. Click into Layout and adjust the size to 1 x 1 to hide the sheet but keep the underlying data in your story. ![The Dashboard pane with Floating selected.](/tableau/next/en-us/server-linux/en-us/Img/data_stories_hidden_1.1.png) You can now configure your stories using this hidden sheet. **Note:** You may need to deselect additional legend elements to keep the sheet hidden. ## Concatenate dimensions If your data contains three dimensions and one measure and is a Discrete Story, you can concatenate (link together) two of those dimensions by creating a calculated field. 1. From the worksheet you want to use in your story, click Analysis and select Create Calculated Field. 2. Name the calculated field and use the following formula to create your calculation, using the + sign to join the dimensions. \[Dimension 1\] + \[Dimension 2\] ![A calculation box that says "\[Population 0-14\]+\[Population 15-64\]"](Img/data_stories_concatenate.png) > [!TIP] > > Drag your dimensions into the Calculated Field box and place them in the formula. 1. Click OK. 2. Drag your new calculated field into the Detail pane to make it accessible in your data story. ## Stack multiple data stories Write about more measures and dimensions by creating multiple Data Stories and stacking them vertically or horizontally on your dashboard. For example, if you wanted to create a story about actual revenue vs benchmark revenue, you could create two different stories—one with the actual revenue and the first benchmark, and another with the actual revenue and the second benchmark—and compare them. [Skip to main content](#main-content) # Add or Delete Sites Tableau Server comes with one site named Default. Server administrators can add or delete sites as the needs of an organization change. ## Add a site 1. Do one of the following: - If you’re adding a site to the server for the first time, select **Settings** > **Add a Site**, and then click **Add a Site**. ![Add a Site option with instructions to host multiple sites on Tableau Server.](/tableau/next/en-us/server-linux/en-us/Img/sites_add_ss.png) - If you’ve added sites before, in the site menu, click **Manage All Sites**, and then click **New Site**. ![Tableau Cloud option to add a New Site.](/tableau/next/en-us/server-linux/en-us/Img/sites_add_multi.png) 2. [Edit the site's settings](https://help.tableau.com/v0.0/server-linux/en-us/sites_add.htm) to customize it for your organization. ## Delete sites Server administrators can delete sites that have been added to Tableau Server. Deleting a site also removes workbooks and data sources that were published to the site, as well as users. If a user belongs to additional sites, they will not be removed. To permanently delete a user, go to the Server Users page. **Note:** The Default site cannot be deleted. 1. On the site menu, click **Manage all sites**, and then click **Sites**. 2. Select the site you want to remove, and then on the Actions menu, click Delete. 3. Click **Delete** in the confirmation dialog box that appears. [Skip to main content](#main-content) # Add Projects and Move Content Into Them Tableau content (such as workbooks or data sources) must be in a project. Starting in Tableau Server 2022.3 and Tableau Cloud October 2022, if Data Management is licensed and Catalog is enabled, external assets (such as databases and tables) can also be in projects. Server and site administrators can add or remove top-level projects on a site, and move published content from one project to another. Project leaders with appropriate site roles can add or remove child projects and move content between projects on which they have Project Leader access. This article contains the steps for creating and moving projects. We recommend becoming familiar with the following related content as well: - To learn about projects and when or why to use them, see [Use Projects to Manage Content Access](https://help.tableau.com/v0.0/server-linux/en-us/projects.htm). - Before you create project hierarchies, become familiar with [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#projectpermissions). - To see the specific site roles that allow full Project Leader access, see [Project-level administration](https://help.tableau.com/v0.0/server-linux/en-us/projects.htm#project-admin). ## Add a top-level or child (nested) project 1. While you’re signed in to Tableau Server as an administrator or project leader, select Explore, and then do one of the following: - Select New > Project to create a new top-level project (only administrators can do this). - Navigate to and open the project in which you want to create a sub-project, and then select New > Project. If you’re not sure where to find the child project, select All Projects from the drop-down menu next to Explore, or use the filters in the upper right. 2. Enter a name and description for the project, and then click Create. ![New project dialog with fields for a project name and description.](/tableau/next/en-us/server-linux/en-us/Img/projects_new1.png) You can include formatting and hyperlinks in the project description. Select **Show formatting hints** for syntax. You can also [Add a Project Image](https://help.tableau.com/v0.0/server-linux/en-us/custom_projectimage.htm). When entering a project description, include a space between capital letters and parentheses to display content inside them, such as "PROJECT (a)". Omitting this space will cause display issues in the project description. **Note:** To edit a project description later, select it to open it, select the information icon next to its name, and then click **Edit**. ## Use the project tree to navigate projects By default, the Explore pane displays a project tree to help you easily navigate your projects. You can use the project tree to find sub-projects within a project folder. You can also use the project tree to search for projects. ![The project tree on the explore pane in Tableau Cloud.](/tableau/next/en-us/server-linux/en-us/Img/Cloud_ProjectTree.png) You can hide and unhide the project tree by clicking the project tree icon located on the Explore pane. ![The project tree icon on the explore pane in Tableau Cloud.](/tableau/next/en-us/server-linux/en-us/Img/Cloud_ProjectTreeIcon.png) > [!TIP] > > **Note:** To ensure the project tree is visible, maintain a browser window width of at least 1441px on the Explore page. A narrower window (1440px or less) or a lower-resolution display will hide the project tree. ## Move an asset to another project 1. In the Explore section, find the asset you want to move. You can use the filters in the upper right to search, or you can navigate through the project hierarchy. 2. On the workbook’s Actions(…) menu, select Move. 3. Select the new project for the workbook, and then click Move Content. ![](/tableau/next/en-us/server-linux/en-us/Img/projects_move_project.png) Moving a project includes moving everything in it, including child projects and their assets. ### How moving projects affect permissions When you move a project, Project Leader permissions adapt to the new project environment. - When the target project hierarchy is **Locked**, previous Project Leader permissions are removed, and new Project Leader permissions are granted according to those set at the top-level of the target hierarchy. - When the target project hierarchy is **Customizable**, previous implicitly granted Project Leader permissions are removed, explicitly set Project Leader permissions are retained, and new Project Leader permissions are granted according to those set at the top-level of the target hierarchy. When you move a project and assets, permissions may be impacted. For more information, see [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#moveproject). ## Delete a project When you delete a project, all of the Tableau content in the project is also deleted. If you want to delete a project but not its content, move the content to another project, and then delete the project. External assets, such as databases and tables, are not deleted, but are moved to the External Assets Default Project. (In Tableau Server 2022.3 and earlier, the assets can be found in External Assets.) **Important** - You cannot undo deleting a project. - Deleting a project deletes all Tableau content in it, including child projects and their content, but not external assets. - You cannot delete the Default project or the External Assets Default Project. To delete a project: 1. In the Explore section, find the project you want to remove. If you’re not sure where to find the project, select All Projects from the drop-down menu next to Explore, or use the filters in the upper right. 2. On the project’s Actions (…) menu, select Delete. 3. Confirm that you want to delete the project. ## Requirements for moving assets Moving an asset is effectively like removing it from one project and publishing it to another. For non-administrators, the permissions needed on the source project are different from those needed on the destination project. ### Required site role To move assets, users must have one of the following site roles: - Server Administrator (Tableau Server only) - Site Administrator Creator or Site Administrator Explorer - Creator or Explorer (can publish) Users with a Server Administrator or Site Administrator site role do not need any additional capabilities. ### Required permissions for the project that users move content _to_ Non-administrators must have the Publish permission capability for the destination project. ### Required permissions for the project that users move content _from_ Non-administrator users must - Be the project owner, project leader, or content owner for the original project OR - Have the Move permission capability for the content (or, for data sources, be the data source owner). When moving a database with its tables, the user must have the Move capability for both the database _and_ its tables. For more information on moving assets, see [Move content](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#MoveContent). [Skip to main content](#main-content) # Add Tables to the Connection On the Tables tab: Add tables to the connection **Add tables** Choose an option: - On the left, under **Tables**, double-click table names or select and drag them to the **Tables** pane on the right. Include an entitlement table, if you're using one. - Select ![New Custom SQL button](/tableau/next/en-us/server-linux/en-us/Img/ipa_New_Custom_SQL_btn.png) to create a custom table schema, or select Convert to Custom SQL on an existing table and use it as a starting point for Custom SQL. Select ![The refresh data icon in the virtual connection editor toolbar](/tableau/next/en-us/server-linux/en-us/Img/ipa_vconns_refresh_icon.png) to get the latest data from the database for all the connections. **View and edit table details** 1. Select a table in the Tables tab. 2. In the Table Details section, select a column value to make edits like hide or rename a column, or change the data type. Select live or extract mode for tables Set individual tables to either live or extract mode: - Live Only\- Queried directly from the database. (Live is the default.) - Extracts Only\- Extracted and saved to Tableau. Under Tables, select the table or tables you want to change the mode for and select Actions, and Change to Live or Change to Extract. - Select Create Pending Extracts to create extracts, or Refresh All Extracts to refresh them after creation. - Select a table's Actions menu (...) > Extract Settings to configure the extract for incremental refresh. - Schedule extract refreshes on the virtual connection page after you publish the connection. [Read schedule extract topic](https://help.tableau.com/current/server-linux/en-us/dm_vconn_extract.htm) Set the table visibility state Use the Visibility toggle to show or hide tables from users. ![Check mark means show](/tableau/next/en-us/server-linux/en-us/Img/ipa_vconn_check_mark_show.png) Users can see table data. Create a policy to govern which data users can see. (Visible is the default.) ![X means hide](/tableau/next/en-us/server-linux/en-us/Img/ipa_vconn_x_hide.png) Users can’t see table data. You can use hidden tables in a data policy and as an entitlement table. See table details Select a table at the top of the Tables tab to see its details below. Switch the table information you see using these icons: ![Tag icon represents column data type.](/tableau/next/en-us/server-linux/en-us/Img/ipa_Tag_16px_medium.png) Data type for each column. ![Table icon represents column sample data.](/tableau/next/en-us/server-linux/en-us/Img/ipa_Table_16px_medium.png) Sample data for each column. ![Profile icon represents the column value range.](/tableau/next/en-us/server-linux/en-us/Img/ipa_Panes_show_16px_medium.png) Range of values in a histogram for each column selected. **Quick clip**: View your table details. Your browser does not support the video tag. See Linked keys by selecting ![table icon](/tableau/next/en-us/server-linux/en-us/Img/ipa_Table_16px_medium.png) to see which columns link to other tables. Linked keys show only when databases have primary and foreign key information. Publish the connection and set permissions ### Save a draft or publish a connection Your connection is automatically saved as a draft while you work. Manually save the draft by clicking ![Save icon](/tableau/next/en-us/server-linux/en-us/Img/ipa_Save_16px_medium.png). To share a new virtual connection with other users, you need to publish it. 1. Click ![Publish button](/tableau/next/en-us/server-linux/en-us/Img/ipa_vconn_publish_btn.png) in the upper right corner of the editor. 2. Type a name for the connection in the Name field. 3. Select a project to save the connection to. 4. Click ![Publish button](/tableau/next/en-us/server-linux/en-us/Img/ipa_vconn_publish_btn.png) When you edit an existing connection, it remains available to users in its current published state. - To save updates to a draft, click ![Save icon](/tableau/next/en-us/server-linux/en-us/Img/ipa_Save_16px_medium.png). - To make the updated connection available to users, click ![Publish button](/tableau/next/en-us/server-linux/en-us/Img/ipa_vconn_publish_btn.png) ### Set permissions so others can use the connection You've published the connection, and you're ready to let others use it. To do this, set the Connect capability to Allowed. 1. Navigate to the virtual connection. 2. Open the Actions menu (...) and click Permissions. 3. Select the box under the Connect icon so that connect is allowed for all users. ![Connect capability check box under Permissions Rules](/tableau/next/en-us/server-linux/en-us/Img/ipa_vconn_connect_capability.png) 4. Click Save. [Read publish and permissions topic](https://help.tableau.com/current/server-linux/en-us/dm_vconn_publish_save.htm) [Read virtual connections topic](https://help.tableau.com/current/server-linux/en-us/dm_vconn_create_conn.htm) ## Related tasks [About the Virtual Connection Editor](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_about_editor.htm) [About Data Policies](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_about_data_policy.htm) [Create and Test Data Policies](https://help.tableau.com/v0.0/server-linux/en-us/ipa_vconn_create_data_policy.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) # Add Trusted IP Addresses or Host Names to Tableau Server The first step in setting up trusted authentication is to configure Tableau Server to recognize and trust requests from one or more web servers: 1. Open TSM in a browser: https://:8850. For more information, see [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/v0.0/server-linux/en-us/sign_in_tsm.htm). 2. Click User Identity & Access on the Configuration tab and then click Trusted Authentication. 3. Under Trusted Authentication, for each trusted host, enter the name or IP address and then click Add: ![Configure trusted authentication screenshot](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-trustedauth.png) **Notes:** The values you specify completely overwrite any previous setting. Therefore, you must include the full list of hosts if you want to amend an existing list. Static IP addresses are required: The web servers you specify must use static IP addresses, even if you use host names. If you have one or more proxy servers between the computer that is requesting the trusted ticket (one of those configured in Step 2 as shown at [Trusted Authentication](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth.htm)) and Tableau Server, you also need to add them as trusted gateways using the `tsm configuration set gateway.trusted` option. See [Configuring Proxies and Load Balancers for Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/proxy.htm) for steps. 4. Enter a value in Token Length (Optional). The token length determines the number of characters in each trusted ticket. The default setting of 24 characters provides 144 bits of randomness. The value can be set to any integer between 9 and 255, inclusive. 5. Click Save Pending Changes after you've entered your configuration information. 6. Click Pending Changes at the top of the page: ![Tableau Server Manager toolbar indicating that there are pending changes.](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-pending-changes-btn.png) 7. Click Apply Changes and Restart. 1. Enter the following command: tsm authentication trusted configure -th In the command above, `` should be a comma-separated list of the IPv4 addresses or host names of your web server(s), with each host name or IP address in quotes. **Note**: The values you specify completely overwrite any previous setting. Therefore, you must include the full list of hosts in the `tsm authentication trusted configure -th` command. (You cannot amend the list of hosts by running the `tsm authentication trusted configure -th` command repeatedly.) For example: tsm authentication trusted configure -th "192.168.1.101", "192.168.1.102", "192.168.1.103" or tsm authentication trusted configure -th "webserv1", "webserv2", "webserv3" **Notes:** Each host name or IP address in the list must be in double-quotes, followed by a comma and one space after each comma. The web servers you specify must use static IP addresses, even if you use host names. 2. If you have one or more proxy servers between the computer that is requesting the trusted ticket (one of those configured in Step 2 as shown at [Trusted Authentication](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth.htm)) and Tableau Server, you also need to add them as trusted gateways using the `tsm configuration set gateway.trusted` option. See [Configuring Proxies and Load Balancers for Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/proxy.htm) for steps. 3. Type the following command to save the changes to all the server configuration files: tsm pending-changes apply If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). There are other optional trusted authentication configurations (legacy support, logging, and timeout settings) that you can make by passing a json file to Tableau Server. See [trustedAuthenticationSettings Entity](https://help.tableau.com/v0.0/server-linux/en-us/entity_trusted_auth.htm). Next, you need to [configure your web server to receive tickets from Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_webrequ.htm). [Skip to main content](#main-content) # Add Users to a Group You can organize Tableau Server users into groups to make it easier to manage multiple users. You can create groups on the server or import groups from Active Directory. If you're managing users with an [External identity store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm#external), such as Active Directory, add users to a group through the external identity store itself. Once users are added to a group in the external identity store, Tableau Server is able to update those users by synchronizing the group of users in the external identity store with the group of users on Tableau Server. For example, to keep Active Directory group membership up to date, we recommend you review the following: - Site administrators can synchronize selected groups on demand in a site. For more information, see [Synchronize Active Directory Groups on a Site](https://help.tableau.com/v0.0/server-linux/en-us/groups_create_adsync.htm). - Server administrators can synchronize all Active Directory groups on the server based on a schedule or on-demand. For more information, see [Synchronize All Active Directory Groups on the Server](https://help.tableau.com/v0.0/server-linux/en-us/groups_globalsync.htm). **Notes:** - In the context of user and group synchronization, Tableau Server configured with LDAP identity store is equivalent to Active Directory. Active Directory synchronization features in Tableau Server function seamlessly with properly configured LDAP directory solutions. When identity pools are configured, you cannot add groups to an identity pool. - Adding groups to an [identity pool](https://help.tableau.com/v0.0/server-linux/en-us/identity_pools.htm) is not supported. Only individual users can be added to an identity pool. If you're managing users with a [Local identity store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm#local), use the procedures described below to add users to a group. To add a user to a group, the group must already exist. ## Add users to a group (Users page) 1. In a site, click **Users**. 2. Select the users you want to add to a group, and then click **Actions** > Group Membership. ![A user list with display names, two of which are selected to be part of a group action.](/tableau/next/en-us/server-linux/en-us/Img/users7.png) 3. In the Group Membership dialog box, select the groups and then click **Save**. ## Add users to a group (Groups page) 1. In a site, click **Groups**, and then click the name of the group. ![A list of groups with checkboxes for selection.](/tableau/next/en-us/server-linux/en-us/Img/groups_addusers_group.png) 2. In the group's page, click **Add Users**. ![Group page showing the Add Users button.](/tableau/next/en-us/server-linux/en-us/Img/groups_addusers.png) 3. In the Add Users dialog box, select the users to be added, and then click **Add Users**. [Skip to main content](#main-content) # Add Users to a Site Everyone who needs to access Tableau Server—whether to browse, publish, edit content or administer the site—must be added as a user. Administrators have the following options for adding users: - Add a local user account or a user account from Active Directory, described later in this article. You can also add users by importing an Active Directory group. See [Create Groups via Active Directory](https://help.tableau.com/v0.0/server-linux/en-us/groups_create_ad.htm). For Tableau Server on Linux, all external directory communication is configured and managed with a LDAP identity store. In the context of user and group synchronization, Tableau Server configured with LDAP identity store is equivalent to Active Directory. Active Directory synchronization features in Tableau Server function seamlessly with properly configured LDAP directory solutions. - [Import Users](https://help.tableau.com/v0.0/server-linux/en-us/users_import.htm) via a CSV file that you create using the [CSV Import File Guidelines](https://help.tableau.com/v0.0/server-linux/en-us/csvguidelines.htm). ## Site administrator access to user management By default site administrators can add and remove users on a site. On the site’s Settings page, server administrators can revoke that capability, so that only server administrators can manage the site’s users. > [!TIP] > > Admin Profiles grant non-administrator users specific capabilities around user and group management without increasing their content access. A site administrator can edit an existing local user account only if the administrator has access to all of the sites the user is a member of. For example, if User1 is a member of sites A and B, an administrator of only site B cannot edit User1’s full name or reset the password. **Note:** When using local authentication, if a site administrator is able to add and remove users, they will be able to tell if a username is configured as a user on any site of Tableau Server ## Add local users to a site 1. Sign in to Tableau Server as an administrator, and if applicable select the site. 2. Select Users. On the Users page, click Add Users, and then click Create new user. ![A dialog box with options to add new users or import users from a CSV file.](/tableau/next/en-us/server-linux/en-us/Img/users1_local.png) 3. Enter a user name. With local authentication, using an email address for the user name is the best way to avoid user name collisions (for example, _lrodriguez@example.com_ instead of _lrodriguez_). ![A new user account creation form.](/tableau/next/en-us/server-linux/en-us/Img/users2_local.png) User names are not case sensitive. Characters not allowed in user names include the semi-colon (;) and colon (:). Also enter information in the following fields: - Display Name—Type a display name for the user (e.g., _Laura Rodriguez_). - Password—Type a password for the user. - Confirm password—Retype the password. - Email—This is optional and can be added at a later time in the user profile settings. 4. Select a site role. For site role definitions, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). 5. Click Create User. ## Add Active Directory users to a site Before adding users to a site, be sure to review [User Management in Deployments with External Identity Stores](https://help.tableau.com/v0.0/server-linux/en-us/users_manage_ad.htm) to understand how multiple domains, domain naming, NetBIOS, and Active Directory user name format influence Tableau user management. 1. In a site, click Users, and then click Add Users, and then click Active Directory Users. ![A dialog box to choose how to add users to the site.](/tableau/next/en-us/server-linux/en-us/Img/users_site_add_AD.png) 2. Enter one or more user names (separated by semicolons). For example, _tdavis; jjohnson; hwilson_ If you are adding a user that is from the same Active Directory domain that the server is running on, you can type the AD user name without the domain. The server’s domain will be assumed. **Note:** Do not enter the user’s full name in this field; it can cause errors during the importing process. 3. Select a site role. For site role definitions, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). 4. Click Import Users. ## Remove local users 1. Sign in to Tableau Server as an administrator, select the site, and open the Users page. 2. Select the check boxes next to the users’ names, and on the Actions menu, select Remove. If a user is a member only of the current site, and they do not own any content, the user is removed from the server. If a user you remove from the current site is a member of other sites on the server, their status remains unchanged on those sites. ## Related information - You can also [Add Users to Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/users_add.htm), without site affiliation. - Upgrading Tableau Server to version 2018.1 or later from a pre-2018.1 version, without activating user-based licenses, affects users who were assigned the Viewer site role in the pre-2018.1 server version. To learn more, see the section “User-based licenses” in the [Licensing Overview](https://help.tableau.com/v0.0/server-linux/en-us/license_server_overview.htm#User-based) and see [Set Users’ Site Roles](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). [Skip to main content](#main-content) # Add Users to Tableau Server You can add users to Tableau Server one at a time or in batches. You can add them to the server as unlicensed users, and then add them to sites and assign site roles as you onboard them to Tableau Server. Or you can add users to sites and specify their site roles at the same time, at which point they are ready to sign in. ## Before you begin - If your Tableau Server is configured with an Active Directory external identity store, review [User Management in Deployments with External Identity Stores](https://help.tableau.com/v0.0/server-linux/en-us/users_manage_ad.htm) to understand how multiple domains, domain naming, NetBIOS, and Active Directory user name format influence Tableau user management. **Note:** In the context of user and group synchronization, Tableau Server configured with LDAP identity store is equivalent to Active Directory. Active Directory synchronization features in Tableau Server function seamlessly with properly configured LDAP directory solutions. - Verify that you have enough user licenses and role licenses for your user base. If you attempt to add a user for a site role that you do not have a license for, then you will receive an error. - To add user licenses to your Tableau Server deployment, visit the [Tableau Customer Portal](http://customer.tableausoftware.com/) to purchase licenses and the corresponding product key(s). After you have purchased licenses, see [Add Capacity to Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/capacity_add.htm) to update the server with the new key(s). - The steps in this topic describe how to add an individual user and assign their site role. To add users in batches, see [Import Users](https://help.tableau.com/v0.0/server-linux/en-us/users_import.htm). ## When adding users at the server level versus the site level In a single-site environment, server administrators can add users on the Users page. ![Option to Add Users on Tableau Cloud.](/tableau/next/en-us/server-linux/en-us/Img/sites_add_user_ss_list.png) After you add a site to Tableau Server, it becomes a multi-site server with a Server Users page (all server users from every site appear here) and a Site Users page. Only server administrators can access the Server Users page, and both site administrators and server administrators can access the Site Users page. ![Site Users on Tableau Cloud.](/tableau/next/en-us/server-linux/en-us/Img/sites_add_user_siteusers.png) The Server Users page is the only place where you can assign users to multiple sites, delete users from the server, and if the server is using local authentication, reset user passwords. ![A list of Tableau Server users with option to Add Users.](/tableau/next/en-us/server-linux/en-us/Img/sites_addusers1.png) ## Add a user to the server When adding a user, the workflow changes depending on whether at least one [identity pool](https://help.tableau.com/v0.0/server-linux/en-us/identity_pools.htm) is configured for Tableau Server. ### No identity pools configured If no identity pools are configured, i.e., Tableau Server is only using the user provisioning and authentication configured during Tableau Server setup (also referred to as the initial pool (TSM configured)), follow the steps described below to add a user. 1. In the site menu, select Manage All Sites > Users, and then click Add Users. To add a user to a site, you select the site and go to the Users page. ![Option to Add Users on Tableau Server.](/tableau/next/en-us/server-linux/en-us/Img/sites_adduser_srv.png) 2. Do one of the following: - If the server is configured for **local authentication**, click New User, and enter a user name. With local authentication, the best way to avoid user name collisions is to provide an email address for the user name. For example, _jsmith@example.com_ instead of _jsmith_. User names are not case sensitive. Characters not allowed in user names include the semi-colon (;) and colon (,). - If the server is configured for **Active Directory authentication**, click Active Directory User. If you are adding a user from the same Active Directory domain that Tableau Server runs on, the server domain will be assumed, and you can type the AD user name without the domain. **Note:** Do not enter the user’s full name; this can cause errors during the importing process. 3. If the server is using local authentication, provide the following: - Display Name—Type a display name for the user (e.g., _John Smith_). - Password—Type a password for the user. - Confirm password—Retype the password. - Email—This is optional and can be added at a later time in the user profile settings. - Selected users are Server Administrators: Specify whether the user should be a server administrator. - Name (Site Membership) / Site Role: If the user is not a server administrator, you can assign a user to zero or more sites, along with a site role for each site. You do not have to choose site membership and site role at this time. If you don’t specify site membership and site role for a new server user, the user will be added as a server user only, with a site role of Unlicensed. For details, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). 4. Click Create. ![Add a new user on Tableau Server form.](/tableau/next/en-us/server-linux/en-us/Img/sites_adduser_srv2.png) ### One or more identity pools configured When adding a user, if one or more identity pools are configured, you must first select an identity pool or the initial pool (TSM configured), which is the user provisioning and authentication configured in TSM during Tableau Server setup. 1. In the site menu, select Manage All Sites > Users, and then click Add Users > Create new user. To add a user to a site, you select the site and go to the Users page. ![Option to Add Users on Tableau Server.](/tableau/next/en-us/server-linux/en-us/Img/sites_adduser_srv_create_new_user.png) 2. In the Add New Users dialog box, select the identity pool you want to add the user to. ![Add new users from an Initial Pool.](/tableau/next/en-us/server-linux/en-us/Img/sites_adduser_idpool_select.png) 3. Do one of the following: - If the identity pool you selected in step 2 is configured for LOCAL identity store and LOCAL authentication: 1. In the New User dialog box, in the Username text box, enter a user name. With local authentication, the best way to avoid user name collisions is to provide an email address for the user name. For example, _jsmith@example.com_ instead of _jsmith_. User names are not case sensitive. Characters not allowed in user names include the semi-colon (;) and colon (,). ![Add New User dialog box.](/tableau/next/en-us/server-linux/en-us/Img/sites_adduser_idpool_local_newuser.png) 2. Enter the following information: - Display name—Type a display name for the user (e.g., _John Smith_). - Password—Type a password for the user. - Confirm password—Retype the password. - Email (optional)—This is optional and can be added at a later time in the user profile settings. - Selected users are Server Administrators: Specify whether the user should be a server administrator. - Site Role: If the user is not a server administrator, you can assign a site role. You do not have to choose site role at this time. If you don’t specify site role for a new user, the user will be added as a server user only, with a site role of Unlicensed. For details, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). 3. When finished, click Create User. - If the identity pool you selected in step 2 is configured for LOCAL identity store with OIDC authentication: 1. In the New User dialog box, in the Username text box, enter a user name. With local authentication, the best way to avoid user name collisions is to provide an email address for the user name. For example, _jsmith@example.com_ instead of _jsmith_. User names are not case sensitive. Characters not allowed in user names include the semi-colon (;) and colon (,). ![Add New User dialog box.](/tableau/next/en-us/server-linux/en-us/Img/sites_adduser_idpool_local_newuser_ad.png) 2. Enter the following information: - Display name—Type a display name for the user (e.g., _John Smith_). - Password—Type a password for the user. - Identifier (optional)—Type the identifier you want to associate with the user. Identifiers are for identity matching purposes. For more information, see [Usernames and identifiers in Tableau](https://help.tableau.com/v0.0/server-linux/en-us/identity_pools.htm#usernames_identifiers). - Email (optional)—This is optional and can be added at a later time in the user profile settings. - Site and Site role—If the user is not a server administrator, you can assign a user to zero or more sites, along with a site role for each site. You do not have to choose site membership and site role at this time. If you don’t specify site membership and site role for a new server user, the user will be added as a server user only, with a site role of Unlicensed. For details, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). - Make selected users Server Administrators—Specify whether the user should be a server administrator. 3. When finished, click Create User. - If the identity pool you selected in step 2 is configured for ACTIVE\_DIRECTORY or LDAP identity store: 1. Type the AD or LDAP user name without the domain. In this workflow, you're adding a user from the same Active Directory domain that Tableau Server was configured with in TSM during Tableau Server setup. Therefore, the server domain will be assumed, and you can type the AD or LDAP user name without the domain. **Note:** Do not enter the user’s full name; this can cause errors during the importing process. ![Import Users from Active Directory.](/tableau/next/en-us/server-linux/en-us/Img/sites_adduser_idpool_ad.png) 2. When finished, click Import Users. [Skip to main content](#main-content) # Add Web Images Dynamically to Worksheets At Tableau, we know that images are a powerful tool when analyzing data. Imagine that you're looking at a viz of monthly shoe sales. The data is telling you that you sold more high heels than wedges, but you can't picture the difference in the two types of shoe. That's where Image Role comes in. You can dynamically add web images to your worksheets and use them in your headers to add visual detail. ![Viz with images of shoes along with the shoe type and sales](/tableau/next/en-us/server-linux/en-us/Img/imagerole_1.png) ## Prepare your data source Image Role can be assigned to discrete dimension fields that contain URLs that point to web images. To prepare your data, be sure that your image fields meet the requirements set by Tableau to be assigned an image role: - Make sure your URLs navigate to .png, .jpeg, .jpg, .svg, .webp, .jfif, .ico, or .gif image files. - Verify that each URL begins with http or https. If a transport protocol isn’t included, Tableau assumes https. - Optimize the number of images used in your data set. Usually, you can load up to 500 images per field. - Ensure that each image file is smaller than 200 kb. **Note:** If you're using Tableau 23.1 or earlier, your URLs must navigate to image files with .jpg, .jpeg, or .png file extensions. In Tableau 23.2 and later, .gif files are supported, but .gif **animations** will only show on Tableau Cloud and Tableau Server with a client-side render. In Tableau Desktop and Tableau Server with a server-side render, the .gif file will show as a static image. Depending on the complexity of your viz, Tableau may default to a server-side render, which limits the number of images to 100 per field. To learn more about complexity settings and server-side rendering, see [Configure Client-Side Rendering.](https://help.tableau.com/current/server/en-us/browser_rendering.htm) ### Example data set:

Product Name	Product Image URL	Product Sales
Flats	https://img.example.com/flats.png	12,118
High Heels	https://img.example.com/highheels.png	15,865
Running Shoes	https://img.example.com/runningshoes.png	14,200
Wedges	https://img.example.com/wedges.png	8,665

## Assign an image role to your URLs After you’ve connected to your data source, you can assign an Image Role to your URLs from either the Data Source page or on the Data pane in a worksheet. ### From the Data Source page: 1. Locate the column that has image URLs. 2. Right-click (control click on Mac) the icon on the top left of the column and select Image Role > URL. The icon changes to an image icon, and your images are ready to use. ![Data source option to assign an image role to URLs](/tableau/next/en-us/server-linux/en-us/Img/imagerole_3.png) ### From a worksheet: 1. Open a new worksheet. 2. Locate a discrete dimension field that has image URLs. 3. Right-click (control click on Mac) the dimension field and select Image Role > URL. The icon changes to an image icon, and your images are ready to use. ![Data pane option to assign an image role to data](/tableau/next/en-us/server-linux/en-us/Img/imagerole_2.png) ## Add images to your visualizations From your worksheet, drag the Image Role field onto the Rows or Columns shelf. You can now see images along with their associated data on your viz. ![Create an image role in the data pane.](/tableau/next/en-us/server-linux/en-us/Img/imagerole_addtoviz2.gif) ## Share your visualizations You can export your workbooks with images and share them. Be sure that the images used in your vizzes are available to be viewed by everyone you share your vizzes with. For example, if you’re using images that are hosted on an internal server behind a firewall, be sure that everyone you share the viz with has sufficient permissions to access the images. In this example, users who view the viz while connected to the same server shouldn’t have any issues seeing the images. But users who export the viz to a pdf on a Tableau Cloud server may not be able to see the images. If you export your workbook and your viewer attempts to open it in Tableau 2022.3 or earlier, your viewer won’t be able to see the images. **Note:** It’s a best practice to always align an Image Role field with a text description to make the content accessible for screen readers and other accessibility software. ## Troubleshoot image connections Sometimes images won't display if you exceed the number of images allowed per field, have large image files on a complex viz, or are viewing the viz on a mobile device. This section helps you troubleshoot those errors. ### None of the images are displaying in my viz There are too many images in the viz Depending on the complexity of your viz, you can typically load 500 images per field. If you have a complex viz, it may default to server-side rendering. With server-side rendering, you can load 100 images per field. If you get an error message that there are too many images in the viz, filter out images and try again. Tableau couldn't access the images If you receive broken image icons instead of your images, first confirm that you have sufficient permissions to view the images (or if, for example, they're behind a firewall). Tableau must be able to access the images, and the images can't require a separate authentication to view them. If you're sure that you have permission to view the images and they're within the size requirements, check that web images are enabled on your settings page. In Tableau Desktop: 1. From your workbook, click Help in the toolbar. 2. Select Settings and Performance > Set Dashboard Web View Security. 3. Make sure that Enable Web Page Objects and Web Images is checked. In Tableau Cloud: 1. From the home page, click Settings. 2. Under general, scroll down and locate Web Page Objects and Web Images. 3. Make sure that Enable Web Page Objects and Web Images is checked. ### Some of the images aren't displaying in my viz The image file is too large Each image file must be smaller than 200 kb to render. Check your image file size and try again. You're using an earlier version of Tableau If you’re using Tableau 23.1 or earlier, only .png, .jpeg, and .jpg image files are supported. Upgrade your version of Tableau or use a supported file type for the version of Tableau you're using. The image URL must begin with http or https Each image URL must begin with either http or https. Tableau doesn't currently support FTP/SMTP calls. Verify your URL format and try again. The image file must be a URL An Image Role can be assigned to only URLs that navigate to .png, .jpeg, or .jpg, .svg, .webp, .jfif, .ico, .bmp, or .gif image files. Verify your URL format and try again. The image file type isn’t supported An Image Role can be assigned to only URLs that navigate to .png, .jpeg, or .jpg, .svg, .webp, .jfif, .ico, .bmp, or .gif image files. Verify your URL format and try again. If you’re using Tableau 23.1 or earlier, only .png, .jpeg, and .jpg image files are supported. Upgrade your version of Tableau or use a supported file type for the version of Tableau you're using. In Tableau 23.2 and later, .gif files are supported, but .gif **animations** will only show on Tableau Cloud and Tableau Server with a client-side render. In Tableau Desktop and Tableau Server with a server-side render, the .gif file will show as a static image. The image file contains bad characters An Image Role can't be assigned to URLs that have the following characters: < > & \\ ^ ' or the following character sequences: .. \\\\. \\r \\n \\t Verify that your URL doesn't contain any of these characters or character sequences and try again. ### The images aren't displaying outside of my worksheet The images aren't displaying in Viz in Tooltip Viz in Tooltip is processed with server-side rendering, which allows you to load up to 100 images per field. Verify that you have fewer than 100 images per field and try again. For more about server and client-side rendering, see [Configure Client-Side Rendering.](https://help.tableau.com/current/server/en-us/browser_rendering.htm) For more about using Viz in Tooltip, see [Create Views in Tooltips (Viz in Tooltip).](https://help.tableau.com/current/pro/desktop/en-us/viz_in_tooltip.htm) The images aren't displaying in View in Thumbnail View Thumbnail is processed with server-side rendering, which allows you to load up to 100 images per field. Verify that you have fewer than 100 images per field and try again. For more about server and client-side rendering, see [Configure Client-Side Rendering.](https://help.tableau.com/current/server/en-us/browser_rendering.htm) The images aren't displaying when I export my workbook All exports and export-related features are processed with server-side rendering, which allows you to load up to 100 images per field. Verify that you have fewer than 100 images per field and try again. The images aren't displaying on a mobile device Mobile devices have a lower complexity threshold than computers, so the processing is completed through server-side rendering, which allows you to load up to 100 images per field. Verify that you have fewer than 100 images per field and try again. You can change the complexity settings on your mobile device. For more info on complexity thresholds, see [Configure the complexity threshold for computers and mobile devices.](https://help.tableau.com/current/server/en-us/browser_rendering.htm#configure-the-complexity-threshold-for-computers-and-mobile-devices) [Skip to main content](#main-content) # Admin Profiles The Server Administrator and Site Administrator site roles grant users automatic permissions to various administrative settings but also all content. This means that if a user is made an admin so they can add users to the site or manage groups, they can also access all content on the site. In many settings, this type of access isn't ideal. Admin Profiles are a way to give a user a specific set of administrative capabilities without giving them universal content access. Each admin profile defines a specific set of capabilities. Users are then assigned to a profile and gain the ability to perform those tasks. - Admin profile capabilities include user management and group management. They don't include the ability to modify site settings. - Admin profiles are created and managed by a Tableau Server Admin. Site admins can be authorized to assign users to profiles, but site admins can't edit or create admin profiles. - Admin profiles don't grant access to content. ## Create an admin profile Creating an admin profile consists of setting up the profile capabilities and adding it to sites. Only a Tableau Server Administrator can create an admin profile. ### Open the Admin Profiles page 1. As a Tableau Server Administrator, go to All Sites to access server-level settings. 1. Open the dropdown for the site selector and choose Manage all sites. 2. In the left pane, select Admin Profiles. Any existing profiles appear in the Admin profiles list. A pane to the right shows details for the selected profile. A selected profile has three tabs: Capabilities, Sites, and Users. - The **Capabilities** tab shows all the capabilities at a glance. - The **Sites** tab shows which sites the admin profile is present on, and how many users per site have the profile. Add the profile to existing sites from this tab. - The **Users** tab shows which users have the profile. This tab is useful for auditing but users can't be assigned a profile from this tab. Profile assignment happens from the Users page. ![the Admin Profiles screen, with a list of four admin profiles and one selected to show its details](/tableau/next/en-us/server-linux/en-us/Img/admin_profiles.png) ### Make a new admin profile 1. Click the New Admin Profile button. 2. Name the profile. 1. This name appears in a dropdown when assigning the profile to users, so make it descriptive but short. 2. Avoid potentially conflicting names, such as site roles like "Site Admin Creator.") 3. Select which [Admin profile capabilities](#capabilities) the profile should grant. 1. Some capabilities depend on other capabilities. For example, "See users" is required for the capability "Add new users." The help text for each capability describes any dependencies it has. 2. Users can have at most one profile per site. 4. (Optional) Add a description that describes the admin profile's purpose. 5. Click the Create Admin Profile button. ![the Create Admin Profiles dialog, showing the capabilities for user and group management](/tableau/next/en-us/server-linux/en-us/Img/admin_profiles_capabilities.png) The profile now exists on the server, but it's not yet available on any sites. The next step is to add the profile to a site and add users. ### Add the profile to a site 1. Select the profile from the list of admin profiles. 2. Go to the Sites tab. 3. Click the Assign Admin Profile to Site button. 4. Select the sites that the profile should be available on. The final step is to assign the profile to users. Because only server admins can access the Admin Profiles page, this step isn't done on the Admin Profiles page. Instead, users are assigned an admin profile from the Users page. ## Assign an admin profile to users To be given an admin profile, a user must have an Explorer or Creator site role. Users can be assigned only one admin profile per site. _Site or Server administrator_. Users can be assigned admin profiles at the site level: 1. Go to the Site Users page. 2. Open the action menu (...) for the user. 3. Select Site role… 4. Use the Admin profile dropdown to assign them a profile. 1. To assign a profile that doesn't appear in the dropdown, ask a server admin to make sure the profile has been added to the site. ![The site role dialog showing dropdowns for site role and admin profile](/tableau/next/en-us/server-linux/en-us/Img/admin_profiles_siteroles.png) _Server administrators only_. Users can be assigned admin profiles at the server level: 1. Go to the Server Users page. 2. Open the action menu (...) for the user. 3. Select Site membership… 4. For each site the user belongs to, use the Admin profile dropdown to assign them a profile. 1. Each site's dropdown shows profiles that have been added to that site. To assign a profile that doesn't appear in the dropdown for that site, go back to the section [Add the profile to a site](#addtosite) and make sure the profile has been added to that site. ## Manage admin profiles To manage an admin profile, go to the Admin Profiles page. (All sites > Admin Profiles in the left pane). From there: - Edit an admin profile by opening the action menu (...) for the profile and selecting Edit Profile. - Delete an admin profile by opening the action menu (...) for the profile and selecting Delete Profile. - Remove a profile from a site by selecting the profile and going to its Sites tab. Open the action menu (...) for a site and choose Remove from site. - If there are any users assigned to that profile on that site, they lose their admin capabilities. ## Admin profile capabilities Unlike groups, which are evaluated in combination to determine [effective permissions](https://www.google.com/url?q=https://help.tableau.com/current/server/en-us/permission_effective.htm%23evaluate-permission-rules&sa=D&source=docs&ust=1779301708030028&usg=AOvVaw25MOy5kCxsHS0XglS-Kwqg), a single admin profile defines what a user with that profile can and can't do. Set up each admin profile to exactly describe what capabilities a user with that profile has. ### User Management

Capability	Definition	Notes
Add new users	Create and add new users to the site	To be able to add users by importing a file upload, the admin profile must include Manage user settings in addition to Add new users.
Manage user settings	Assign site roles and manage user settings	User settings include locale, email address, force password update, and so on. May need to be granted on multiple sites.*
See users	See what users exist on the site	See users is required for all other user management capabilities in the UI.
Delete users	Permanently remove users

\*When an end user has access to multiple sites, some of their user settings such as email address are shared across sites. For a user with an admin profile to manage these settings, they need to be granted the _Manage user settings_ capability on every site the end user is on. For example, consider user Oscar who is a viewer on Site A and Site B. Uma is a user with an admin profile that includes _Manage user settings_ on Site A. Uma won't be able to manage Oscar's email address—even on Site A—unless Uma is given an admin profile on Site B that includes _Manage user settings_. ### Group Management

Capability	Definition	Notes
Create new groups	Create groups with and without grant role on sign-in
See groups	See what groups exist on the site	See groups is required for all other group management capabilities in the UI.
Edit group details	Change group names and grant role on sign-in status.
Add users to groups	Manage group membership	Only users with an admin site role can assign an admin site role to another user.
Delete groups	Permanently remove groups

[Skip to main content](#main-content) # Administrative Views The Status page contains an embedded Tableau workbook with various administrative views. These views help you to monitor different types of server or site activity. **Note:** You must install PostgreSQL drivers before you can see Administrative views. For more information, see [Database Drivers](https://help.tableau.com/v0.0/server-linux/en-us/dbdriver.htm). ## Navigating to administrative views To see administrative views, click Status. Site administrators can see administrative views for their site. Administrators of multiple sites can see views for the current site. On a multi-site server, server administrators can see views for the entire server. Click the site menu, and then click Manage All Sites to access the server menus. ![A menu with options for Home, Explore, Favorites, Recents, Users, Groups, Schedules, Tasks, Server Status, and Settings.](/tableau/next/en-us/server-linux/en-us/Img/nav_status_multi_site_serveradmin.png) To see views for individual sites on a multi-site server, click the site menu, select the site name, and then click Site Status. ![A menu with options for Home, Explore, Favorites, Recents, Users, Groups, Schedules, Tasks, Server Status, and Settings.](/tableau/next/en-us/server-linux/en-us/Img/nav_status_multi_site_serveradmin01.png) ## Other articles in this section [Skip to main content](#main-content) # Administrative Views for Flows Administrative views can be used to monitor the activities related to flows, performance history, and the disk space used. The **Status** page contains an embedded Tableau workbook with various administrative views that can be used to monitor different types of server or site activity. For **Tableau Server** installations, you must install PostgreSQL drivers before you can see Administrative views. For more information, see [Database Drivers](https://help.tableau.com/current/server-linux/en-us/dbdriver.htm) (Linux), [Database Drivers](https://help.tableau.com/current/server/en-us/dbdriver.htm) (Windows). Server administrators can use these views to see activity both at the server level (aggregated for all sites) or for a specific site. Only server administrators can filter by site. ## Who can do this? Tableau Server administrators and Tableau Site administrators can both view and work with Administrative Views. Only Server administrators can filter by site. ## Action by all users Use this view to gather insight into how flows are being used. This includes actions like publish, download, and flow runs. You can filter the view by actions, by site, and by time range. The Total Users count shows the number of users who have performed an action. This value is not affected by any filtering. The Active user count shows the number of users who have been active during the selected time period and performed one of the selected actions. ![An administrative view showing a line chart on flows and how they are being used.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_admin_views_action_allusers.png) ## Action by Specific User Use this view to gather insights about how an individual user is working with flows. You can filter the view by user name, the type of action, time range, and by site. ![An administrative view showing how an individual user is working with flows.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_admin_views_action_specificuser.png) ## Action by Recent Users This view shows you which users have been active on Tableau Server over the past 24 hours. This can be useful if you need to do some maintenance activity on the server and want to know which users and how many this will affect, and what they're doing. The view shows **Active**, **Recently Active**, and **Idle** users that are currently signed in to Tableau Server. For this view, an active user is one who took an action in the last 5 minutes, a recently active user is one who last took an action within 30 minutes, and an idle user is one who last took an action more than 30 minutes ago. Select a user to see only the actions that user performed recently. Hover over an action to see details of the action. ![An administraive view view showing which flow users have been active on Tableau Server or Tableau Cloud over the past 24 hours.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_admin_views_action_recentusers.png) ## Backgrounder Task Delays This view shows the delay for extract refresh tasks, subscription, and flow tasks—that is, the amount of time between when they are scheduled to run and when they actually run. You can use the view to help identify places you can improve server performance by distributing your task schedules and optimizing tasks. ![An administrative view showing Extract, Subscription, and Flow wait times.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_admin_views_backgrounder_delays.png) Possible reasons for the delays and ways to reduce the delays include the following: - Many tasks are scheduled for the same time. In the example view, tasks that show long delays are clustered at the same time every day, which creates spikes in the wait time. You can set the Timeline filter to a single day to view task delays by hour and identify the hours of the day when many tasks are scheduled at the same time. One solution is to distribute the tasks to off-peak hours to reduce load on the server. - Other server processes running at the same time are consuming server resources and slowing down performance. Monitor the CPU and memory usage of server processes to identify processes that consume the most resources, then adjust the configuration of processes on your server. For more information on monitoring processes, see [Collect Data with Windows Performance Monitor](https://help.tableau.com/current/server/en-us/perf_collect_perfmon.htm). ## Background Tasks for Non Extracts Background Tasks are created to run flows (scheduled and ad hoc). You can use this view to see how many flow tasks succeeded or failed on this site. For details on a task, hover over its icon. ![An administrative view showing how many flow tasks succeeded or failed on this site.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_admin_views_backgrounder_tasks.png) ## Performance of Flow Runs Use this view to see the performance history for all the flows on a site. You can filter by Flow Name, Output Step Name, Flow Owner, Run Type (Scheduled or Ad Hoc), and the time the flow runs were started. ![An administrative view showing the flow performance over time. Each point on the chart corresponds to a specific flow run, displaying the flow name, output step, flow owner, run type, and start and end times.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_admin_views_flow_performance.png) Questions you can answer using this view include: - **What flow tasks are currently scheduled?** – To do this, use the Start Time filter and select the time frame you want to look at. For example, to see flow tasks that are scheduled in the next 3 hours, select **Hours** -> **Next** -> and enter **3**. - **What is the duration of flow tasks?** - To answer this, click on a mark in the view to see details, including the task duration. - **How many flows were run ad hoc, and how many were scheduled runs?** - To answer this, use the **Run Type** filter and select **Ad hoc** or **Scheduled**. This view can also show you the following information: - Flows with the highest run frequency have the most marks. - To see flows that are currently running at the same time, hover over a mark that shows “**In Progress**” or “**Pending and select** “**Keep Only**” to filter all flow runs that are currently running. - To see flows that are running at the same time during a specific time range, select a range for the **Start Time** filter. For example, select “**Next three hours**” to see which flows will be running in the next three hours. ## Stats for Space Usage Use this view to identify which flow outputs are taking up the most disk space on the server. Disk space usage is displayed by user, project, and by the size of flow output and is rounded down to the nearest number. ![An administrative view showing which flow outputs are taking up the most disk space on the server.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_admin_views_spaceusage.png) Use the Min Size filter to control which flow outputs are displayed, based on the amount of space they take up. Use the object type filter for flows. - **What Users Use the Most Space** – This section shows the users who own flows (when filtered for flows) that are taking up the most space. Click a user name to filter the next two graphs for that user. - **What Projects Use the Most Space** – This section shows the projects with flows (when filtered for flows) that are using the most space. - **What Workbooks, Data Source and Flows Use the Most Space** – This section shows the flows (when filtered for flows) that take up the most space. ## Who can do this - **Tableau Server Administrators**: - Setup email notifications at the server level - Set up email notifications for a site - View errors - Resume suspended tasks - View alerts - view process status - **Tableau Site Administrators**: - Set up email notifications at the site level - View errors - Resume suspended tasks - View alerts - **Flow owners, project leaders and any user who is granted permissions to view the flow**: - View errors - Resume suspended tasks - View alerts (Flow owners) [Skip to main content](#main-content) # Agent Incidents [Agents Unlicensed](#Agents) (critical) [Incompatible Agent Version](#Incompat) (critical) [Agent Message Queue Credential Rotation Failure](#MQCredFail) (critical) [Agent Down](#Agent) (warning) In an effort to align with our company values of Equality, we have changed non-inclusive terminology where possible. Because changing terms in certain places can causing a breaking change, we maintain the existing terminology. So, you may continue to see the terms in CLI commands and options, installation folders, configuration files. and other instances. For more information, see [About Tableau Help](https://help.tableau.com/current/tableau/en-us/about-tableau-help.htm). ## Agents Unlicensed _Agents Unlicensed_ incidents will be logged as critical when we detect that your Tableau Server has not been properly licensed to use Tableau Resource Monitoring Tool. To monitor a Tableau Server using the Resource Monitoring Tool your Tableau Server must be licensed with the Tableau Advanced Management. Agents will no longer collect data in the unlicensed state and send to the RMT Server. You can however, continue to see the data that was previously collected when the environment was properly licensed. To resolve this issue, license Tableau Server with Advanced Management. For more information, see [About Tableau Advanced Management on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm). **Note:** It may take up to an hour after adding a valid license to Tableau Server, for the incident to be cleared. There are other possible causes that can cause an **Agents Unlicensed** incident: - Tableau Server API credentials may not be correct. In the environment configuration page, verify that the username and password are correct and that the account used has the Server Administrator role on Tableau Server. - Unable to connect to Tableau Server REST API. Make sure that REST API is enabled on Tableau Server and that Tableau Server is running. To resolve the REST API connectivity issue, from the **Admin** menu, select **Environments**, click **Edit Environment** on the environment you want to modify, and in the **Environment Details** tab, click the **Test Connection** button in the **Tableau Server REST API** section on the right side of the page. - The RMT Server was unable to connect to Tableau Server, likely due to a network connectivity or similar issue. ## Incompatible Agent Version Agent incompatible incidents will be logged as critical when one or more Agents in the environment are on a version that is not compatible with the RMT Server version. To resolve the issue, you need to make sure that the Agent is on a version that is compatible with the current RMT Server version. Use one of the following to resolve this issue: - We recommend that the RMT Server and all Agents be on the same version. - If the Agent is on a version that is earlier than the minimum compatible version, then you must upgrade the Agent to at least the minimum compatible version that is listed in the incident report. - If the Agent is on a version that is later than the RMT Server version, we recommend that you upgrade the RMT Server to that same later version as well. You may need to upgrade other Agents depending on the version that they are currently on. ### Upgrading Agents: Use the following steps to upgrade the Agent: - 1. Copy the Agent package to the machines where you have Agents installed. Agents are installed on Tableau Server nodes that you are monitoring. The Agent should be on the same version as the RMT Server or use a version that is compatible with the RMT Server version. The incident details provides the minimum compatible version. 2. Stop the Resource Monitoring Tool Agent service on all Tableau Server nodes using the following command: `rmtadmin stop --agent` 3. Upgrade all the Agents by running the following command: **For RHEL like distributions including CentOS:** `sudo yum install /-x86_64.rpm>` `sudo /opt/tableau/tabrmt/agent/install-scripts/upgrade-rmt-agent --accepteula` **For Ubuntu and Debian distributions:** If you are upgrading from version 2020.4 to 2020.4.1 or later: `touch /tmp/tabrmt-agent-upgrading.txt && sudo apt install -amd_64.deb>` `sudo /opt/tableau/tabrmt/agent/install-scripts/upgrade-rmt-agent --accepteula` > [!IMPORTANT] > > **Note:** The touch command is only required when upgrading from 2020.4. If you do not run the touch command before installing the package, your existing version of the Resource Monitoring Tool will be uninstalled before upgrading. If you are upgrading from version 2020.4.1 to 2020.4.2 or later: `sudo apt install /-amd_64.deb>` `sudo /opt/tableau/tabrmt/agent/install-scripts/upgrade-rmt-agent --accepteula` 4. Confirm that the Agent is running and has been upgraded. You can view Agent registration status by navigating to **Admin** -> **Environments** -> **Edit the Environment** -> **servers** tab to see a full list of Tableau Server nodes and the status of the Agent. ### Upgrading RMT Server Upgrade the RMT Server if one or more Agents are on a later version. Use the following steps to upgrade RMT Server: 1. Copy the new version of the RMT Server package to the machine where RMT Server is installed. 2. Stop the Resource Monitoring Tool on the RMT server using the following command: `rmtadmin stop --master` 3. Stop the Resource Monitoring Tool Agents on all Tableau Server Nodes using the following command: `rmtadmin stop --agent` 4. Once the services have been stopped, it is best practice to check for any Resource Monitoring Tool processes that are running after the services have been stopped: Any with tabrmt-agent or tabrmt-master. This does not include PostgreSQL or RabbitMQ. You can check the status using the following command: `rmtadmin status` 5. Run the upgrade commands on the RMT Server. This will upgrade the existing version to the new version: For RHEL like distributions including CentOS: `sudo yum install /-x86_64.rpm>` `sudo /opt/tableau/tabrmt/master/install-scripts/upgrade-rmt-master --accepteula` For Ubuntu and Debian distributions: If you are upgrading from version 2020.4 to 2020.4.1 or later: `touch /tmp/tabrmt-master-upgrading.txt && sudo apt install -amd_64.deb>` `sudo /opt/tableau/tabrmt/master/install-scripts/upgrade-rmt-master --accepteula` > [!IMPORTANT] > > **Note:** The touch command is only required when upgrading from 2020.4. If you do not run the touch command before installing the package, your existing version of the Resource Monitoring Tool will be uninstalled before upgrading. If you are upgrading from version 2020.4.1 to 2020.4.2 or later: `sudo apt install /-amd_64.deb>` `sudo /opt/tableau/tabrmt/master/install-scripts/upgrade-rmt-master --accepteula` 6. Confirm that the Agent and RMT Server are running. Start the Agent and RMT Server if they do not automatically restart after the upgrade is complete. ## Agent Message Queue Credential Rotation Failure Starting in version 2021.3, as a security best practice, the credentials for connections between Agent and Rabbit MQ must be unique to that Agent. The unique credentials are created during a new installation or updated when upgrading to 2021.3. During upgrade, if there are network issues, the credential update process can fail, resulting in a critical incident report. This, however, does not interrupt the upgrade process and the upgrade process will continue. After upgrade is complete, the Resource Monitoring tool will retry daily to create the unique credentials. A critical incident report is created for the initial failure and every subsequently failed retry. During this time, Agent will continue to work using the previous credentials until new credentials have been created. The issue might resolve by itself, but if it persists, do the following: - Verify that the Agents can connect to RMT Server. - Check for firewall issues between Agent and RMT Server. ## Agent Down Agent Down incidents will be logged as warning when the Tableau Resource Monitoring Tool is unable to communicate with the Agents on Tableau Server. Use the following steps to troubleshoot this issue: 1. Make sure that the hardware that hosts the Agents is running and available to communicate with the RMT Server. 2. Make sure that the Agent service is successfully registered, and is running. You can view Agent registration status by navigating to **Admin** -> **Environments** -> **Edit the Environment** -> **servers** tab to see a full list of Tableau Server nodes and the status of the Agent. ### Agent polling and incident creation times - Agent sends a _heartbeat message_ to the Resource Monitoring Tool server every 5 minutes. - The Resource Monitoring Tool server checks to see if the most recent _heartbeat message_ from Agent is less than 15 minutes old. - If the latest _heartbeat message_ received from the Agent is less than 15 minutes old, then the Agent is considered to be online and no incident is created, and any existing **Agent Down** incidents are cleared. - If the latest _heartbeat message_ received from Agent is more than 15 minutes old, then it is considered to be the first failed attempt. Every minute thereafter, a check is done, two more times. If after three attempts (first attempt and two retries) there is still no recent heartbeat message, then an **Agent Down** incident is created. **Note:** Based on the polling interval described above, it takes about 17 (15+1+1) minutes for an **Agent down** incident to be created after the Agent is offline. ## Who can do this Resource Monitoring Tool Administrator or a Resource Monitoring Tool user with **Server/Environment Management** role. [Skip to main content](#main-content) # Allow Saved Access Tokens After you configure Tableau Server for OAuth, you can decide to allow users to manage their own OAuth credentials, or you want to manage them centrally. If you want users to manage their own, you need to enable user profile settings from the server. **Note:** If you haven’t yet configured your server to enable OAuth data connections, see the related topics listed below. **Note**: Single use refresh tokens are not supported for OAuth connections to Tableau at this time. In most cases, you can set up your identity provider (such as Okta or Redshift IDC) to use rolling refresh tokens instead. For more information, see your provider’s OAuth documentation. 1. Sign in to Tableau Server as a server administrator. 2. **Single-site**: Click Settings \> General. **Multisite**: In the site menu, click **Manage. All Sites** and then click Settings \> General. 3. In the Saved Credentials for Data Sources section, select the following: - Let users save passwords for data sources (allows users to save their individual credentials with data sources). - Let users save OAuth access tokens for data sources ![](/tableau/next/en-us/server-linux/en-us/Img/allow_saved_tokens.png) 4. Click Save. After you select these check boxes, users will see a Manage Credentials section in their profile settings, where they can add access tokens for OAuth data connections. ![](/tableau/next/en-us/server-linux/en-us/Img/allow_saved_tokens3.png) ## Managing credentials centrally Server administrators alternatively can manage OAuth credentials centrally. This can work well, for example, if multiple users work from the same data, and you have a dedicated user account for your data provider. To manage credentials centrally, you do the following: - Clear the check boxes described in the preceding procedure. - Edit connection information as data sources are published. When you edit the connection, you embed credentials that use an OAuth access token instead of an individual’s user name and password. When the settings for saving passwords and access tokens aren’t enabled, the Manage Credentials section is excluded from users’ profile settings. ## See also [Set up OAuth for Google](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_google.htm) [Change Salesforce.com OAuth to Saved Credentials](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_sfdc.htm) [Configure OAuth for Snowflake Connections on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_snowflake.htm) [Set Up OAuth for Intuit QuickBooks Online](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_qbo.htm) [Skip to main content](#main-content) # Allow Users to Save Revision History Revision history enables your users to see how workbooks and data sources (content resources) have changed over time. Each time someone saves (publishes) a content resource, Tableau Server creates a new version, which becomes the current version. It makes the previous version the most recent revision in the revision history list. Revision history gives users confidence to experiment with their content, knowing that their older versions are available. ## Notes - This information applies to Tableau Server, and is for server administrators who want to allow publishers to work with revisions. - On Tableau Cloud, workbook and data source revision history are enabled on all sites. Users can save up to 10 revisions. - For information about working with the content revisions themselves, including potential issues, see [Work with Content Revisions](https://help.tableau.com/current/pro/desktop/en-us/qs_revision_history.htm "Opens linked topic in new browser tab.") in the User/Analyst section of the Tableau help. ## Permissions users need to work with revision history To access revision history, a user must have a site role of Creator or Explorer (Can Publish), plus the following permissions, depending on the content type: - Project: View and Save - Workbooks in the project: View, Save, and Download Workbook/Save As - Flows in the project: View, Save, and Download Flow/Publish As - Data sources in the project: View, Save, and Download Data Source For virtual connections in the project, you must have a Creator site role and the View and Overwrite permissions. (Virtual connections require Data Management. See [About Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_overview.htm) for details.) ## Enable revision history and set the number of revisions allowed Revision history is set at the site level, and is enabled by default, with a limit of 25 revisions for each content resource. 1. Sign in to a site as a Server Administrator, and click Settings. 2. Under Revision History, select Save a history of revisions, and enter the maximum number of revisions you want to allow for each content resource. 3. Click Save. When you lower the number of revisions, the most recent revisions are saved. For example, if you set the limit to 15, the 15 most recent versions of the workbook or data source are saved. **Note**: A content resource’s revision history list might not show the changes to the limit until a background cleanup process runs on the server. ## Clear all revisions Server administrators can delete all previous revisions of published workbooks and data sources from a site. The most recent version of each published workbook and data source is always retained. 1. Sign in to a site as a Server Administrator, and click Settings. 2. Under Revision History, click Clear Revision History. 3. Click Save. ## Security for previewing and restoring workbooks When users select Restore or Preview for workbook revisions, user passwords are exchanged between the user’s browser and the server. Tableau Server encrypts these passwords using public/private key encryption. To ensure these public keys are provided by Tableau Server, you must configure the server to use SSL (HTTPS). For more information, see [SSL (Secure Sockets Layer)](https://help.tableau.com/v0.0/server-linux/en-us/ssl.htm). ## See also [Potential revision history issues](https://help.tableau.com/current/pro/desktop/en-us/qs_revision_history.htm#more-notes) in the User/Analyst section of the Tableau help. [Skip to main content](#main-content) # An error occurred communicating with the server (403) If Tableau Server is configured for trusted authentication, you may receive this error after opening a new view in a browser and attempting to navigate back to views you'd opened earlier. Tableau Server provides protection against unauthorized reuse of VizQL sessions through the [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm) `vizqlserver.protect_sessions`, which is set to `true` by default. Because Tableau Server is configured for trusted authentication, you might not need this level of protection. To disable this option, you can use [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm) to change `vizqlserver.protect_sessions` to `false`. Beginning in 2024.2.0, Tableau Server always prevents VizQL sessions from being reused after the original user signs out. [Skip to main content](#main-content) # Analyzed Fields in Explain Data Explain Data runs a statistical analysis on a dashboard or sheet to find marks that are outliers, or specifically on a mark you select. The analysis also considers possibly related data points from the data source that aren't represented in the current view. Explain Data might not include every column from the data source in the analysis. In many cases, certain types of fields will be automatically excluded from the analysis. For more information, see [Fields excluded by default](#DefaultExcFields). ![Explain Data view analyzed fields.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_viewfields.gif) **Note**: Dimensions with more than 500 unique values won't be considered for analysis (unless allowed by the author in Explain Data Settings). All users can view information on which fields are included or excluded in the current analysis. Creators and Explorers who have editing permissions can edit the fields used by Explain Data for statistical analysis. ## View fields analyzed by Explain Data When you expand an explanation for a measure that is contributing to the value of the mark, a link that indicates the number of fields considered in the analysis is displayed at the bottom of the Data Guide pane. ![Explain Data details with a link to view the 14 of 23 fields that are relevant to the higher sum value.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_fieldslink.png) Click the link to see the list of fields included in or excluded from the current statistical analysis. When a data source contains more than 1000 unvisualized dimensions or measures, you might see an alert asking if you want Explain Data to consider more fields. Click Explain All to run an analysis that includes more fields. The analysis may take longer to complete. #### To view fields used by Explain Data for statistical analysis 1. [Run Explain Data on dashboard, sheet, or mark](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm#RunExD). 2. In the Data Guide pane, under **Contributing to the value of**, click a measure name. ![Explain Data details about an analyzed mark, with text highlighted that describes a higher than expected trip distance sum value of 8,800.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_viewfields1.png) 3. Click the _number-of-fields_ link at the bottom of the pane. ![Explain Data details about an analyzed mark, with text highlighted that reads "12 of 23 fields".](/tableau/next/en-us/server-linux/en-us/Img/explaindata_viewfields2.png) ## Change fields used for statistical analysis Creators and Explorers who have editing permissions can select fields to be included or excluded from the statistical analysis in the Fields tab of the Explain Data Settings dialog box. ![Explain Data Settings window that provides information about the data settings, including fields and data types.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_settings.png) When a data source contains dimensions with a large number of unique values (up to 500), those fields won't be considered for analysis. #### To edit the fields used by Explain Data for statistical analysis Settings for analyzed fields are applied at the data source level. 1. Run Explain Data on a mark when editing a view. 2. In the Data Guide pane, click the settings icon at the bottom of the pane. Or, click the Edit button in the Analyzed Fields view ([how to open analyzed fields](#ViewAnalyzed)). ![Edit button on the Analyzed Fields pane.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_editfields.png) 3. In the Explain Data Settings dialog box, click the Fields tab. 4. Click a drop-down arrow next to a field name, select Automatic or Never Include, and then click OK. Note that fields must have less than 500 unique values to be included in the analysis. ![Explain Data Settings window with a measure selected and the dropdown menu expanded to reveal options for including or excluding the field.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_excludefield.png) ## Fields excluded by default

Fields excluded by default	Reasons for exclusion
All unvisualized measures when there are more than 1,000 measures in the data source. All unvisualized dimensions when there are more than 1,000 dimensions in the data source.	Computing explanations for more than 1000 unvisualized measures or dimensions can take longer to compute, sometimes several minutes. These fields are excluded by default for initial analysis, but you can choose to include them for further analysis. In this situation, you might see an alert asking if you want Explain Data to consider more fields. Click the alert link to get more information. Click Explain All to run an analysis that includes more fields.
Fields that use geometry, latitude, or longitude	Geometry, latitude, or longitude by themselves can never be explanations. It is highly likely that an explanation that calls out the latitude or the longitude as an explanation is due to a spurious correlation and not a probable explanation.
Dimensions with high cardinality (dimensions with > 500 members)	High cardinality dimensions take longer to compute. Dimensions with more than 500 unique values will not be considered for analysis.
Groups, bins, or sets	Not currently supported.
Table calculations	Table calculations cannot be analyzed when table calculations are at a different level of detail than the view.
Unvisualized measures that can't be averaged	Unvisualized measures that can't be averaged include measures that are calculated fields where the calculation expression includes aggregations (display as AGG() fields when added to the sheet).
Discrete measures and continuous dimensions	Not currently supported.
Hidden fields	Not available.
Calculated fields with errors	No values present to analyze.

[Skip to main content](#main-content) # Archived Content ## This is archived content Deployments on public clouds continue to be supported but the content for third-party public cloud deployments is no longer updated. For the latest Tableau Server deployment content, see the [Deploy](https://help.tableau.com/current/server-linux/en-us/install.htm) section of Tableau Server help. For those customers who have access, we recommend Tableau Cloud. For more details, see: - [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) - [Tableau Cloud Trial for Admin](https://help.tableau.com/current/server-linux/en-us/install.htm) - [Tableau Cloud: Get Started for Admin](https://www.tableau.com/learn/get-started/online-admin) ## Other articles in this section [Skip to main content](#main-content) # Ask Data Usage **Important changes for Ask Data and Metrics** Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience.](https://www.tableau.com/blog/tableau-pulse-and-tableau-gpt) The Ask Data Usage view is a pre-built dashboard that allows site or server admins to see and understand the usage patterns and value of Ask Data for a site. Admins can see the growth of engagement with Ask Data and monitor the results of internal training or roll-outs. The dashboard highlights the top Ask Data users, data sources, and data source owners, along with some headline value metrics. ![A dashboard illustrating Ask Data's usage and adoption, tracking the number of users, queries, and data sources over time.](/tableau/next/en-us/server-linux/en-us/Img/adminview_ask_data_usage.png) To enable Ask Data, see [Disable or Enable Ask Data for a Site](https://help.tableau.com/v0.0/server-linux/en-us/ask_data_enable.htm). ## Explore the dashboard The Ask Data Usage view provides information about Ask Data across the entire site. You can use the following metrics to understand user engagement and help drive self-service analytics adoption in your organization. ![Ask Data usage is evidenced by 22 users, 177 queries, and 930 data sources.](/tableau/next/en-us/server-linux/en-us/Img/adminview_ask_data_usage_top.png) At the top of the dashboard, three headline metrics provide an overview of Ask Data usage on the site. - Number of Users on Ask Data - This shows the total number of Ask Data users on the site. - Number of Queries on Ask Data - This shows the total number of Ask Data queries issued on the site. - Number of Data Sources Used with Ask Data - This shows the total number of data sources used with Ask Data. ![Two line graphs display the growth of distinct users and distinct data source owners over time.](/tableau/next/en-us/server-linux/en-us/Img/adminview_ask_data_usage_middle.png) In the middle of the dashboard, two line charts show you how Ask Data is used over time. - Distinct Users Over Time - This shows the distinct number of Ask Data users over time. - Distinct Data Source Owners Over Time - This shows the distinct number of data source owners over time. ![Three bar charts display the top data users, data sources, and data source owners.](/tableau/next/en-us/server-linux/en-us/Img/adminview_ask_data_usage_bottom.png) At the bottom of the dashboard, three bar charts list the top Ask Data users, data sources, and data source owners. - Top Ask Data Users - This lists the top Ask Data users and the total number of queries issued by each user. - Top Ask Data Data Sources - This lists the top Ask Data data sources and the total number of queries issued for each data source. - Top Ask Data Data Source Owners - This lists the top Ask Data data source owners and the total number of data sources owned by each user. [Skip to main content](#main-content) # ATRDiag.exe Command Line Reference You can use the ATRDiag command line utility to manage licensing issues related to the login-based license management and authorization-to-run (ATR) features. ## Synopsis `ATRDiag -dumpATR -showAll -showVerbose -product ["Tableau Desktop"]["Tableau Prep"]["Tableau Server"]` `-subProduct {subProduct} -version {version} -setVersion {version}` `-container -serverDataPath {path}` `-log [Trace][Debug][Info][Warn][Error][Fatal][Off] -status -deleteAllATRs` `-deleteInvalidATRs -deleteATR {atrIdToDelete}` `-enableATRFeature -disableATRFeature -enableLBLMFeature -disableLBLMFeature` `-requireLBLMFeature -setDuration {seconds`} **Note:** All ATRDiag options are case-insensitive. ## Options `-dumpATR` Display a valid authorization-to-run (ATR) on the command prompt (if present). Use `-version/-product/-subProduct/-version` to control which ATR is dumped if more than one is valid. `-showAll` Enumerate the contents of the registry to see available ATRs.(some of which might not be valid). `-showVerbose` Enumerate the contents of the registry and use `-version/-product/-subProduct/-version` to provide per-product. `-product ["Tableau Desktop"]["Tableau Prep"]["Tableau Server"]` Defaults to "Tableau Desktop". Must specify "Tableau Server" to display Server ATR. For example: `atrdiag -product "Tableau Server"` ![Command prompt window with attributes details.](/tableau/next/en-us/server-linux/en-us/Img/atrdiag_product_tableau_server.png) `-subProduct {subProduct}` Defaults to "Professional". `-container` Container mode, only for Tableau Server. Must specify `-product "Tableau Server"`. `-serverDataPath` The location of Server data under Container mode. Defaults to `"/var/opt/tableau/tableau_server/"`. `-version {version}` No default; a valid value for this field is "Tableau 2021.1". `-setVersion {version}` Persist a default value for -version. `-log [Trace][Debug][Info][Warn][Error][Fatal][Off]` Display ATR log information. `-status` Provide ATR feature status (enabled or disabled), the license server, and dump the ATR. `-deleteAllATRs` Remove all ATRs present on the machine. `-deleteInvalidATRs` Remove all invalid ATRs. `-deleteATR {atrIdToDelete}` Remove an ATR by ID. `-enableATRFeature` Turn on the ATR feature. Must run as an administrator. For use on Tableau Desktop only. `-disableATRFeature` Turn off the ATR feature. Must run as an administrator. For use on Tableau Desktop only. `-enableLBLMFeature` Turn on login-based license management (LBLM). Must run as an administrator. `-disableLBLMFeature` Turn off login-based license management (LBLM). Must run as an administrator. `-requireLBLMFeature` Set the login-based license management (LBLM) feature to required. Must run as an administrator. `-setDuration {seconds}` Set `ATRRequestedDurationSeconds` to seconds. Must run as an administrator. ## Global Options `-h, --help` Optional. Show the command help. [Skip to main content](#main-content) # Attempting to Redeem the Ticket from the Wrong IP Address When you’ve configured Tableau Server for trusted authentication, you may encounter issues with redeeming the ticket. This issue can occur when Tableau Server is configured to enforce client IP address matching. Because the client web browser IP address is not considered by default when redeeming the ticket, make sure that the client's web browser IP address that is sent in the POST request to Tableau Server is the same as when the browser tries to retrieve the embedded view. For example, in the Trusted Authentication diagram, if the [POST request in step 3](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth.htm) sends the parameter `client_ip=74.125.19.147`, then the [GET request in step 5](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth.htm) must come from that same IP address. For more information, see [Optional: Configure Client IP Matching](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_optional.htm) to learn how to configure Tableau Server to enforce client IP address matching. [Skip to main content](#main-content) # Audit Permissions Using the Activity Log Permission auditing allows system administrators to monitor which users have modified access controls to Tableau content. There are two ways to modify access control: _explicit_ changes (by changing permission capabilities on a project or content item) and _effective_ changes (by changing user site roles, group membership, moving content, and so on). All of these changes are recorded, so administrators can certify that security and access controls are maintained. For more information about how permission rules are evaluated, see [Effective permissions](https://help.tableau.com/v0.0/server-linux/en-us/permission_effective.htm). ## Log format Every action that modifies user or group access to content will get a log entry. Each log entry is structured in a JSON format, with specific keys representing different pieces of information. A log entry contains two parts: - Metadata: Contains information about when and where an action occurred and what user performed the action. - Action: Contains information about what piece of content had its permissions changed, what capabilities were changed, and to what values the capabilities were changed. **Note:** Activity Log records changes made through the Permissions Dialog UI and REST API. For more information about API methods, see [Permissions Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_permissions.htm). The Activity Log entries are not formatted, and the keys are not sorted in any particular order in the logs. When auditing permissions, you can combine Activity Log data with other data sources to link IDs to names and make the events easier to interpret. ### Example The following is an example log entry showing a group was allowed to connect to a data source. { "actorUserId": 39872, "actorUserLuid": "4e6b42bf-9040-4e60-b326-1c56a4fb96f8", "authorizableType": "DATASOURCE", "capabilityId": 32, "capabilityValue": "connect", "contentId": 2099835, "contentName": "Superstore ExtractNeal3", "eventTime": "2023-01-31T22:44:23.650058Z", "granteeId": 22, "granteeLuid": "dae0717a-d524-436d-b469-fadeaa22a5dd", "granteeType": "Group", "granteeValue": "GROUP\_ALLOW", "initiatingUserId": 39872, "initiatingUserLuid": "4e6b42bf-9040-4e60-b326-1c56a4fb96f8", "isError": false, "eventCategory": "security", "eventType": "set\_permissions", "eventVersion": "1.0", "permissionType": "explicit", "siteLuid": "b45e272d-10c7-49d5-9037-e53ce47dbf4e" } The log entry captures essential information regarding the event, including: - `eventType` shows a set permissions event occurred - `permissionType` shows an explicit change to permissions - `contentId` shows the ID of the content that was modified - `authorizableType` shows the content type, in this case, a data source - `capabilityValue` shows the capability that was changed - `granteeId` shows the grantee that was affected - `actorUserId` shows the ID of the user who performed the change - `eventTime` shows the date and time of the change ## Events Log entries contain various event types for permissions changes, such as `content_owner_change` when the content owner changes or `set_permissions` when a permission rule is created or updated. Different actions produce different events. For more information about event types, attributes, and when they're recorded, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/server-linux/en-us/activity_log_schema.htm). [Skip to main content](#main-content) # Authentication Authentication verifies a user's identity. Everyone who needs to access Tableau Server—whether to manage the server, or to publish, browse, or administer content—must be represented as a user in the Tableau Server repository. The method of authentication may be performed by Tableau Server (“local authentication”), or authentication may be performed by an external process. In the latter case, you must configure Tableau Server for external authentication technologies such as Kerberos, SAML, or OpenID. In all cases, whether authentication takes place locally or is external, each user identity must be represented in the Tableau Server repository. The repository manages authorization meta data for user identities. Looking for Tableau Server on Windows? See [Authentication](https://help.tableau.com/current/server/en-us/security_auth.htm "Opens topic in a new browser tab"). Although all user identities are ultimately represented and stored in the Tableau Server repository, you must manage user accounts for Tableau Server in an identity store. There are two, mutually exclusive, identity store options: LDAP and local. Tableau Server supports arbitrary LDAP directories, but it's been optimized for Active Directory LDAP implementation. Alternatively, if you are not running an LDAP directory, you can use the Tableau Server local identity store. For more information see [Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm). As shown in the following table, the type of identity store you implement, in part, will determine your authentication options.

Identity Store	Authentication Mechanism
Identity Store	Basic	SAML	Site SAML	Kerberos	(Windows only) Automatic Logon (Microsoft SSPI)	OpenID Connect	Connected Apps	Trusted Auth	Mutual SSL
Local	X	X	X			X	X	X	X
Active Directory	X	X		X	X		X	X	X
LDAP	X	X					X	X	X

Access and management permissions are implemented through site roles. Site roles define which users are administrators, and which users are content consumers and publishers on the server. For more information about administrators, site roles, groups, Guest User, and user-related administrative tasks, see [Users](https://help.tableau.com/v0.0/server-linux/en-us/users.htm) and [Site Roles for Users](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). **Note**: In the context of authentication, it’s important to understand that users are not authorized to access external data sources through Tableau Server by virtue of having an account on the server. In other words, in the default configuration, Tableau Server does not act as a proxy to external data sources. Such access requires additional configuration of the data source on Tableau Server or authentication at the data source when the user connects from Tableau Desktop. ## Add-on authentication compatibility Some authentication methods can be used together. The following table shows authentication methods that can be combined. Cells marked with an "X" indicate a compatible authentication set. Blank cells indicate incompatible authentication sets.

	Connected Apps	Trusted Authentication	Server-wide SAML	Site SAML	Kerberos	(Windows only) Automatic Logon (Microsoft SSPI)	Mutual SSL	OpenID Connect
Tableau Connected Apps	N/A		X	X	X		X	X
Trusted Authentication		N/A	X	X	X		X	X
Server-wide SAML	X	X	N/A	X
Site SAML	X	X	X	N/A
Kerberos	X	X			N/A
Automatic Logon (Microsoft SSPI)						N/A
Mutual SSL	X	X					N/A
OpenID Connect	X	X						N/A
Personal Access Token (PAT)	*	*	*	*	*	*	*	*

**\*** PATs, by design, do not work directly with the authentication mechanism listed in these columns to authenticate to the REST API. Instead, PATs use Tableau Server user account credentials to authenticate to the REST API. ## Client authentication compatibility ### Authentication handled through a user interface (UI)

Clients	Authentication Mechanism
Clients	Basic	SAML	Site SAML	Kerberos	(Windows only) Automatic Logon (Microsoft SSPI)	OpenID Connect	Connected Apps	Trusted Auth	Mutual SSL	Personal Access Token (PAT)
Tableau Desktop	X	X	X	X	X	X			X
Tableau Prep Builder	X	X	X	X	X	X			X
Tableau Mobile	X	X	X	X (iOS only *)	X **	X			X
Web Browsers	X	X	X	X	X	X	X *******	X	X

**\*** Kerberos SSO isn't supported for Android, but a fall back to user name and password is possible. For more information, see [Note 5: Android platform](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_browser.htm#note5). **\*\*** SSPI is not compatible with the Workspace ONE version of the Tableau Mobile app. **\*\*\*** In embedding workflows only. ### Authentication handled programmatically

Clients	Authentication Mechanism
Clients	Basic	SAML	Site SAML	Kerberos	(Windows only) Automatic Logon (Microsoft SSPI)	OpenID Connect	Connected Apps	Trusted Auth	Mutual SSL	Personal Access Token (PAT)
REST API	X						X			X
tabcmd 2.0	X									X
tabcmd	X

## Local authentication If the server is configured to use local authentication, then Tableau Server authenticates users. When users sign-in and enter their credentials, either through Tableau Desktop, tabcmd, API, or web client, Tableau Server verifies the credentials. To enable this scenario, you must first create an identity for each user. To create an identity, you specify a username and a password. To access or interact with content on the server, users must also be assigned a site role. User identities can be added to Tableau Server in the server UI, using [tabcmd Commands](https://help.tableau.com/v0.0/server-linux/en-us/tabcmd_cmd.htm), or using the [REST API](https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api.htm). You can also create groups in Tableau Server to help manage and assign roles to large sets of related user groups (e.g., “Marketing”). When you configure Tableau Server for local authentication, you can set password policies and account lockout on failed password attempts. See [Local Authentication](https://help.tableau.com/v0.0/server-linux/en-us/local_auth.htm). **Note:** Tableau with multi-factor (MFA) authentication is available for Tableau Cloud only. ## External authentication solutions Tableau Server can be configured to work with a number of external authentication solutions. ### Kerberos You can configure Tableau Server to use Kerberos for Active Directory. See [Kerberos](https://help.tableau.com/v0.0/server-linux/en-us/kerberos.htm). ### SAML You can configure Tableau Server to use SAML (security assertion markup language) authentication. With SAML, an external identity provider (IdP) authenticates the user's credentials, and then sends a security assertion to Tableau Server that provides information about the user's identity. For more information, see [SAML](https://help.tableau.com/v0.0/server-linux/en-us/saml.htm). ### OpenID Connect OpenID Connect (OIDC) is a standard authentication protocol that lets users sign in to an identity provider (IdP) such as Google. After they've successfully signed in to their IdP, they are automatically signed in to Tableau Server. To use OIDC on Tableau Server, the server must be configured to use the local identity store. Active Directory or LDAP identity stores are not supported with OIDC. For more information, see [OpenID Connect](https://help.tableau.com/v0.0/server-linux/en-us/openid_auth.htm). ### Mutual SSL Using mutual SSL, you can provide users of Tableau Desktop, Tableau Mobile, and other approved Tableau clients a secure, direct-access experience to Tableau Server. With mutual SSL, when a client with a valid SSL certificate connects to Tableau Server, Tableau Server confirms the existence of the client certificate and authenticates the user, based on the username in the client certificate. If the client does not have a valid SSL certificate, Tableau Server can refuse the connection. For more information, see [Configure Mutual SSL Authentication](https://help.tableau.com/v0.0/server-linux/en-us/ssl_config_mutual.htm). ### Connected apps #### Direct trust Tableau connected apps enable a seamless and secure authentication experience by facilitating an explicit trust relationship between your Tableau Server site and external applications where Tableau content is embedded. Using connected apps also enables a programmatic way to authorize access to the Tableau REST API using JSON Web Tokens (JWTs). For more information, see [Use Tableau Connected Apps for Application Integration](https://help.tableau.com/v0.0/server-linux/en-us/connected_apps.htm). #### EAS or OAuth 2.0 trust You can register an external authorization server (EAS) with Tableau Server to establish a trust relationship between your Tableau Server and an EAS using the OAuth 2.0 standard protocol. The trust relationship provides your users with single sign-on experience, through your IdP, to embedded Tableau content. In addition, registering an EAS enables a programmatic way to authorize access to the Tableau REST API using JSON Web Tokens (JWTs). For more information, see [Configure Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/v0.0/server-linux/en-us/connected_apps_eas.htm). ### Trusted authentication Trusted authentication (also referred to as "Trusted tickets") lets you set up a trusted relationship between Tableau Server and one or more web servers. When Tableau Server receives requests from a trusted web server, it assumes that the web server has already handled whatever authentication is necessary. Tableau Server receives the request with a redeemable token or ticket and presents the user with a personalized view which takes into consideration the user’s role and permissions. For more information, see [Trusted Authentication](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth.htm). ### LDAP You can also configure Tableau Server to use LDAP for user authentication. Users are authenticated by submitting their credentials to Tableau Server, which will then attempt to bind to the LDAP instance using the user credentials. If the bind works then the credentials are valid and Tableau Server grants the user a session. “Binding” is the handshake/authentication step that happens when a client tries to access an LDAP server. Tableau Server does this for itself when it makes various non-authentication related queries (such as importing users and groups). You can configure the type of bind you want Tableau Server to use when verifying user credentials. Tableau Server supports GSSAPI and simple bind. Simple bind passes credentials directly to the LDAP instance. We recommend that you configure SSL to encrypt the bind communication. Authentication in this scenario maybe be provided by the native LDAP solution, or with an external process, like SAML. For more information about planning for and configuring LDAP, see [Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm#plan) and [External Identity Store Configuration Reference](https://help.tableau.com/v0.0/server-linux/en-us/ldap_config.htm). ### SCIM System for Cross-domain Identity Management (SCIM) in Tableau Server is a standard for automating the provisioning and management of users and groups from external cloud-based identity providers (IdPs). Though SCIM is not an authentication method, it provisions users who then authenticate using the methods configured for your Tableau Server. For more information, see [SCIM](https://help.tableau.com/v0.0/server-linux/en-us/scim_config_online.htm). ## Other authentication scenarios - REST API: [Signing In and Out (Authentication)](https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api_concepts_auth.htm) **Note:** REST API does not support SAML single-sign (SSO). - Mobile device authentication: [Single sign-on for Tableau Mobile](https://help.tableau.com/current/mobile/mobile-admin/en-us/admin_mobile_sso.htm) - Certificate trust for TSM clients: [Connecting TSM clients](https://help.tableau.com/v0.0/server-linux/en-us/tsm_overview.htm#Connecti) - PAM integration for TSM administration: [TSM Authentication](https://help.tableau.com/v0.0/server-linux/en-us/tsm_overview.htm#Authenti) ## Data access and source authentication You can configure Tableau Server to support a number of different authentication protocols to various different data sources. Data connection authentication may be independent of Tableau Server authentication. For example, you may configure user authentication to Tableau Server with local authentication, while configuring OAuth or SAML authentication to specific data sources. See [Data Connection Authentication](https://help.tableau.com/v0.0/server-linux/en-us/security_data_connection_auth.htm). ## Other articles in this section [Skip to main content](#main-content) # Authorization _Authorization_ refers to how and what users can access on Tableau Server after authentication has been verified. Authorization includes: - What users are allowed to do with content hosted on Tableau Server, including projects, sites, workbooks, and views. - What users are allowed to do with the data sources that are managed by Tableau Server. - What tasks users are allowed to perform to administer Tableau Server, such as configuring server settings, runing command line tools, creating sites, and other tasks. Authorization for these actions is managed by Tableau Server and determined by a combination of the user's site role and permissions associated with specific entities such as workbooks and data sources. ## Site roles Site roles define who is an administrator. Administrators can be assigned at the site or server level. For non-admins, site roles indicate the maximum level of access a user can have on a given site, subject to permissions set on content assets. For example, if one user is assigned the Viewer site role, and another the CreatorCreator For more information about site roles, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). ## Permissions Permissions determine whether a given user is allowed or denied to perform a specific action on a specific content asset. As an administrator setting up Tableau Server, it’s important that you understand how permissions are evaluated. Understanding the Tableau permissions process will enable you to set up and configure permissions on sites, projects, and other assets so that you can control how content and data is shared, published, viewed, extracted, and imported. Four important concepts to understand about permissions in Tableau are: - **Permissions are asset-based**. Permissions are assigned to individual content assets (projects, data sources, workbooks) and are granted to users or groups. - **Permissions are implicitly denied, and non-admin users must explicitly be allowed to access content**. The process by which Tableau Server determines the “allow” or “deny” permission is explained in detail in [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#EvaluatePermRules). - **Permissions inheritance exists only in locked projects and in workbooks with tabbed views**. When content permissions are locked to the top-level project, workbooks, views, and data sources in the entire project hierarchy will use the default permissions set at the top-level project. In workbooks saved with the option Show sheets as tabs, views inside those workbooks use the workbook permissions. For more information, see [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#projectpermissions). - **In a project that is not locked, initial permissions are a one-time copy of the container item's permissions**. A data source or workbook starts with the default permissions, but authorized users can subsequently edit permissions on those assets. For more information on default permissions and projects, see [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#LockProject). Tableau Server provides a flexible permissions infrastructure that allows you to manage access to all content for countless scenarios. For more detailed information, see [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm). ## Data access and external authorization There are scenarios where Tableau Server and Desktop rely on external authorization to enable access to data. For example: - Users connecting to external data sources might require authorization that is outside the scope of Tableau Server’s authority. If users publish an external data source, Tableau Server will manage access and capabilities of that data source. But if users embed an external data source in a workbook, it’s up to the user who publishes the workbook to determine how other users who open the workbook will authenticate with the underlying data that the workbook connects to. - Running Tableau Server in an organization with Active Directory, where Tableau has been configured with a Run As user account, results in a dependency on Active Directory and NTFS for authorization. For example, if you configure Tableau Server to use the Run As account to impersonate users connecting to SQL, then object-level authorization is reliant on NTFS and Active Directory. - How users authenticate and are authorized by specific database solutions can differ. As noted, Tableau Server can be configured to provide access authorization when a data source is configured, but some databases will authorize access according to their own authentication scheme. [Skip to main content](#main-content) # Automate Licensing Tasks You can use `[tsm licenses](https://help.tableau.com/v0.0/server-linux/en-us/cli_licenses_tsm.htm)` to perform licensing tasks such as activating or deactivating a Tableau Server product key on- or off-line, and getting associated files for offline activation or deactivation. However, Tableau Server must already be deployed and configured. You can automate these licensing tasks using the [Tableau Services Manager API](http://onlinehelp.tableau.com/v0.0/api/tsm_api/en-us/index.htm). `C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\` [Skip to main content](#main-content) # Automate Refresh Tasks You can associate extract refresh tasks with schedules in Tableau Server to automate refreshing extracts. You can also automate extract refreshes using tabcmd, a command line utility that you can download for use with Tableau Server. In particular, you can use the `refreshextracts` command in combination with other commands in your own script. For example: `tabcmd login - http://mytabserver -u jsmith -p P@ssw0rd! refreshextracts --datasource salesq4` **Note:** When an extract refresh is performed on extracts created in Tableau 10.4 and earlier (that is, a .tde extract), the extract is upgraded to .hyper extract automatically. While there are many benefits of upgrading to a .hyper extract, your users won't be able open the extract with earlier versions of Tableau Desktop. For more information, see [Extract Upgrade to .hyper Format](https://help.tableau.com/v0.0/server-linux/en-us/extracting_upgrade.htm). ## Notes - The subrange is automatically converted to UTC. In environments using time zones other than UTC, configure the subrange based on UTC. For information about downloading the tabcmd utility, see [tabcmd](https://help.tableau.com/v0.0/server-linux/en-us/tabcmd.htm). [Skip to main content](#main-content) # Automatically Build Views with Ask Data **Important changes for Ask Data and Metrics** Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience.](https://www.tableau.com/blog/tableau-pulse-and-tableau-gpt) Ask Data lets you type a question in common language and instantly get a response right in Tableau. Answers come in the form of automatic data visualizations, with no need to manually drag-and-drop fields or understand the nuances of your data's structure. Ask Data lets you ask sophisticated questions naturally, with support for key analytical concepts such as time series and spatial analysis, and an understanding of conversational phrases such as "last year" and "most popular." ![Create a viz using Ask Data](/tableau/next/en-us/server-linux/en-us/Img/askdata_1.gif) ## Navigating to Ask Data lenses Before you can query a data source with Ask Data, [a Tableau author must first create a lens](https://help.tableau.com/current/pro/desktop/en-us/ask_data_lenses.htm) that specifies the subset of data fields the lens uses. In Tableau, here are all the places where you can access an Ask Data lens: - On the All Lenses page at the top level of your Tableau Cloud or Tableau Server site. ![The Ad Campaigns and Shipping Analysis lenses for Ask Data.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_all_lenses.png) - On the Ask Data tab for a data source for which lenses have been created. ![The Super Store data source page displays with three connected lense options highlighted.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_connected_lenses.png) - In an Ask Data object on a dashboard. ![A dashboard with a map, a scatterplot, and a customer ranking list.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_in_dashboard.png) ## Ask Data from a lens page or dashboard object ### Navigate to a lens and learn more about its data 1. Navigate to a lens via the All Lenses page for your Tableau site, the Ask Data tab for a data source, or an Ask Data object on a dashboard. 2. (Optional) Under Recommended Visualizations, click an entry to quickly see visualizations the lens author has created for your organization. If the recommendations don't address your current data analysis needs, [build a query](#Build) to create your own question. 3. In the Data pane at left, briefly hover over each field to learn more about the data it contains. ![Viz with Country string highlighted in the side pane and Country details shown, including the number of unique country values and a list of country names.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_tooltip.png) In a narrower dashboard object, the Data pane may be hidden, but you can see the same information by clicking the Fields drop-down menu. ![A dashboard with the Fields menu highlighted.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_dashboard_fields.png) ### Build queries by entering text 1. Type in the box reading Search fields or values to create a visualization. ![Search field for adding fields or values to a visualization.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_ask_textbox.png) 2. As you type, Ask Data searches data fields, functions, and string values and displays results in a drop-down list. Click items in the list to add them to your current entry, shown above the search box. To automatically create a viz using the current entry, press Enter at any time. ![The Ask Data UI for search, with the autofill dropdown showing](/tableau/next/en-us/server-linux/en-us/Img/ask_data_entity_search.png) Modifying a query by searching for fields and analytical functions A. Current entry B. Current filters C. Search box D. Returned fields E. Returned analytical functions F. Returned field values ### Build queries by adding suggested phrases Tableau will suggest phrases based on the most common queries asked in your lens and by others in your organization. When you open your lens, you'll notice suggestions that will help you get quick answers to common questions. You can add these suggestions to your query by clicking them. As you add phrases to your query, the suggestions dynamically update with more relevant phrases. The view automatically builds with each selection. ![Create a viz using Ask Data](/tableau/next/en-us/server-linux/en-us/Img/askdata_2.gif) ### Build queries by adding fields and filters 1. Click Add Field or Add Filter. ![The Ask Data Phrase Builder with the Add Field and Add Filter options highlighted.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_click_phrasebuilder.png) 2. Click the desired field. (To narrow down a long list, first type in the Search Fields box.) ![The Ask Data Phrase Builder with the Sales measure selected for visualization.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_click_phrasebuilder_2.png) 3. Set any sub-options, such as aggregation type for a numeric field, or grouping for string and date fields. 4. To add more fields or filters, click the plus sign. ![The Ask Data Phrase Builder with the plus icon highlighted.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_click_phrasebuilder_3.png) ### See how elements of your query are applied To see how elements of your query are applied, hover over them in the text box or the interpretation above it. Words that aren't used are grayed out, helping you rephrase your query in a way that's clearer to Ask Data. ![Ask Data mapping.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_mapping.gif) ## Rephrase your question You can rephrase questions by clicking options, data fields, and filters in the user interface. ### Change the viz type If the default viz doesn't fully reveal your data, click the menu at upper right, and choose from these supported viz types: - Bar Chart - Gantt Bar - Heat Map - Histogram - Line Chart - Map - Pie Chart - Scatter - Stacked Bar Chart - Text Table - Treemap ![A viz of a map of the United States displays average profit per city, and a dropdown menu is highlighted to show the following options for changing the viz type: map, bar chart, text table, stacked bar, heat map, and treemap.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_viz_change.png) **Note:** To automatically create certain viz types, Ask Data sometimes adds fields such as "Number of Records" to your entries. ### Change fields, filters, and displayed data Ask Data gives you several ways to fine-tune how field values are displayed. - To switch the fields used for the vertical and horizontal axes, click the Swap Axes button ![Swap Axes button.](/tableau/next/en-us/server-linux/en-us/Img/environ_swap.png) to the left of the viz selection menu: ![The swap axes icon.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_swap_axes_context.png) - To change a field, first click it in your query entry, and then click the field name below. (To change fields used in difference calculations, see [Compare differences over time](#Compare).) ![The CO2 emissions measure is highlighted.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_change_field.png) - To change a field's aggregation or grouping type (for example, from average to sum), click the field name in the text box, and then choose a different aggregation or grouping. ![Aggregation method selection options shown for sum, average, or median with average selected.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_aggtype_short.png) - For categorical filters, click values (for example, "exclude United States" in the example below) to change specific values or enter wildcard parameters. ![Ask Data filter adjustment shown with a country value excluded.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_adjust_filter.png) - To adjust a numeric range, click words such as "high" or "cheap." ![Ask Data filter adjustment shown with the profit range adjustment options.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_adjust_range.png) - To delete a field or filter, hover over it and click the X. ### Adjust date filters To adjust a date filter, click words such as "last" or "previous." Then click one of the following: - Specific Dates to enter a specific time period or date value - Relative Dates to show a date range relative to the present day - Range of Dates to enter specific start and end points Specific Dates offers some unique options in the Date Detail menu: - Time Period options show a single continuous date range - Date Value options show ranges that can repeat in multiple time periods. For example, to see combined sales performance for Q1 across multiple years, under Date Value, you would choose Quarters. ![A date filter dialog for specific dates. ](/tableau/next/en-us/server-linux/en-us/Img/ask_data_specific_date.png) ## Compare differences over time Ask Data lets you compare time periods with phrases such as "year over year" or "quarter over quarter." The results appear as difference or percent difference table calculations in workbooks you save from Ask Data. ![Line chart showing year-over-year difference in the sum of sales over order date, with year over yeard difference highlighted.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_yoy.png) In the text box, click a difference calculation to choose other fields, aggregation methods, and time periods. ![A dialog box shows options for calculating the difference in average sales over order date or ship date.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_yoy_revise.png) ## Apply simple calculations Ask Data supports simple calculations between two measures, which you can apply using these symbols: + sums the measures \- produces the difference between them \* multiplies / divides In workbooks you save from Ask Data, these calculations don't become calculated fields but instead ad hoc calculations on the Columns, Rows, or Marks shelves. ![A viz with the Ask Data calculations option highlighted showing an equation where the sum of profit is divided by the sum of sales.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_calculations.png) ## Add sheets with other vizzes To quickly create multiple different vizzes from a lens, add sheets in Ask Data. At the bottom of the web page, do any of the following: - Click the Add Sheet icon to the right of named sheets. ![Sheet tabs labeled Sheet 1 and Sheet 2, with a button to add a new sheet.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_sheets.png) - Right-click a sheet name, and choose either Duplicate or Delete. (To rename sheets from Ask Data, you need to save them in a new workbook.) ## Share Ask Data vizzes via email, Slack, or a link You can quickly share Ask Data vizzes with anyone who has access to a lens. 1. In the upper right corner of the browser, click the Share icon. ![Share icon](/tableau/next/en-us/server-linux/en-us/Img/ask_data_link.png) 2. Do either of the following: - To share the viz via email or Slack, enter specific user names in the text box. (Email and Slack integration must previously be configured by your Tableau administrator.) - To copy a URL you can paste into custom emails and other messages, click Copy Link. ## Send feedback to the lens owner If you have questions about the structure of a lens or how best to use it with Ask Data, you can send feedback directly to the author. (This option is enabled by default, but lens authors may disable it.) 1. To the left of the query box for Ask Data, click the Ask Data tips icon. ![Hovered over information icon showing the Ask Data tips tooltip.](/tableau/next/en-us/server-linux/en-us/Img/ask_data_tips_button.png) 2. At the bottom of the tips dialog, click Contact the Lens Author. ## Tips for successful queries As you structure questions for Ask Data, apply these tips to get better results. - **Use keywords** — For example, instead of "I want to see all the countries that these airports are in, try "by airport and country." - **Use exact wording for field names and values** — For example, if your lens includes Airport Code, Airport Name, and Airport Region fields, specify those by name. - **See a ranked list** — Ask Data maps terms such as "best" and "worst" to Top 1 and Bottom 1, respectively. If you want to see broader rankings, use "high" and "low" instead. For example, enter "houses with low sale prices." - **Query table calculations** — In query expressions for table calculation fields, note that you can't filter, limit, or include "year over year difference." - **Surround unusually long values with quotation marks** — To analyze long field values that contain line returns, tabs, or more than ten words, surround them with quotation marks. To improve performance, Ask Data doesn't index fields of that length, or anything beyond the first 200,000 unique field values. ## Other articles in this section [Skip to main content](#main-content) # Automatically Suspend Extract Refreshes for Inactive Workbooks and Data Sources To save resources, Tableau can automatically suspend extract refresh tasks for inactive workbooks and published data sources. This feature applies to full extract refreshes only, and only applies to refresh tasks that run more frequently than weekly. It does not apply to: - incremental extract refreshes - weekly or less frequent than weekly refresh tasks - published data sources being updated by Bridge. Server administrators can configure the length of time a workbook is inactive before extract refresh tasks are suspended. For more information see [Configure the extract refresh suspend feature](#Config_auto-suspend) below. **Note:** Support for automatic suspension of extract refreshes for data sources is available beginning in Tableau Server version 2023.3. For a workbook, if any of the following events occur, the workbook's inactivity countdown timer is reset: - Viewing the workbook sheets - Having any data-driven alert or subscription set-up on the workbook - Downloading the workbook - Moving the workbook's location or changing the owner For a published data source, any event which fetches the data from the data source will cause its inactivity countdown timer to be reset. These include: - Loading a workbook view that is connected to the data source - Visiting the data source’s Ask Data page - Tableau Desktop connecting to the data source - In web authoring, opening a workbook that uses a published data source, even without publishing the workbook - Tableau Prep flow runs (including scheduled Prep Conductor runs) that use a data source as a flow input - A Tableau Pulse metric digest or user view that is using a published data source - User-triggered "Run Now" refreshes of a data source ## Configure the extract refresh suspend feature 1. Sign in to Tableau Server as a server administrator. 2. Go to the General tab of the Settings page for the site: - If you have a single site, at the top the browser window, click Settings and General. - If you have multiple sites, select the site you want to configure and click Settings and General. 3. On the General page, do the following: - Under Automatically Suspend Extract Refresh Tasks, select the Automatically suspend extract refresh tasks for inactive workbooks and datasources check box. - Specify the number of days, from 7 through 100, that a workbook should be inactive before extract refresh tasks are suspended. The default is 32 days. - Click **Save**. ## Notifications Email notifications are sent to the owner of the workbook or data source at the following times: - Three days before the extract refresh schedule is suspended - When the extract refresh schedule is suspended ## Resume suspended extract refreshes Suspended extract refreshes won't automatically resume if someone uses the workbook. It must be done manually by a server or site administrator. To view and resume extract refreshes that were suspended: 1. Sign in to the site as an administrator and click **Tasks**. 2. Click the **Extract Refreshes** tab. 3. Select one or more items. 4. From the **Actions** menu, select **Resume**. [Skip to main content](#main-content) # AWS Key Management System Tableau Server has three Key Management System (KMS) options that allow you to enable encryption at rest. Two of these require Advanced Management capabilities, while a local one is available with all installations of Tableau Server. **Important:** As of September 16, 2024, Advanced Management is no longer available as an independent add-on option. Advanced Management capabilities are only available if you previously purchased Advanced Management, or if you purchase certain license editions: Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server). Beginning in version 2019.3, Tableau Server added these KMS options: - A local KMS that is available with all installations. For details, see [Tableau Server Key Management System](https://help.tableau.com/v0.0/server-linux/en-us/security_kms.htm). - An AWS-based KMS that comes as part of Advanced Management. This is described below. Beginning in version 2021.1, Tableau Server added another KMS option: - An Azure-based KMS that comes as part of Advanced Management. For details, see [Azure Key Vault](https://help.tableau.com/v0.0/server-linux/en-us/security_kms_azure.htm). With the release of version 2019.3, Tableau Server supports the AWS key management system (KMS) as part of Advanced Management. ## AWS KMS for encryption at rest AWS KMS is available as part of Advanced Management in Tableau Server. For more information see [About Tableau Advanced Management on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm). If your organization is deploying Data Extract Encryption at Rest, then you may optionally configure Tableau Server to use AWS as the KMS for extract encryption. To enable AWS KMS, you must deploy Tableau Server in AWS EC2. In the AWS scenario, Tableau Server uses the AWS KMS customer master key (CMK) to generate an [AWS data key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys). Tableau Server uses the AWS data key as the root master key for all encrypted extracts. However, even when configured for AWS KMS, the native Java keystore and local KMS are still used for secure storage of secrets on Tableau Server. The AWS KMS is only used to encrypt the root master key for encrypted extracts. Using AWS to encrypt the master root key provides better security properties by not storing the master key under the same permissions as the extracts. ![A diagram illustrating the various keys for data encryption.](/tableau/next/en-us/server-linux/en-us/Img/security_kms_AWS_key_hierarchy.png) The key hierarchy when Tableau Server is configured with AWS KMS ## Configure AWS KMS for Tableau Server encrypted extracts To use the AWS customer master key (CMK) to encrypt the root key in the Tableau Server KMS hierarchy, you must configure Tableau Server as described in this section. Before you begin, verify that you meet the following requirements: - Tableau Server must be deployed in AWS EC2. - Tableau Server must be configured with Advanced Management. See [About Tableau Advanced Management on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm). - You must have administrative control of a customer master key (CMK) created in AWS Key Management Service. - The user ID (often the email address) for the person configuring AWS KMS cannot be longer than 26 characters. ### Step 1: Create CMK and set key policy for Tableau Server in AWS The following procedures are performed in the AWS KMS service. References are included to AWS documentation. 1. Create the CMK that you will use for Tableau Server. See the AWS topic, [Creating Keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys). 2. Update the server instance’s IAM role. Tableau Server needs to be able to authenticate with AWS KMS using the instance’s IAM role. The role needs to have a policy attached to it. The policy should be giving the instance permissions to call the "GenerateDataKey" and "Decrypt" actions on the CMK. See [IAM Roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html).. In a multi-node deployment of Tableau Server, all nodes of the server must be running under roles that have this policy (or equivalent) attached. You can assign the same role to all nodes in the cluster. 3. At a minimum, the CMK must have a key policy where the `Effect` is set to `Allow` the `Prinicpal` (the IAM role that is attached to the server instances) the `Action`: `GenerateDataKey` and `Decrypt`. See [Using Key Policies in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html). ### Step 2: Collect AWS configuration parameters You will need the full ARN string from AWS KMS. This string is in the "General configuration" section of the AWS KMS management pages. The ARN is presented in this format: arn:aws:kms:::key/, for example, `arn:aws:kms:us-west-2:867530990073:key/1abc23de-fg45-6hij-7k89-1l0mn1234567`. You will also need to specify the AWS region, which is also included in the ARN string. In the example above, the region is `us-west-2`. The region is where your KMS instance resides. In the next step, you will need to specify a region as shown in the Region column in the [Amazon API Gateway table](https://docs.aws.amazon.com/general/latest/gr/rande.html). ### Step 3: Configure Tableau Server for AWS KMS Run the following command on Tableau Server. This command will restart the server: - `tsm security kms set-mode aws --aws-region "" --key-arn "arn:aws:kms:::key/"` The `--key-arn` option takes a direct string copy from the ARN in the "General configuration" section of the AWS KMS management pages. For example, if your AWS KMS instance is running in us-west-2 region, your account number is 867530990073, and your CMK key is 1abc23de-fg45-6hij-7k89-1l0mn1234567, then the command would be as follows: `tsm security kms set-mode aws --aws-region "us-west-2" --key-arn "arn:aws:kms:us-west-2:867530990073:key/1abc23de-fg45-6hij-7k89-1l0mn1234567"` ### Step 4: Enable encryption at rest See [Extract Encryption at Rest](https://help.tableau.com/v0.0/server-linux/en-us/security_ear.htm). ### Step 5: Validate installation 1. Run the following command: `tsm security kms status` The following information may be returned: - The ARN (ID) of the customer master key (CMK) - The region the CMK is in - The ID of the root master key (RMK) in use. The RMK is a key that is encrypted by the CMK. Tableau Server decrypts the CMK by making calls to AWS KMS. The RMK is then used to encrypt/decrypt the master extract key (MEK). The RMK can change, but there will be only one at a time. - KMS stores a collection of master extract keys (MEKs). Each MEK has: - An ID, for example, 8ddd70df-be67-4dbf-9c35-1f0aa2421521 - Either a “encrypt or decrypt key” or “decrypt-only key” status. If a key is "encrypt or decrypt", Tableau Server will encrypt new data with it. Otherwise, the key will only be used for decryption - A creation timestamp, for example, "Created at: 2019-05-29T23:46:54Z." - First transition to encrypt and decrypt: a timestamp indicating when the key became an encrypt or decrypt key. - Transition to decrypt-only: a timestamp indicating when the key transitioned to decrypt-only. 2. View logs after you encrypt and decrypt extracts: - Publish extracts to your site and then encrypt them. See [Extract Encryption at Rest](https://help.tableau.com/v0.0/server-linux/en-us/security_ear.htm). - Access the extracts with Tableau Desktop or with Web Authoring on a browser (this will decrypt the extracts for use). - Search the vizqlserver\_node log files for the `AwsKmsEncryptionEnvelopeAccessor` and `AwsKmsEncryptionEnvelope` strings. The default location of the logs are at `/var/opt/tableau/tableau_server/data/tabsvc/logs/` Log entry examples that indicate successful configuration include the following: - Decrypted the RMK with ID 1abc23de-fg45-6hij-7k89-1l0mn1234567 using the CMK with ARN arn:aws:kms:us-west-2:867530990073:key/1234567d-a6ba-451b-adf6-3179911b760f - Using RMK with ID 1abc23de-fg45-6hij-7k89-1l0mn1234567 to decrypt KMS store For publishing and extract refreshes related to KMS, search the backgrounder logs. For more information about logs, see [Tableau Server Logs and Log File Locations](https://help.tableau.com/v0.0/server-linux/en-us/logs_loc.htm). ## Troubleshoot configuration ### Multi-node misconfiguration In a multi-node setup for AWS KMS, the `tsm security kms status` command may report healthy (OK) status, even if another node in the cluster is misconfigured. The KMS status check only reports on the node where the Tableau Server Administration Controller process is running and does not report on the other nodes in the cluster. By default the Tableau Server Administration Controller process runs on the initial node in the cluster. Therefore, if another node is misconfigured such that Tableau Server is unable to access the AWS CMK, those nodes may report Error states for various services, which will fail to start. If some services fail to start after you have set KMS to the AWS mode, then run the following command to revert to local mode: `tsm security kms set-mode local`. ## Refresh AWS CMK Refreshing the AWS CMK is a task that you perform with AWS. By default, the AWS CMK will refresh once a year. See the AWS topic, [How Automatic Key Rotation Works](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works). Since the ARN and region do not change, you do not need to update the KMS configuration on Tableau Server for normal CMK refresh scenarios. After AWS CMK refreshes, you must regenerate the internal RMK and MEKs on Tableau Server. You should also re-encrypt all extracts with the new CMK: 1. Run the `[tsm security regenerate-internal-tokens](https://help.tableau.com/v0.0/server-linux/en-us/cli_security_tsm.htm#regenerate-tokens)` command to regenerate all internal keys on Tableau Server, including the RMK and MEKs used for extract encryption. 2. Run `tabcmd reencryptextracts ` to re-encrypt extracts on a given site. Run this command on every site where you are storing encrypted extracts. Depending on the number of encrypted extracts on the site, this operation could consume significant server processing load. Consider running this operation outside of business hours. See [Extract Encryption at Rest](https://help.tableau.com/v0.0/server-linux/en-us/security_ear.htm). ## Regenerate RMK and MEK on Tableau Server To regenerate the root master key and the master encryption keys on Tableau Server, run the `[tsm security regenerate-internal-tokens](https://help.tableau.com/v0.0/server-linux/en-us/cli_security_tsm.htm#regenerate-tokens)` command. ## Back up and restore with AWS KMS A server backup can be taken in AWS mode with no additional configurations or procedures. The backup contains encrypted copies of the RMK and MEKs. Decrypting the keys requires access and control of the AWS CMK. For the restore scenario, the server being restored to can be in either KMS mode, including Local. The only requirement is that the server the backup is being restored to has decrypt access to the CMK the backup itself used. Upon restore, the MEKs from the backup are imported as decrypt-only keys. The RMK is not migrated over. A new RMK is generated as part of the installation/restore process. [Skip to main content](#main-content) # Azure Key Vault Tableau Server has three Key Management System (KMS) options that allow you to enable encryption at rest. Two of these require Advanced Management capabilities, while a local one is available with all installations of Tableau Server. **Important:** As of September 16, 2024, Advanced Management is no longer available as an independent add-on option. Advanced Management capabilities are only available if you previously purchased Advanced Management, or if you purchase certain license editions: Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server). Beginning in version 2019.3, Tableau Server added these KMS options: - A local KMS that is available with all installations. For details, see [Tableau Server Key Management System](https://help.tableau.com/v0.0/server-linux/en-us/security_kms.htm). - An AWS-based KMS that comes as part of Advanced Management. For details, see [AWS Key Management System](https://help.tableau.com/v0.0/server-linux/en-us/security_kms_aws.htm). Beginning in version 2021.1, Tableau Server added another KMS option: - An Azure-based KMS that comes as part of Advanced Management. This is described below. ## Azure Key Vault for encryption at rest Azure Key Vault is available as part of Advanced Management in Tableau Server beginning in version 2021.1.0. For more information see [About Tableau Advanced Management on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm). If your organization is deploying Data Extract Encryption at Rest, then you may optionally configure Tableau Server to use Azure Key Vault as the KMS for extract encryption. To enable Azure Key Vault, you must deploy Tableau Server in Azure. In the Azure scenario, Tableau Server uses the Azure Key Vault to encrypt the root master key (RMK) for all encrypted extracts. However, even when configured for Azure Key Vault, the Tableau Server native Java keystore and local KMS are still used for secure storage of secrets on Tableau Server. The Azure Key Vault is only used to encrypt the root master key for encrypted extracts. ![A diagram illustrating the various keys for data encryption.](/tableau/next/en-us/server-linux/en-us/Img/security_kms_azure_hierarchy.png) The key hierarchy when Tableau Server is configured with Azure Key Vault ## Configure Azure Key Vault for Tableau Server encrypted extracts To use the Azure Key Vault to encrypt the root key in the Tableau Server KMS hierarchy, you must configure Tableau Server as described in this section. Before you begin, verify that you meet the following requirements: - Tableau Server must be deployed in Azure. - Tableau Server must be configured with a Advanced Management license. See [About Tableau Advanced Management on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm). - You must have administrative control over the key vault in Azure where the key resides. ### Step 1: Create a key vault and key for Tableau Server in Azure The following procedures are performed in the Azure Key Vault service. References are included to Azure documentation. 1. Create the key vault that you will use for Tableau Server. See the Azure topic, [Create a key vault](https://docs.microsoft.com/en-us/azure-stack/user/azure-stack-key-vault-manage-portal?view=azs-2008#create-a-key-vault). 2. Create a key in the vault. See the Azure topic, [Manage keys and secrets](https://docs.microsoft.com/en-us/azure-stack/user/azure-stack-key-vault-manage-portal?view=azs-2008). The key must be an asymmetric, RSA type, but can be any size (Tableau Server does not care about the key size). We recommend you use the Principle of Least Privilege to have maximum security. Tableau requires permissions to perform the GET, UNWRAP KEY, and WRAP KEY commands operations and we recommend you allow access for only these operations for least privilege. Assign the access policy to the VM you are running Tableau Server on. In a multi-node deployment of Tableau Server, the access policy must be assigned to all nodes of the server cluster. ### Step 2: Collect Azure configuration parameters You will need the key vault name and the key name from Azure. ### Step 3: Configure Tableau Server for Azure Key Vault Run the following command on Tableau Server. This command will restart the server: - ``` tsm security kms set-mode azure --vault-name "" --key-name "" ``` The `--vault-name` and `--key-name` options a direct string copies from your Azure key vault. For example, if your Azure key vault is named `tabsrv-keyvault` and your key is `tabsrv-sandbox-key01`, then the command would be as follows: `tsm security kms set-mode azure --vault-name "tabsrv-keyvault" --key-name "tabsrv-sandbox-key01"` ### Step 4: Enable encryption at rest See [Extract Encryption at Rest](security_ear.htm). ### Step 5: Validate installation 1. Run the following command: `[tsm security kms status](cli_security_tsm.htm#kms-status)` The following information may be returned: - Status: OK (indicates the Key Vault is accessible by the controller node): - Mode: Azure Key Vault - Vault name: - Azure Key Vault key name: - List of available UUIDs for MEKs indicating which key is active - Error information if the KMS data is not accessible 2. View logs after you encrypt and decrypt extracts: - Publish extracts to your site and then encrypt them. See [Extract Encryption at Rest](security_ear.htm). - Access the extracts with Tableau Desktop or with Web Authoring on a browser (this will decrypt the extracts for use). - Search the vizqlserver\_node log files for the `AzureKeyVaultEnvelopeAccessor` and `AzureKeyVaultEnvelope` strings. The default location of the logs are at `/var/opt/tableau/tableau_server/data/tabsvc/logs/` For publishing and extract refreshes related to the Azure Key Vault, search the backgrounder logs. For more information about logs, see [Tableau Server Logs and Log File Locations](logs_loc.htm). ## Troubleshoot configuration ### Multi-node misconfiguration In a multi-node setup for Azure Key Vault, the `tsm security kms status` command may report healthy (OK) status, even if another node in the cluster is misconfigured. The KMS status check only reports on the node where the Tableau Server Administration Controller process is running. It does not report on the other nodes in the cluster. By default the Tableau Server Administration Controller process runs on the initial node in the cluster. Therefore, if another node is misconfigured so that Tableau Server is unable to access the Azure key, those nodes may report Error states for various services, which will fail to start. If some services fail to start after you have set KMS to the "azure" mode, then run the following command to revert to local mode: `tsm security kms set-mode local`. ## Refresh Azure Key You refresh the Azure key in Azure. There is no required or scheduled key refresh period. You can refresh your key by creating a new key version in Azure. Because the Key Vault name and Key Name do not change, you do not need to update the KMS configuration on Tableau Server for normal Azure Key refresh scenarios. ## Back up and restore with Azure Key Vault A server backup can be taken in Azure Key Vault mode with no additional configurations or procedures. The backup contains encrypted copies of the RMK and MEKs. Decrypting the keys requires access and control of the Azure Key Vault. For the restore scenario, the server being restored to can be in either Azure Key Vault or Local KMS mode. The only requirement is that the server to which the backup is being restored has access to the Azure Key Vault the backup itself used. [Skip to main content](#main-content) # Back up Tableau Server Data Regularly backing up Tableau Server is an important step in proper administration and maintenance of your server. You can use the `tsm maintenance restore` command to restore Tableau Server backups created using the `tsm maintenance backup` command. Database backups made in other ways, and virtual machine snapshots are not valid sources for restoring Tableau Server, so it is critical that you have an up-to-date backup. You can only restore from a backup that has the same type of identity store as the running server. For example, a backup from a server using local authentication can be restored to a Tableau Server initialized with local authentication, but a backup from a server using Active Directory authentication cannot be restored to a server initialized with local authentication. Looking for Tableau Server on Windows? See [Back Up Tableau Server Data](https://help.tableau.com/current/server/en-us/db_backup.htm "Opens topic in a new browser tab"). Tableau Server data includes data extract files, as well as the Tableau PostgreSQL database, which contains workbook and user metadata, and configuration data. When you use TSM to create a backup, all of this data is saved in a single file with a .tsbak extension. If you are running a distributed installation of Tableau Server data from all the nodes is backed up. The frequency of your backups depends on your environment, including how much use your server gets and how much and frequently the content and users change. Any changes or updates that happen after your backup will be lost if there is a system failure and you need to restore Tableau Server. The more activity there is, the more often you need to back the server up. In addition to regularly scheduled backups, you should _always_ create a backup before upgrading to a new version of Tableau Server. The upgrade process does not create a backup except when the version of PostGRES is being updated, and then the upgrade process creates a PostGRES-only backup to be used internally. To help protect against data loss, after you create the backup, you should store the .tsbak file on a computer that is not a part of your Tableau Server installation. ## Disk Space Usage for Backup The free disk space required to create a backup varies depending on the amount of data in the Tableau Server repository and file store services, and their collocation with the tabadmincontroller service. During backups, the background tasks for cleaning up old extracts are temporarily paused. This means that, for the duration of the backup, extract refreshes will leave extra files in place, adding to disk space usage. If your backup takes a long time, or if your organization uses many extracts that are regularly updated, this can result in a significant amount of temporary disk space usage. These temporary files will be removed after the backup is complete. The following table lists the disk space requirements for backup based on whether the node hosts the repository, file store, controller, or some combination of them. In multi-node Tableau Server environments you need to estimate the required disk space on each node.

Repository	File Store	Controller	Disk Space Required
			3x repository data + 250 MB To obtain an estimate of the repository data, check the size of `<data directory>/pgsql/data/base` directory. To obtain the exact size of the repository data, open the backup file and use the size of the workgroup.pg_dump file.
			1.5x file store data To obtain an estimate of file store data (extracts, flows, etc.), check the size of `<data directory>/dataengine` directory.
			3x repository data + 250 MB + 2.5x file store data
			3x repository data + 250 MB + 1.5x file store data
			3x repository data + 250 MB + 1.5x file store data
			3x repository data + 250 MB + 2.5x file store data
			3x repository data + 250 MB + 1.5x file store data

## Optimizing Tableau Server Backup There are several ways you can maximize backup efficiency. Your environment can impact how effective each of these is, so test with your data to see what works best. **Optimizing with topology configurations:** - Co-locating File Store on the same node as the Administration Controller can reduce the length of time it takes to back up Tableau Server by reducing or eliminating the need to transfer data between nodes during the backup process. This is especially true if your organization uses many extracts. - Co-locating the repository (pgsql) with the Administration Controller node can also help to reduce back up time, but the time savings is less significant than that of the File Store. The Administration Controller is usually on the initial node, unless you have had an initial node failure and moved the controller to another node. Optimizing with backup strategies: Backup is a resource intensive process. If possible, doing your backups during off peak hours is a generally a good strategy. But this however, depends on your requirements and how often Tableau Server data is updated and what your restore requirements. For a detailed explanation of backup and disaster recovery, see [Tableau Server Disaster Recovery](https://www.tableau.com/sites/default/files/whitepapers/disaster_recovery_whitepaper_0.pdf). Here are some backup strategies and adopt them to your requirements - **Type of storage:** Solid State disks are recommended in general for backups. SSD helps make your backups faster and complete sooner compared to traditional spinning disks. - **Backup compression:** You have the option of running your backups with or without compression. When you do your backup with compressions, your backup size will be comparatively smaller, but you may see a slower performance. So if your goal is more focused on speed, choose the `--skip-compression` option: Use the `--skip-compression` option when backing up Tableau Server. This creates the backup without using compression, and results in a larger backup file but can reduce the amount of time it takes for the backup to complete. For more information, see [tsm maintenance backup](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#tsm). - **Snapshot backup:** This option is only available if you have configured your Tableau Server with External File Store. Although the performance of snapshot backups depend on the type of network attached storage, in general snapshot backups are faster than the traditional Tableau Server backups. For more information see, [Tableau Server External File Store](https://help.tableau.com/v0.0/server-linux/en-us/server_external_filestore_storage.htm). ## Create a backup using the TSM command line interface (CLI) Use the `tsm maintenance backup` command to create a backup of the data managed by Tableau Server. This data includes data extract files and the Tableau PostgreSQL database, which contains workbook and user metadata. **Important:** Do not use the `pg-only` option when generating a backup unless instructed by Tableau Support. This option will only back up the repository and _cannot_ be used to restore your Server. Its primary use is for troubleshooting, and Tableau Support will ask you to create a `--pg-only` back up if this is necessary. **Note:** When backing up Tableau Server on Linux to a network location, the unprivileged user must have write access to the network share where the backup files are written or the backup will fail. To back up server configuration data, use the [tsm settings](https://help.tableau.com/v0.0/server-linux/en-us/cli_settings_tsm.htm) command. When you use the `tsm maintenance backup` command, the current date is appended to the backup file: `tsm maintenance backup -f -d` For more information, see [tsm maintenance backup](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#tsm). ## Create a pre-upgrade backup You should always create a backup before upgrading Tableau Server. You can create a backup while Tableau Server is running and minimize the amount of time the server is unavailable during upgrade. The process for creating a pre-upgrade backup is the same as for creating regular backups, with one additional consideration for distributed installations. **Note:** Uninstall Tableau Server from any nodes that you are not including in your new installation to avoid conflicts between the older nodes and the new installation. ## Backups during upgrades During a Tableau Server upgrade, when necessary, a temporary backup of the database may be created to allow for migrations that occur as part of upgrades. This is done during the upgrade and in most cases has no noticeable impact to the upgrade process. In certain special cases there can be additional impacts: - Upgrades to Tableau Server 2022.1 (or later) from version 2021.4 (or earlier)—If you perform Blue/Green upgrades or manually upgrade Tableau Server 2021.4 (or earlier) using the [tsm maintenance (backup and restore)](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm) method, you must enable `legacy-identity-mode` before you can restore to Tableau Server 2022.1 (or later). For more information, see [Troubleshoot Issues with the Identity Migration](https://help.tableau.com/v0.0/server-linux/en-us/identity_migration_troubleshoot.htm). - Major version pgsql updates—If an upgrade includes a major version update to the database used for the Tableau repository, the internal upgrade backup is done without compression to save time. This requires additional temporary disk space during the upgrade process. Tableau Server versions that include a major version database update; 2020.4. ## Scheduling and Managing Backups Beginning in 2020.4.0 you can use tsm commands to schedule a backup. You need to do this from the command line (there is no TSM UI to schedule backups). The `[tsm maintenance backup](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#tsm)` command allows you to create and update backup schedules. The `[tsm schedules](https://help.tableau.com/v0.0/server-linux/en-us/cli_schedules_tsm.htm)` commands give you the ability to view, delete, pause, resume, and update schedules. ### To schedule a backup: 1. Open a command prompt as administrator on the initial node (the node where TSM is installed). 2. Run the following command: tsm maintenance backup -f -sr -st -sd -sn For example, to create a backup schedule named "monthly-backup" that runs on the 15th of each month at 2 am and generates a file called `-ts-mid_month_backup.tsbak`: tsm maintenance backup -f ts-mid\_month\_backup -sr monthly -st 02:00 -sd 15 -sn monthly-backup ### To view a scheduled backup: 1. Open a command prompt as administrator on the initial node (the node where TSM is installed). 2. Run the following command: tsm schedules list You can sort the schedules by scheduled run time, earliest to latest, or by name using the `--next-run` or `--schedule-name` options. You can alternately display details for a single schedule using the `--schedule-id` option. When you view a single schedule you see additional details about it, including when i twas created, how many times it has run, and specific options used when it is run. Job options are shown in JSON format as "Job args". ### To update a scheduled backup: 1. Open a command prompt as administrator on the initial node (the node where TSM is installed). 2. Run the following command: tsm schedules update --schedule-id --schedule-time --schedule-recurrence --schedule-days **Note:** To add or change a name, use the `tsm-maintenance-backup` command. ### To suspend or resume a backup schedule: 1. Open a command prompt as administrator on the initial node (the node where TSM is installed). 2. Run one of the following commands: - To suspend a schedule: tsm schedules suspend --schedule-id - To resume a suspended schedule: tsm schedules resume --schedule-id ## Script the backup process If you back up often, you might want to create a script that performs the backup and related tasks for you. These tasks include: - Clean up files and folders before running the backup. - Running the backup itself. - Copying the backup file to a separate computer for safekeeping. This section discusses `tsm` commands you can use together to perform a backup and related tasks. ### Remove log files and clear temporary folders You can clean old Tableau Server log file and temporary files to reduce the time it takes to create a backup, and to ensure the backup file is as small as possible. To clean log files older than a few days, run the following command: `[tsm maintenance cleanup](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#cleanup)` ### Run the backup **Note:** When backing up Tableau Server on Linux to a network location, the unprivileged user must have write access to the network share where the backup files are written or the backup will fail. To create the backup, use the `[tsm maintenance backup](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#tsm)` command: `tsm maintenance backup --file --append-date` Note the following about the command: - Add `--append-date` to the command to include the date in the backup file name. - The backup file is assembled in a temporary location in the data directory and then written to the directory defined in the TSM `basefilepath.backuprestore` variable: `` `/var/opt/tableau/tableau_server/data/tabsvc/files/backups/` ```.tsbak` For more information about where backup files are written, and how to change that location, see [tsm File Paths](https://help.tableau.com/v0.0/server-linux/en-us/cli_default_filepaths_tsm.htm). **Note:** Even when you change the backup location, the backup process uses a temporary location in the data directory to assemble the backup file. ### Copy the backup file to another computer As a best practice, after the backup is created, copy the backup file to another location that is separate from Tableau Server. [Skip to main content](#main-content) # Background Task Delay **Note:** This view is only available to server administrators. To access server views on multi-site deployments, click the site menu and select **Manage All Sites**. For information about how to navigate to administrative views, see [Administrative Views](https://help.tableau.com/v0.0/server-linux/en-us/adminview.htm) . The Background Task Delay view displays the delay for flow tasks, extract refresh tasks and for subscription tasks—that is, the amount of time between when they are scheduled to run and when they actually run. You can use the view to help you identify places you can improve server performance by distributing your task schedules and by optimizing tasks. ![A scatter plot visually represents the wait time for extracts and subscriptions across five days.](/tableau/next/en-us/server-linux/en-us/Img/adminview_background_task_delay.png) Here are possible reasons for the delays, and ways that you might reduce the delays: - Many tasks are scheduled for the same time. In the example view, tasks that show long delays are clustered at the same time every day, which creates spikes in the wait time. Note that you can set the Timeline filter to a single day to view task delays by hour and identify the hours of the day which have many tasks scheduled at the same time. A solution to this issue can be to distribute the tasks to off-peak hours to reduce load on the server. - Specific tasks take a long time to run and are preventing other tasks from running. For example, there might be an extract refresh job that is connecting to a slow data source or that is processing a large amount of data. Use the Background Tasks for Extracts administrative view to identify which extract refresh tasks are running slowly. You can then optimize the extract refresh task by filtering the data, aggregating the data, or creating multiple data sources for individual tables in a data source. - Other server processes are running at the same time and are consuming server resources and slowing down performance. Monitor the CPU and memory usage of server processes to see which processes are consuming the most resources and then adjust the configuration of processes on your server. [Skip to main content](#main-content) # Background Tasks for Extracts The Background Tasks for Extracts view displays extract-specific tasks that run on the server. ![The time-series graph displays the number of extracts run on the server over the past seven days, while the bar chart illustrates the daily count of successful and failed extracts.](/tableau/next/en-us/server-linux/en-us/Img/adminview_extract.png) ## Understand this view To better understand this pre-built admininstrative view, make note of the following: - The table, "What Extracts Ran on this Server," lists the extracts that ran in the time period specified in Timeline. - You can click Success or Error to filter the table based on status. - You can also click a specific task to update the "How Much Time did Extracts Take" graph for the selected task. - The table, "How Many Extracts Succeeded or Failed," updates for the status (success or failure) of the task, but the count of extracts that succeeded or failed does not change. ### Status Tasks can have a status of success or error.

Icon	Description
	Error—Server was unable to complete the task.
	Success—Server completed the task.

### See details about a task For details on about the task, use your mouse to hover over the success or error icon. ![Information on the data extract status.](/tableau/next/en-us/server-linux/en-us/Img/adminview_extract_details.png) [Skip to main content](#main-content) # Background Tasks for Non Extracts The Background Tasks for Non Extracts view displays tasks that the server runs that are not related to extract refreshes. For example, edited OAuth connections, subscription notifications, and so on. ![A time-series chart displays the tally of accomplished and aborted background tasks within the past 24 hours, while a comprehensive table itemizes each task and its frequency of execution.](/tableau/next/en-us/server-linux/en-us/Img/adminview_nonextract.png) A table lists the tasks that ran in the time range specified. Click Success or Error to filter the table based on status. Select a specific task in the How Many Tasks Succeeded or Failed on this Site table to update the What Background Tasks Ran on this Site graph for the selected task. Tasks can have a status of success or error. For details about the task, use your mouse to hover over the success or error icon.

Icon	Description
	Error—Server was unable to complete the task.
	Success—Server completed the task.

Details that you can see about the task are its ID, status, priority, when it was created, started and completed. You can also see its runtime: the total run time of the background job, which includes the run time of the job plus background job overhead such as initialization and cleanup. You can also see which backgrounder the job is running on. ## Other articles in this section [Skip to main content](#main-content) # Backgrounder Dashboard The **Backgrounder Dashboard** view is an overview of the background jobs. Using this view, you can find more information about: - The time it takes for jobs to run. - When backgrounder is busy or overloaded. - Jobs that completed successfully, failed, or canceled. Note: This view does not include flow run jobs. > [!IMPORTANT] > > In previous versions of Tableau Server, admin views were all displayed in the same workbook, in separate tabs. However, the two new admin views are displayed as separate workbooks and not part of the existing admin view workbook. You can navigate to the new admin views from the Server or Site Status page: > ![Site status page on Tableau Cloud with a list of site status options including backgrounder dashboard, stats for unused content, and login-based license usage.](/tableau/next/en-us/server-linux/en-us/Img/new-admin-views-nav.png) ## Summary and Filters ![A dashboard includes a time-series line chart of the duration of each backgrounder job over the past 31 days, complemented by a second chart displaying a histogram of total job run times.](/tableau/next/en-us/server-linux/en-us/Img/admin-view-backgrounder-dashboard.png) **A** - At the top, is a summary chart that tells you the number of jobs that have succeeded, failed or canceled. You can click on the sections of the bar chart to filter the information by job status. This filter is applied to the entire view and the information displayed includes only jobs with the job status that you selected. **B** - You can find additional filter options by clicking on the filter icon. A Filter pane is displayed that allows you to filter by **Task type**, **Job executed at**, **Site**, **Project**, **Content owner**, **Schedule**, and **Backgrounder ID** . The Backgrounder ID is unique to a Backgrounder process. You can use this to see the information about the work done by each Backgrounder process. When you select one or more of these filters, they are applied to the entire view. ![A Dashbord Filters dialog box.](/tableau/next/en-us/server-linux/en-us/Img/admin-view-backgrounder-dashboard-filters.png) ## Details The Backgrounder Dashboard has four sections each showing different information about jobs. Each of these sections have more filters in the drop down menu that you can apply to that specific section. 1. **The section at the top left** gives you information about the jobs with the selected job status or any filters you selected using the Filter pane. If no selection is made, all jobs are included. The information displayed also varies based on the selection you make using the drop down: 1. **Total run time** : This shows you the total run time for all jobs with the selected job status, and any other filters you selected. For example, if you selected, Job Status: Failed, and Task type : Subscriptions, the graph shows all subscription jobs that failed. 2. **Number of Jobs**: This shows you the number of jobs that ran for the selected job status and any other selected filters. 3. **Maximum delay**: This shows you the how long the jobs were queued before running. ![A line chart that displays the maximum delay of jobs over time.](/tableau/next/en-us/server-linux/en-us/Img/admin-view-backgrounder-dashboard-top-left-section.png) 2. **The section at the top right** gives you information on how busy or overloaded the Backgrounder is on a given day and time. The information displayed however depends on the filter selections you made for the job status and other options in the Filter pane. ![A heatmap that visually represents the time each job takes to run throughout the week.](/tableau/next/en-us/server-linux/en-us/Img/admin-view-backgrounder-dashboard-top-right-section.png) If you click on the information icon at the top right part of this section it, a color legend is displayed. - The variations in the blue color correlates to the number of jobs running in that time period. The darker the blue, the more jobs that are running. - The variations in the orange color correlates to the queue times . The darker the orange, the longer the queue time. - Using both of these metrics, you can identify when the backgrounder is busy (dark blue) or is overloaded (dark orange). ![A two-variable color map that illustrates the correlation between queue times and running background jobs.](/tableau/next/en-us/server-linux/en-us/Img/admin-view-backgrounder-dashboard-info-map.png) 3. **The section at the bottom left** gives you run time information about the jobs with the selected status or any other filters you selected using the Filter pane. If no selection is made, all jobs are included. Select marks in the top sections to populate this section with details for the selected content. ![Bar chart with total run time for each job by title.](/tableau/next/en-us/server-linux/en-us/Img/admin-view-backgrounder-dashboard-bottom-left-section.png) The drop down selections gives you more options and the information displayed changes accordingly: - When **Title** is selected, the run time information for each individual job is displayed. - When **Project** is selected, the total run time for each project is displayed. - When **Job Creator** is selected, the total run time for jobs created by a specific user is displayed. - When **Site** is selected, the total run time for jobs on that specific site is displayed. - When **Schedule** is selected, the total run time for jobs using that specific schedule is displayed. 4. **The section at the bottom right** tells you how long it took for each job to run. ![A box plot showing the distribution of job duration per job.](/tableau/next/en-us/server-linux/en-us/Img/admin-view-backgrounder-dashboard-botton-right-section.png) [Skip to main content](#main-content) # Backup and Restore A Tableau Server administrator should perform regular database maintenance, monitor disk usage on the server, clean up unnecessary files to free up space on the server, and back up Tableau Server and its data. Taking these steps can help ensure that Tableau Server runs with maximum efficiency. You can use the Tableau Services Manager (TSM) command line tool to back up and restore your Tableau data. Tableau data includes data extract files, as well as Tableau Server's own PostgreSQL database, which stores workbook and user metadata, and server configuration data. Tableau Server log files capture activity and can help you diagnose problems. Logs are written to folders on the server and you can archive and remove them to save disk space. **Note**: You can use the `tsm maintenance restore` command to restore Tableau Server backups created using `tabadmin backup` and `tsm maintenance backup`. Database backups made in other ways, and virtual machine snapshots are not valid sources for restoring Tableau Server. You can only restore from a backup that has the same type of identity store as the running server. For example, a backup from a server using local authentication can be restored to a Tableau Server initialized with local authentication, but a backup from a server using Active Directory authentication cannot be restored to a server initialized with local authentication. ## Platform compatibility - You can use a backup created with Tableau Server on Linux to restore Tableau Server on Windows. - You can use a backup created with Tableau Server on Windows to restore Tableau Server on Linux. For more information about restoring a Windows backup on Tableau Server on Linux, see [Migrate Tableau Server from Windows to Linux](https://help.tableau.com/current/server-linux/en-us/restore_from_backup_linux.htm). - You can use a backup created with Tableau Server on Linux to restore Tableau Server on Linux running a different Linux operating system. ## Disk Space Usage for Backup and Restore The free disk space required to create a backup varies depending on the amount of data in the Tableau Server repository and file store services, and their collocation with the tabadmincontroller service. During backups, the background tasks for cleaning up old extracts are temporarily paused. This means that, for the duration of the backup, extract refreshes will leave extra files in place, adding to disk space usage. If your backup takes a long time, or if your organization uses many extracts that are regularly updated, this can result in a significant amount of temporary disk space usage. These temporary files will be removed after the backup is complete. The following table lists the disk space requirements for backup based on whether the node hosts the repository, file store, controller, or some combination of them. In multi-node Tableau Server environments you need to estimate the required disk space on each node.

Repository	File Store	Controller	Disk Space Required
			3x repository data + 250 MB To obtain an estimate of the repository data, check the size of `<data directory>/pgsql/data/base` directory. To obtain the exact size of the repository data, open the backup file and use the size of the workgroup.pg_dump file.
			1.5x file store data To obtain an estimate of file store data (extracts, flows, etc.), check the size of `<data directory>/dataengine` directory.
			3x repository data + 250 MB + 2.5x file store data
			3x repository data + 250 MB + 1.5x file store data
			3x repository data + 250 MB + 1.5x file store data
			3x repository data + 250 MB + 2.5x file store data
			3x repository data + 250 MB + 1.5x file store data

#### Restore disk space requirements You must have adequate disk space for the database restore process to run successfully. To restore Tableau Server: - On controller nodes, you need free space equal to at least the size of the backup archive. - On repository nodes, you need free space equal to at least three times the size of the repository data in the backup archive, plus 250 MB, plus the size of the pgsql data directory. - On file store nodes, you need free space equal to at least twice the size of the dataengine folder in the backup archive. ## Best Practices for Backing Up Tableau Server We recommend following these security and performance best practices. ### Protect backup file While configuration secrets are encrypted when stored on disk internally, when these configurations are exported to a backup file, some secrets are written into the file in plain text. It is up to the administrator to take measures to protect the backup file. There are a variety of options available: - Write the file to an encrypted file system. - Write the file to a disk that is physically protected and restricted to specific users. - Encrypt the backup file. ### Maximize backup efficiency There are several ways you can maximize backup efficiency. Your environment can impact how effective each of these is, so test with your data to see what works best. **Optimizing with topology configurations:** - Co-locating File Store on the same node as the Administration Controller can reduce the length of time it takes to back up Tableau Server by reducing or eliminating the need to transfer data between nodes during the backup process. This is especially true if your organization uses many extracts. - Co-locating the repository (pgsql) with the Administration Controller node can also help to reduce back up time, but the time savings is less significant than that of the File Store. The Administration Controller is usually on the initial node, unless you have had an initial node failure and moved the controller to another node. Optimizing with backup strategies: Backup is a resource intensive process. If possible, doing your backups during off peak hours is a generally a good strategy. But this however, depends on your requirements and how often Tableau Server data is updated and what your restore requirements. For a detailed explanation of backup and disaster recovery, see [Tableau Server Disaster Recovery](https://www.tableau.com/sites/default/files/whitepapers/disaster_recovery_whitepaper_0.pdf). Here are some backup strategies and adopt them to your requirements - **Type of storage:** Solid State disks are recommended in general for backups. SSD helps make your backups faster and complete sooner compared to traditional spinning disks. - **Backup compression:** You have the option of running your backups with or without compression. When you do your backup with compressions, your backup size will be comparatively smaller, but you may see a slower performance. So if your goal is more focused on speed, choose the `--skip-compression` option: Use the `--skip-compression` option when backing up Tableau Server. This creates the backup without using compression, and results in a larger backup file but can reduce the amount of time it takes for the backup to complete. For more information, see [tsm maintenance backup](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#tsm). - **Snapshot backup:** This option is only available if you have configured your Tableau Server with External File Store. Although the performance of snapshot backups depend on the type of network attached storage, in general snapshot backups are faster than the traditional Tableau Server backups. For more information see, [Tableau Server External File Store](https://help.tableau.com/v0.0/server-linux/en-us/server_external_filestore_storage.htm). ## Other articles in this section [Skip to main content](#main-content) # Backup and Restore with External File Store When you have External File Store enabled on your Tableau Server, you cannot use the `tsm maintenance backup` command to do a backup of the Tableau Server repository and File Store Data. Instead, use a "snapshot" backup process to create a point in time snapshot of your network share. - [Tableau Server configured with External File Store](#external-file-store) - [Tableau Server configured with External File Store and External Repository](#external-file-store-external-repo) ### Backup strategies: The backup strategy you use depends on your recovery plan. The snapshot backup process may not be sufficient by itself as it only creates a backup of the File Store (and repository data if requested), and there are other configurations and settings that you may need in order to do a full recovery. **Important:** We strongly recommend disabling scheduled tasks before you perform an upgrade. This includes all updates to data content and should be done before you create your pre-upgrade backup. This may involve disabling jobs that are triggered outside of Tableau Server, such as those initiated through REST API-based extract refreshes or using tabcmd. Here are some scenarios that illustrate when the snapshot backup process may or may not be enough: - **Standby Tableau Server**—If you maintain a standby Tableau Server to use if your production Server is down, creating a snapshot backup and restoring it to your standby server on a regular schedule may be sufficient. Your backup schedule should be based on your recovery point objective. - **New Tableau Server, existing configuration not needed**—If you plan to use a new Tableau Server installation in case of a disaster, but don’t necessarily need to use the configurations and settings from your existing Tableau Server installation you can install a fresh instance of Tableau Server and use the snapshot to restore your data. - **New Tableau Server, existing configuration needed**—If you plan to use a new Tableau Server installation that includes your existing configurations and settings as well as your backed up date, you need additional files in along with the snapshot backup. To do a full backup including all the configurations and settings, follow these instructions: 1. Export topology and configuration data. This exports most of the Tableau Server configuration and topology. For more information, see [Perform a Full Backup and Restore of Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/backup_restore.htm#backup-data-types). 2. Create a network share snapshot of the File Store (and repository data, if desired) as described in the [Backup and Restore with External File Store](#Creating) section of this topic. 3. Document the settings that are not included in the export. These include values for system user accounts, coordination service deployment configuration, and customized settings. For more information, see [Perform a Full Backup and Restore of Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/backup_restore.htm#backup-assets-that-require-a-manual-process). ## Tableau Server configured with External File Store When you have Tableau Server configured with an External File Store your backup process needs to include creating a point-in-time snapshot backup of the network share with the External File Store. The following procedure describes how to do this. **Note:** If you have both an External File Store and an external repository, see [Tableau Server configured with External File Store and External Repository](#external-file-store-external-repo). ### Creating a snapshot backup Use the following steps to create a snapshot backup: 1. Prepare for the snapshot backup. Run the following command to create a repository backup file and temporarily copy it to the network share. Tableau Server continues to operate normally during the snapshot prepare process. To ensure a consistent snapshot, the internal process that deletes unused extracts will be paused. This process will resume once you complete the backup process described in a later step. `tsm maintenance snapshot-backup prepare` You should see the following message when the prepare step is complete: **Preparation for snapshot backup succeeded**. Confirm that the repository backup file was created on the network share. **Note:** The prepare step creates a backup file of the repository and KMS and Asset keys. If you are using a cloud solution for your encryption key solution, you will need access to the CMK used to decrypt the keys which is necessary for restore. For more information on encryption key solution with AWS, see [AWS Key Management System](https://help.tableau.com/v0.0/server-linux/en-us/security_kms_aws.htm). For more information on encryption key solution with Azure, see [Azure Key Vault](https://help.tableau.com/v0.0/server-linux/en-us/security_kms_azure.htm). 2. Create a snapshot of your network share. Use the appropriate process to create a snapshot of your network share. The snapshot is a read-only version of the share, taken at a particular point in time. This will include your File Store data, along with the repository backup file that was temporarily copied to the share in the previous step. The steps you take to create this network share snapshot depend on your network. See your networking documentation for details. 3. Complete the snapshot backup process. Run the following command to complete the backup process and restart the paused internal processes. This removes the temporary repository backup file that was copied to your network share. `tsm maintenance snapshot-backup complete` Confirm that the temporary repository backup file was removed from the network share. ### Restoring a snapshot backup These steps apply to both single node and multi-node Tableau Server installations. 1. Stop Tableau Server. At the command prompt, run the following command: `tsm stop` 2. Restore your File Store data by restoring your network share snapshot to your network. Your specific steps will depend on your network. 3. Restore the repository data. Use the following command to restore the repository data: `tsm maintenance snapshot-backup restore` **Note:** If you are using a cloud solution for your encryption key solution, make sure the server where the backup is being restored has decrypt access to the cloud instance where the CMK is deployed. 4. Restart Tableau Server. At a command prompt, run the following command: `tsm start` ## Tableau Server configured with External File Store and External Repository When you have Tableau Server configured with both an External File Store and an external repository, there are special steps you need to take to create a backup. These include creating a point-in-time snapshot backup of the network share with the External File Store, and may include separately backing up your external repository. The following procedure describes how to do this. **Note:** If you have an External File Store but are using the default repository, see [Tableau Server configured with External File Store](#external-file-store). ### Backing up the repository When you have both an External File Store and an external repository, you have two options for backing up the repository data. There are reasons why you might choose each of these: - Include the repository backup with the network share snapshot: Ease of management. You do not have to do a separate backup of the repository, and the backup is in sync with the File Store data. - Back up the repository independently: Doing a backup of an External Repository separately can be faster, especially if you are using a cloud solution that allows for snapshot backups of the instance. The size of the backup file can significantly impact the time it takes to prepare for a network share snapshot. ### Option 1: Include repository backup with network share snapshot #### Create a snapshot backup 1. Prepare for the snapshot backup. Run the following command to create a repository backup file and temporarily copy it to the network share. Tableau Server continues to operate normally during the snapshot prepare process. To ensure a consistent snapshot, the internal process that deletes unused extracts will be paused. This process will resume once you complete the backup process described in a later step. `tsm maintenance snapshot-backup prepare --include-pg-backup` **Note:** Starting in 2021.1, if you have both External File Store and External Repository enabled, you _must_ use the `--include-pg-backup` option to create the repository backup. If you are upgrading from a version earlier than 2021.1 and you have scripts to run or schedule your backups, and want to continue to include the repository backup, add the `--include-pg-backup` option in the prepare command as shown above. For versions prior to 2021.1 you do not need the option, the repository backup is automatically included. You should see the following message when the prepare step is complete: **Preparation for snapshot backup succeeded**. Confirm that the repository backup file was created on the network share. **Note:** The prepare step creates a backup of the repository and KMS and Asset keys. If you are using a cloud solution for your encryption key solution, you will need access to the CMK used to decrypt the keys which is necessary for restore. For more information on encryption key solution with AWS, see [AWS Key Management System](https://help.tableau.com/v0.0/server-linux/en-us/security_kms_aws.htm). For more information on encryption key solution with Azure, see [Azure Key Vault](https://help.tableau.com/v0.0/server-linux/en-us/security_kms_azure.htm). 2. Create a snapshot of your network share. Use the appropriate process to create a snapshot of your network share. The snapshot is a read-only version of the share, taken at a particular point in time. This will include your File Store data, along with the repository backup file that was temporarily copied to the share in the previous step. The steps you take to create this network share snapshot depend on your network. See your networking documentation for details. **Important:** The snapshot of the network share and the Repository backup must be completed within 3 hours after completing the Prepare step (step 1). This is to make sure that the File Store and the Repository backups are in sync and to allow the restore to work properly. 3. Complete the snapshot backup process. Run the following command to complete the backup process and restart the paused internal processes. This also removes the temporary repository backup file that was copied to your network share. `tsm maintenance snapshot-backup complete` #### Restoring a snapshot backup These steps apply to both single node and multi-node Tableau Server installations. **Important:** If you perform Blue/Green upgrades or manually upgrade Tableau Server 2021.4 (or earlier) using the [tsm maintenance (backup and restore)](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm) method, you must enable `legacy-identity-mode` before you can restore to Tableau Server 2022.1 (or later). For more information, see [Troubleshoot Issues with the Identity Migration](https://help.tableau.com/v0.0/server-linux/en-us/identity_migration_troubleshoot.htm). 1. Stop Tableau Server. At the command prompt, run the following command: `tsm stop` 2. Restore your File Store data by restoring your network share snapshot to your network. Your specific steps will depend on your network. 3. Restore the repository data. Use the following command to restore the repository data: `tsm maintenance snapshot-backup restore` **Note:** If you are using a cloud solution for your encryption key solution, make sure the server where the backup is being restored has decrypt access to the cloud instance where the CMK is deployed. 4. Restart Tableau Server. At a command prompt, run the following command: `tsm start` ### Option 2: Back up repository separately This option is recommended only when the host platform for the External Repository allows you to do snapshot backup. If you are using Azure as your host platform, we recommend using Option 1. #### Create snapshot backups 1. Prepare for the snapshot backup. Run the following command to create a repository backup file and temporarily copy it to the network share. Tableau Server continues to operate normally during the snapshot prepare process. To ensure a consistent snapshot, the internal process that deletes unused extracts will be paused. This process will resume once you complete the backup process described in a later step. `tsm maintenance snapshot-backup prepare` You should see the following message when the prepare step is complete: **Preparation for snapshot backup succeeded**. **Note:** The prepare step creates a backup of the KMS and Asset keys. If you are using a cloud solution for your encryption key solution, you will need access to the CMK used to decrypt the keys which is necessary for restore. For more information on encryption key solution with AWS, see [AWS Key Management System](https://help.tableau.com/v0.0/server-linux/en-us/security_kms_aws.htm). For more information on encryption key solution with Azure, see [Azure Key Vault](https://help.tableau.com/v0.0/server-linux/en-us/security_kms_azure.htm). 2. Create a snapshot of your network share. Use the appropriate process to create a snapshot of your network share. The snapshot is a read-only version of the share, taken at a particular point in time. This will include your File Store data. The steps you take to create this network share snapshot depend on your network. See your networking documentation for details. 3. Create a backup of the repository: Use the backup technology of platform where you are hosting your external repository to create a backup. **Important:** The snapshot of the network share and the Repository backup must be completed within 3 hours after completing the Prepare step (step 1). This is to make sure that the File Store and the Repository backups are in sync and to allow the restore to work properly. For more information on creating a snapshot of AWS DB instance, see [Creating a DB snapshot](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CreateSnapshot.html). For more information on creating a backup of Azure DB instance, see [Backup and Restore on Flexible Server](https://docs.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-backup-restore) (PostgreSQL 12 and later) or [Backup and Restore on Single Server](https://docs.microsoft.com/en-us/azure/postgresql/concepts-backup) (PostgreSQL 11 or earlier). **Note:** If you are using a cloud solution for your encryption key solution, make sure the server where the backup is being restored has decrypt access to cloud instance where CMK is deployed. 4. Complete the snapshot backup process. Run the following command to complete the backup process and restart the paused internal processes. `tsm maintenance snapshot-backup complete` #### Restoring a snapshot backup These steps apply to both single node and multi-node Tableau Server installations. 1. Use the database backup of your External Repository. If you are using a cloud platform to host your Repository, this generally requires that you create a new database instance into which you restore the backup. For detailed instructions on creating a new instance, see the option for your hosting solution in [Install External Repository](https://help.tableau.com/v0.0/server-linux/en-us/server_external_repo_new_install.htm#external-repo-install). 2. Use the instructions in Step 1 of the [Install Tableau Server with External PostgreSQL Repository](https://help.tableau.com/v0.0/server-linux/en-us/server_external_repo_new_install.htm) topic to create a configuration file for the new instance. 3. Stop Tableau Server. At the command prompt, run the following command: `tsm stop` 4. If the restore of the external repository requires a new database instance, use the following commands to point Tableau Server to the new database instance and then apply the changes to Tableau Server: `tsm topology external-services repository replace-host -f .json -c .pem` `tsm pending-changes apply` The `.json` file is the configuration file you created in Step 2. The certificate file is the SSL certificate you downloaded from the new database instance. 5. Restore your File Store data by restoring your network share snapshot to your network. Your specific steps will depend on your network. **Note:** Some technologies require you to create a new network share when doing a restore. If this applies to your network attached storage, you can do your restore **before** stopping the Tableau Server. If you are restoring the File Store data to a new network share, you must configure Tableau Server to use the new network share. For more information, see [Configure Tableau Server to use a different external storage](https://help.tableau.com/v0.0/server-linux/en-us/server_external_filestore_storage_reconfigure.htm#configure-new-storage). 6. Run the following command to restore the KMS and Asset keys: `tsm maintenance snapshot-backup restore` **Note:** If you are using a cloud solution for your encryption key solution, make sure the server where the backup is being restored has decrypt access to cloud instance where CMK is deployed. 7. Run the following command to restart Tableau Server: `tsm start` ## Who can do this Tableau Server Administrators can backup and restore Tableau Server. In addition you must have permission to access and perform snapshot backups on the external storage. [Skip to main content](#main-content) # Basic Product Data By default Tableau products send usage data to Tableau so that we can understand how customers use our software, and gain insights into where they are successful and where they might run into problems that we can address. For example, this data can help us learn where upgrades are commonly failing and allow us to make product changes to address those issues, or identify what portion of our user base needs informed about a security issue that applies to a specific version of Tableau Server. You can disable the sending of this data at installation time, or later. For details on how to do this, see the instructions for [Tableau Desktop](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_setting_changes.htm#usage) or [Tableau Server](https://help.tableau.com/current/server/en-us/usage_data_server.htm). Even when you disable the sending of product usage data, certain basic product data is sent to Tableau. This Basic Product Data includes information about products and their processes, including which product or process is running, when they start up, what operating system they are running on, licensing information, which machine or cluster of machines has sent the data (using unique pseudonymized identifiers), and whether the product is configured to send product usage data. You can disable the sending of Basic Product Data at the machine level, or at the enterprise level, by blocking traffic sent to **prod.telemetry.tableausoftware.com**. ## Disabling sharing of Basic Product Data on individual computers **Important:** This procedure involves modifying your local `hosts` file. If you do not know what this is, you should not change it. You should only make this change if you understand the implications of making changes to the file, know how to change the file, and have made a backup of the file for safety. Modifying `hosts` files changes network behavior for computers. Detailed instructions for modifying `hosts` files are provided by operating system providers such as Microsoft, Apple or Linux Distributions. 1. Make a copy of your existing hosts file and save it to a computer that is not your Tableau computer. This is your backup, in case you need to reverse your changes. Do not start modifying the file until you have made a backup copy of it. 2. Modify your computer’s `hosts` file to include these lines: \# Stops sending Product Usage to Tableau (prod.telemetry.tableausoftware.com). # Learn more here: http:\\\\tableau.com\\derived-data 127.0.0.1 prod.telemetry.tableausoftware.com The first and second lines are comments, explaining the third line. The third line prevents all traffic to `prod.telemetry.tableausoftware.com` (`http://prod.telemetry.tableausoftware.com/`) from leaving your local machine by sending it to the Internal host loopback address. The data does not get sent outside the computer. ## Disabling the sharing of Basic Product Data at the enterprise level To disable sending of Basic Product Data on an enterprise level, modify your Network Firewall to prevent outbound traffic to `prod.telemetry.tableausoftware.com`. This domain is used by Tableau to receive the Basic Product Data about process launch and shutdown. It is also used for the more general Product Usage Data. Blocking traffic to this domain it you will prevent both kinds of data from being sent. Traffic to this domain will occur on Ports 80 (for initial registration of our Product Data clients) and on Port 443 (for all subsequent traffic). To completely prevent product data from being sent, block all traffic to this domain. For details on how to configure your network firewall, refer to your vendor or your internal IT department. Tableau cannot provide these instructions. [Skip to main content](#main-content) # Before you install... **Note:** You can find additional information about technical specifications for Tableau Server on the Tableau web site, [here](http://www.tableau.com/products/techspecs#server "Tableau Server Tech Specs"). This topic includes requirements and recommendations that you must consider before you install Tableau Server into a production environment. - If you are new to Tableau Server, and you want to deploy it in your organization, we encourage you to deploy Tableau Server as a single server in a test environment first. The easiest way to do a single-server installation is to follow the steps in [Jump-start Installation](https://help.tableau.com/v0.0/server-linux/en-us/jumpstart.htm). - For an end-to-end procedure that describes how to deploy an enterprise-ready, four-node, reference architecture in a tiered data center, see [Tableau Server Enterprise Deployment Guide](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_intro.htm). - If you are deploying Tableau Server in a distributed cluster, review [Distributed Requirements](https://help.tableau.com/v0.0/server-linux/en-us/distrib_requ.htm) in addition to the requirements and recommendations described in this topic. - If you are migrating from Tableau Server on Windows to Tableau Server on Linux, see [Migrate Tableau Server from Windows to Linux](https://help.tableau.com/v0.0/server-linux/en-us/restore_from_backup_linux.htm). ## Validating your server deployment plan Before you commit to installing a new Tableau Server deployment in your organization, be sure to carefully evaluate your options. For most organizations, Tableau Cloud will provide a more reliable, performant, and cost-effective analytics solution when compared to self-hosting Tableau Server. For information about the viability of Tableau Cloud for your organization, review this blog post, [Should I move my analytics to the cloud?](https://www.tableau.com/blog/should-i-move-my-analytics-cloud) Already running Tableau Server and want to migrate to Tableau Cloud? See [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm). ## Hardware recommendations for production installations The following list describes the _minimum_ hardware recommendations for a production use, single- node installation of Tableau Server: **Important:** These recommendations are minimums and may not reflect the requirements for your installation and organization. For example, there are a number of factors that can impact disk space requirements, including whether or not you will be publishing extracts, flows, and the number of workbooks to Tableau Server. For more information on what might impact free disk space requirements, see [Disk Space Requirements](https://help.tableau.com/v0.0/server-linux/en-us/requ_diskspace.htm).

Install Type	Processor	CPU	RAM	Free Disk Space
Single node	64-bit (x86_64 chipsets) Must support SSE4.2 and POPCNT instruction sets ARM-based processors are not supported	8 cores (16 vCPUs), 2.0 GHz or higher	Version 2022.3 and later: 128 GB Version 2021.4.0 to version 2022.1.x: 64 GB Version 2021.3.x and earlier: 32 GB	50 GB
	If you are adding Tableau Prep Conductor to your Tableau Server installation, we recommend you add a second node and dedicate this to running Tableau Server Prep Conductor. This node should have a minimum of 4 cores (8 vCPUs), and 16 GB of RAM.
	Recommended swap memory: The square root of the system RAM or 8 GB, which ever is larger.
Multi-node and enterprise deployments	Contact Tableau for technical guidance. Nodes must meet or exceed the minimum hardware recommendations, except: Dedicated Backgrounder nodes running up to two instances of backgrounder, where 4 cores may be acceptable. Dedicated node for Tableau Prep Conductor: Minimum of 4 cores (8 vCPUs), and 16 GB of RAM. Dedicated node for Independent Gateway: Minimum of 2 cores (4 vCPUs), 8 GB of RAM, and 100 GB free disk space.

**Important:** The disk space requirement cannot be checked until you initialize TSM. If you don’t have enough space, you won’t be told this until after you install the Tableau Server package. 50 GB disk space available, with a minimum of 15 GB allocated to the `/opt` directory, and the remainder allocated to the `/var` directory for data storage. - Free disk space is calculated after the Tableau Server Setup program is unzipped. The Setup program uses about 1 GB of space. You may need to allocate additional disk space depending on various factors like whether you will be using extracts. The core Tableau Server bits must be installed in a directory with at least 15 GB of free disk space. If you attempt to install Tableau Server on a computer that does not have enough space, the Tableau Server package will install, but you will be unable to continue with setup. By default the install location is the `/opt` directory. You can change the installation path for Tableau Server on RHEL distros. If you plan to make heavy use of extracts then you may need to allocate additional disk space.You can specify a different directory for data (extract) storage during installation. - **Network attached storage space requirements for External File Store:** If you are planning to configure [Tableau Server with External File Store](https://help.tableau.com/v0.0/server-linux/en-us/server_external_filestore_storage.htm), you will need to estimate the amount of storage space to dedicate on your network attached storage. Estimating the storage size: You must take into account the amount of storage needed for publishing and refreshing extracts. In addition, you must also take into account the repository backup size unless you specifically choose the option to do your repository backup separately as described in the [Option 2: Back up repository separately](https://help.tableau.com/v0.0/server-linux/en-us/server_external_filestore_storage_backup_restore.htm#backup-repository-separately) topic. - Extracts: - Consider the number of extracts that will be published to Tableau Server and the size of each extract. Test your needs by publishing several extracts to Tableau Server, and then checking the disk space used. You can use this amount of disk space to help you figure out how many extracts will be published to Tableau Server over time as well as how each existing extract will increase in size. - Consider the space needed by the temp directory during an extract refresh. The temp directory, which is where an extract is stored to during a refresh, may require up to three times the final file size of the extract. - Repository Backup: - To obtain an estimate of the repository data, check the size of `/pgsql/data/base` directory. - To obtain the exact size of the repository data, open the backup file and use the size of the `workgroup.pg_dump` file. - Core count is based on "physical" cores. Physical cores can represent actual server hardware or cores on a virtual machine (VM). Hyper-threading is ignored for the purposes of counting cores. - RAM shown is the minimum recommended for a single-node installation. Your installation may function better with more RAM, depending on activity, number of users, and background jobs, for example. To see the full list of recommendations and to see the minimum requirements, see [Minimum Hardware Requirements and Recommendations for Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/server_hardware_min.htm). For hardware specifications Tableau uses internally for testing scalability, see [Hardware recommendations for production installations](https://help.tableau.com/v0.0/server-linux/en-us/server_baseline_config.htm#Hardware). For public cloud deployments on Amazon Web Services and Google Cloud Platform, their “vCPU” is actually a CPU hyper-thread, and not a full CPU core. When sizing cloud instances, you will need twice as many vCPU as the Tableau Server CPU core requirements given (8 vCPU required for a minimum trial installation, 16 vCPU recommended for a single-node installation). ## Operating system requirements **Important:** There is a [known issue](https://issues.salesforce.com/issue/a028c00000y51g0AAA/activationservice-or-tabadmincontroller-crashes-on-multiple-linux-distributions-during-initialization-or-license-activation-in-ts-20231 "link to known issue") where initialization or license activation fails on servers running Linux with Tableau Server on the following versions: 2023.3.1 - 2023.3.17, 2024.2.1 - 2024.2.10, and 2025.1.0 - 2025.1.1. The issue is fixed beginning with the May 2025 maintenance releases, in versions 2023.3.18, 2024.2.11, and 2025.1.2. For information on resolving this, see [this Knowledge Base article](https://help.salesforce.com/s/articleView?id=001922852&type=1 "link to Knowledge Base article with resolution to known issue"). The following distributions of Linux are supported:

	2023.1.8+	2023.3.0	2023.3.1 - 2024.2.11	2024.2.12+	2025.1.x - 2025.3.0	2025.3.1+	2026.2.x
AlmaLinux 8.x
AlmaLinux 9.x
AlmaLinux 10.x
Amazon Linux 2
Amazon Linux 2023
CentOS 7.9+ (not 8.x)
CentOS Stream 8.x
CentOS Stream 9.x
CentOS Stream 10.x
Oracle Linux 7.3+
Oracle Linux 8.x
Oracle Linux 9.x
Oracle Linux 10.x
RHEL 7.3+
RHEL 8.3+
RHEL 9.x
RHEL 10.x
Rocky Linux 8.x
Rocky Linux 9.x
Rocky Linux 10.x
Ubuntu 16.04 LTS
Ubuntu 18.04 LTS
Ubuntu 20.04 LTS
Ubuntu 22.04 LTS
Ubuntu 24.04 LTS

For information about Linux distribution requirements for Tableau Server in a Container, see [Supported distributions for building](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container_setup-tool.htm#TSContainer-distros) . **Important:** To ensure you have the latest security and functionality patches, Tableau strongly recommends that you use the latest supported version of the Linux distribution you are deploying on. Tableau generally tests and validates on the latest minor version of a supported distribution major version. Additional notes on Linux distributions: - Red Hat Enterprise Linux (RHEL), CentOS, Oracle Linux, and Amazon Linux distributions are collectively referred to in this documentation as RHEL-like. - As of version 2025.1.0, the following distributions are no longer supported: CentOS 7, RHEL 7, Oracle Linux 7, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Amazon Linux 2. - As of July 2022, Debian distributions are no longer supported. For more information, see [this Tableau Community post](https://community.tableau.com/s/news/a0A4T0000011xDOUAY/debian-end-of-life). - Non-LTS releases of Ubuntu are not supported. - Ubuntu version 24.04 support was added in Tableau Server version 2025.1.0. - Ubuntu version 20.04 support was added in Tableau Server version 2023.1.0, and in Server maintenance releases 2022.1.12 and 2022.3.4. It is not supported in earlier versions. - Custom kernels are not supported. In a multi-node installation of Tableau Server, all of the computer nodes where you are installing Tableau must run Linux and the same distribution of Linux. ## Installation directory The core Tableau Server bits are installed in the `/opt` directory by default. - The directory where you install Tableau Server must have at least 15 GB of free disk space allocated to it. If you attempt to install Tableau Server on a computer that does not have enough space, the Tableau Server package will install, but you will be unable to continue with setup. - You can specify a non-default install location on RHEL-like systems, but cannot change the location on Ubuntu. - Do not specify a symbolic link or a directory location on a Network File System (NFS) volume when specifying a non-default install location on RHEL-like systems. ### Data directory By default, Tableau Server will create a data directory for all content and extracts that are managed by Tableau. The directory is created at `/var/opt/tableau/tableau_server`. Do not use a symbolic link or directory location on a Network File System (NFS) volume for the data directory as these are not supported. You can specify a non-default directory for data (extract) storage during installation. If you plan to use a different directory, do not create the directory. Instead, let Tableau Server setup create the directory. The data directory requires specific permissions that are set during the installation process. To change the data directory, you must pass a flag along with the data directory path when you run the `initialize-tsm` script. See [Help Output for initialize-tsm Script](https://help.tableau.com/v0.0/server-linux/en-us/initialize_tsm-h.htm). If you are changing the default data directory: - Do not specify a symbolic link or a data directory location on a Network File System (NFS) volume. - Do not specify a data directory location with a path that includes a period or space. If there is a period or space in the path, initialization will fail. - The data directory must be installed into a different directory than the installation directory. **Important**: You cannot change the data directory location after you've run `initialize-tsm`. The data directory location will persist for the life of the deployment, including subsequent upgrades. ## Tableau Prep Conductor Tableau Prep Conductor is one of the process on Tableau Server. It runs a flow, checks connection credentials, and sends alerts if a flow fails. Tableau Prep Conductor leverages the scheduling and tracking functionality of Tableau Server so you can automate running flows to update the flow output instead of logging into Tableau Prep Builder to manually run individual flows as your data changes. Tableau Prep Conductor is licensed separately and is available through the Data Management license. For more information on Tableau Prep Conductor licensing, see [License Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_license.htm). We recommend you enable Tableau Prep Conductor on a dedicated node. For more information: - If you are installing a new Tableau Server, see [Step 1 (New Install): Install Tableau Server with Tableau Prep Conductor](https://help.tableau.com/v0.0/server-linux/en-us/prep_conductor_new_install.htm). - If you are adding Tableau Prep Conductor to an existing installation of Tableau Server, see [Step 1 (Existing Install): Enable Tableau Prep Conductor](https://help.tableau.com/v0.0/server-linux/en-us/prep_conductor_add_to_existing_install.htm). ## Additional requirements Make sure that your environment also meets the following additional requirements: **Hostname** - Tableau Server must be able to resolve the hosthame to an IP address either using the domain name server (DNS) or with a local host file on the computer running Tableau Server. By default, host files are stored at `/etc/hosts`. - The hostname of the server must not change after you start Tableau Services Manager during the setup process. For example, this might happen if you use the cloud-init package to initialize a virtual machine, and you install Tableau Server on that virtual machine. - Hostnames that include underscores (\_) are not supported by Tableau Server. **DNS responsiveness** Domain name servers configured for Tableau Server nodes must respond quickly and reliably to both A and AAAA record lookups for hostnames used during runtime resolution. This includes returning timely negative responses (for example, NXDOMAIN) when a hostname is not registered. Slow DNS responses or timeouts may cause connection and query delays. **Static IP address** The computer where you install Tableau Server must have a static IPv4 or IPv6 address. **Database drivers** To connect to specific data sources, the computer where you install Tableau Server must have the correct database drivers installed. For more information, see [Database Drivers](https://help.tableau.com/v0.0/server-linux/en-us/dbdriver.htm). **Available ports** TSM and Tableau Server each require an available TCP port in order for you to access them. TSM defaults to port 8850, and the Tableau Server Gateway service defaults to port 80. We strongly recommend that you ensure that both port 8850 and 80 are not in use on your system before installing Tableau Server. If those ports are not available, the TSM and gateway ports may be dynamically remapped to different port numbers, and there is currently no interface for displaying which port they have been remapped to. See [Tableau Services Manager Ports](https://help.tableau.com/v0.0/server-linux/en-us/ports.htm). **Local firewall configuration** If you are running a firewall on the computer where you will be installing Tableau Server, then you will need to open the following default ports for Tableau Server traffic. All port numbers, except 443 can be changed.

Port	TCP/UDP	Used by ...	TYPE OF INSTALLATION
Port	TCP/UDP	Used by ...	All	Distributed / High Availability
80	TCP	Gateway	X
443	TCP	SSL. When Tableau Server is configured for SSL, the application server redirects requests to this port. Do not change this port.	X
8850	TCP	Tableau Services Manager.	X
8060	TCP	PostgreSQL database.	X
8061	TCP	PostgreSQL backup verification port	X
8000-9000	TCP	Range of ports reserved by default for dynamic mapping of Tableau processes		X
27000-27009	TCP	Range of ports used by Tableau Server for License service. This range must be open on the node running the License service and accessible from other nodes. By default, the initial node runs the License service.	X

See [Tableau Services Manager Ports](https://help.tableau.com/v0.0/server-linux/en-us/ports.htm) and [Configure Local Firewall](https://help.tableau.com/v0.0/server-linux/en-us/config_firewall_linux.htm). **System user and groups** Tableau Server on Linux uses one unprivileged user, and two groups for proper operation. Tableau will create the default account and groups during setup. Alternatively, you can specify existing accounts. See [System user and groups](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm#System) and [TSM authorization group](https://help.tableau.com/v0.0/server-linux/en-us/tsm_overview.htm#TSM). **Sudo and root access** All installation tasks and administrative tasks for Tableau Server must be run as root. Often this is accomplished using the sudo command, but running the commands directly as the root user is also possible. To install Tableau Server with the root account, you must specify a user account during installation. The account will be used for managing TSM. Specify the account by running the initialize-tsm script with the `-a` option. See [Help Output for initialize-tsm Script](https://help.tableau.com/v0.0/server-linux/en-us/initialize_tsm-h.htm). **Account password** The user account that you use to install and administer Tableau Server must be able to authenticate with a password. That is, the user must not use another means of authenticating (for example public key authentication). If the account you are using to install and initialize Tableau Server does not have a password, you can set one using the `passwd` command: `sudo passwd $USER` **Port access requirements** If you want to install Tableau Server remotely, for example by means of SSH, ensure that the following ports are open: - `8850`. The port used for the Tableau Services Manager (TSM) web interface. You can use this interface to configure Tableau Server. - `80`. The port used for the main Tableau Server web interface. The Tableau Server installer attempts to open these ports during the installation process, but it can only open these ports for the `firewalld` firewall. If your computer runs another firewall, you must open the ports before you install. **Virtual Container environments** Beginning with version 2021.2, certain configurations of Tableau Server on Linux can be run in a container. For details on supported configurations, see [Tableau Server in a Container](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container.htm). Previous versions of Tableau Server on Linux and unsupported configurations have not been tested and are not supported in virtual container environments such as Docker. In these cases, Tableau Server on Linux will not function as expected if installed in these environments. ### Package requirements **Systemd** Tableau Server requires `systemd`to manage services. This package is installed by default starting on CentOS 7 and Ubuntu 16. If you decide to test Tableau Server on a modified version of these distributions, you can run the following command to confirm that `systemd` is installed: `whereis systemd` If `systemd`is installed, the installation location is displayed. For example, you might see the following output: `systemd: /usr/lib/systemd /etc/systemd /usr/share/systemd /usr/share/man/man1/systemd.1.gz` If you have systemd installed but the Tableau installer is failing requirements checks for systemd, it's likely that systemd is not running. To verify that systemd is running, run the following command: `ls /run/systemd` The output will be a list of files and directories. If systemd is running, the output will include `system`. If `system` is not in the output, then systemd is not running. **Antivirus software** Antivirus software that scans directories used by Tableau Server can interfere with installation and ongoing use of Tableau Server. In some cases, this can result in installation failures, problems starting Tableau Server, or impacts to performance. If you plan to run antivirus software on the computer running Tableau Server, follow the recommendations in the [Knowledge Base](http://kb.tableau.com/articles/howto/improving-performance-by-using-antivirus-exclusions). _Continue to the next step: [Install and Configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm)._ [Skip to main content](#main-content) # Best Practices for Installing Tableau Server in the Alibaba Cloud ## This is archived content Deployments on public clouds continue to be supported but the content for third-party public cloud deployments is no longer updated. For the latest Tableau Server deployment content, see the [Deploy](https://help.tableau.com/current/server-linux/en-us/install.htm) section of Tableau Server help. For those customers who have access, we recommend Tableau Cloud. For more details, see: - [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) - [Tableau Cloud Trial for Admin](https://help.tableau.com/current/server-linux/en-us/install.htm) - [Tableau Cloud: Get Started for Admin](https://www.tableau.com/learn/get-started/online-admin) ## Introduction The following best practices make installing Tableau Server in the cloud a better experience. - Read the Tableau Server [Plan Your Deployment](https://help.tableau.com/v0.0/server-linux/en-us/plan.htm) section. - Read the Tableau Server on [Alibaba Cloud Prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/ts_alibaba_prerequisites.htm). - Read the Tableau Server [Security Hardening Checklist](https://help.tableau.com/v0.0/server-linux/en-us/security_harden.htm). - If you’re new to the cloud, use the [Alibaba Cloud free trial](https://www.alibabacloud.com/campaign/free-trial) to get familiar with working in the cloud before you deploy Tableau Server on the Alibaba Cloud. - Read about and understand [network topology](https://www.alibabacloud.com/help/doc-detail/34217.htm) on the Alibaba Cloud and how to architect it. ## Keeping Costs Down The Alibaba Cloud offers cloud-based services on a pay-as-you-go basis. Costs are determined by the services you run and amount of time you use them. Different combinations of instance types and sizes have different costs. For more information about services pricing, see [Alibaba Cloud pricing](https://www.alibabacloud.com/pricing). You can estimate your total monthly costs using the [Alibaba Cloud price calculator](https://www.alibabacloud.com/pricing-calculator#/). To help monitor and control usage costs on an ongoing basis, you can set up a billing alert on the Alibaba Cloud to send email when your monthly Alibaba Cloud costs reach your predefined spending threshold: 1. In the Alibaba Cloud console, click Billing Management. 2. On the Account Overview page, next to Monthly Spending Alert, click Setting. 3. In the Monthly Spending Alert dialog box, turn on monthly spending alerts, enter the spending threshold, and set the email recipient who should be notified when spending reaches the threshold you've set. 4. Click Save. For more information about how to track your spending, see [How to see the instance spending](https://www.alibabacloud.com/help/doc-detail/106929.htm) at the Alibaba website. [Skip to main content](#main-content) # Best Practices for Installing Tableau Server on Amazon Web Services ## This is archived content Deployments on public clouds continue to be supported but the content for third-party public cloud deployments is no longer updated. For the latest Tableau Server deployment content, see the [Deploy](https://help.tableau.com/current/server-linux/en-us/install.htm) section of Tableau Server help. For those customers who have access, we recommend Tableau Cloud. For more details, see: - [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) - [Tableau Cloud Trial for Admin](https://help.tableau.com/current/server-linux/en-us/install.htm) - [Tableau Cloud: Get Started for Admin](https://www.tableau.com/learn/get-started/online-admin) ## Introduction The following best practices make installing Tableau Server in the cloud a better experience. - Read the Tableau Server [Plan Your Deployment](https://help.tableau.com/v0.0/server-linux/en-us/plan.htm) section. - Read [What You Need Before You Begin](https://help.tableau.com/v0.0/server-linux/en-us/ts_aws_prerequisites.htm). - Read the Tableau Server [Security Hardening Checklist](https://help.tableau.com/v0.0/server-linux/en-us/security_harden.htm). - If you’re new to the cloud, use the [AWS Free Tier](https://aws.amazon.com/free/) to get familiar with working in the cloud before you deploy Tableau Server on AWS. - Read about and understand [network topology on AWS](http://docs.aws.amazon.com/gettingstarted/latest/awsgsg-intro/gsg-aws-compute-network.html) and how to architect it. - Use an [Amazon elastic network interface](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_ElasticNetworkInterfaces.html) to provide a static MAC address for your Amazon EC2 instance. ## Keeping Costs Down AWS offers cloud-based services on a pay-as-you-go basis. Costs are determined by the services you run and amount of time you use them. Different combinations of instance types and sizes have different costs. For more information about services pricing, see [AWS Pricing](https://aws.amazon.com/pricing/) at the AWS website. You can estimate your total monthly costs using the [AWS Simple Monthly Calculator](http://calculator.s3.amazonaws.com/index.html) at the AWS website. You can also compare on-premises vs the cloud using the [AWS Total Cost of Ownership (TCO) Calculators](https://aws.amazon.com/tco-calculator/) at the AWS website. To help monitor and control usage costs on an ongoing basis, you can use Amazon CloudWatch to alert you when your monthly AWS costs reach your predefined spending threshold. For more information, see [Monitor Your Estimated Charges Using Cloudwatch](http://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/gs_monitor_estimated_charges_with_cloudwatch.html) in the _Amazon CloudWatch User’s Guide_ at the AWS website. [Skip to main content](#main-content) # Best Practices for Installing Tableau Server on Microsoft Azure ## This is archived content Deployments on public clouds continue to be supported but the content for third-party public cloud deployments is no longer updated. For the latest Tableau Server deployment content, see the [Deploy](https://help.tableau.com/current/server-linux/en-us/install.htm) section of Tableau Server help. For those customers who have access, we recommend Tableau Cloud. For more details, see: - [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) - [Tableau Cloud Trial for Admin](https://help.tableau.com/current/server-linux/en-us/install.htm) - [Tableau Cloud: Get Started for Admin](https://www.tableau.com/learn/get-started/online-admin) ## Introduction The following best practices make installing Tableau Server in the cloud a better experience. - Read the Tableau Server [Plan Your Deployment](https://help.tableau.com/v0.0/server-linux/en-us/plan.htm) section. - Read [What You Need Before You Begin](https://help.tableau.com/v0.0/server-linux/en-us/ts_azure_prerequisites.htm). - Read the Tableau Server [Security Hardening Checklist](https://help.tableau.com/v0.0/server-linux/en-us/security_harden.htm). - If you’re new to the cloud, use the [Azure free tier](https://azure.microsoft.com/en-us/free/) to get familiar with working in the cloud before you deploy Tableau Server on Microsoft Azure. - Read about and understand [network topology](https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/) on Microsoft Azure and how to architect it. ## Keeping Costs Down Microsoft Azure offers cloud-based services on a pay-as-you-go basis. Costs are determined by the services you run and amount of time you use them. Different combinations of instance types and sizes have different costs. For more information about services pricing, see [Azure pricing](https://azure.microsoft.com/en-au/pricing/calculator/). You can estimate your total monthly costs using the [Microsoft Azure Pricing Calculator](https://azure.microsoft.com/en-au/pricing/calculator/). You can also compare on-premises vs the cloud using the [Microsoft Azure Total Cost of Ownership (TCO) Calculator](http://tco.microsoft.com/). To help monitor and control usage costs on an ongoing basis, you can set up billing alerts for Microsoft Azure to alert you when your monthly Microsoft Azure costs reach your predefined spending threshold. For more information, see [Set up billing or credit alerts for your Microsoft Azure subscriptions](https://docs.microsoft.com/en-us/azure/billing/billing-set-up-alerts) at the Microsoft Azure website. [Skip to main content](#main-content) # Best Practices for Installing Tableau Server on the Google Cloud Platform ## This is archived content Deployments on public clouds continue to be supported but the content for third-party public cloud deployments is no longer updated. For the latest Tableau Server deployment content, see the [Deploy](https://help.tableau.com/current/server-linux/en-us/install.htm) section of Tableau Server help. For those customers who have access, we recommend Tableau Cloud. For more details, see: - [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) - [Tableau Cloud Trial for Admin](https://help.tableau.com/current/server-linux/en-us/install.htm) - [Tableau Cloud: Get Started for Admin](https://www.tableau.com/learn/get-started/online-admin) ## Introduction The following best practices make installing Tableau Server in the cloud a better experience. - Read the Tableau Server [Plan Your Deployment](https://help.tableau.com/v0.0/server-linux/en-us/plan.htm) section. - Read the Tableau Server on [Google Cloud Platform Prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/ts_gcp_prerequisites.htm). - Read the Tableau Server [Security Hardening Checklist](https://help.tableau.com/v0.0/server-linux/en-us/security_harden.htm). - If you’re new to the cloud, use the [Google Cloud Platform free tier](https://cloud.google.com/free/) to get familiar with working in the cloud before you deploy Tableau Server on the Google Cloud Platform. - Read Google Cloud Platform [best practices for enterprise organizations](https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations). - Read about and understand [network topology](https://cloud.google.com/vpc/docs/vpc) on the Google Cloud Platform and how to architect it. ## Keeping Costs Down The Google Cloud Platform offers cloud-based services on a pay-as-you-go basis. Costs are determined by the services you run and amount of time you use them. Different combinations of instance types and sizes have different costs. For more information about services pricing, see [Google Cloud Platform pricing](https://cloud.google.com/pricing/). You can estimate your total monthly costs using the [Google Cloud Platform pricing calculator](https://cloud.google.com/products/calculator/). You can also compare on-premises vs the cloud using the [Google Cloud Platform TCO calculator](https://cloud.google.com/pricing?authuser=0&hl=fi#calculators). To help monitor and control usage costs on an ongoing basis, you can set up billing alerts for the Google Cloud Platform to alert you when your monthly Google Cloud Platform costs reach your predefined spending threshold. For more information, see [Set budgets and alerts](https://support.google.com/cloud/answer/6293540?visit_id=0-636416330629139015-862362861&rd=1) at the Google website. [Skip to main content](#main-content) # Best Practices for Updating Your Tableau Server Computer This topic provides the steps for doing minor version upgrades or patches on a computer running Tableau Server. **Important:** Any major version operating system or Linux system kernel upgrade (for example: RHEL 7.x to RHEL 8.x) must be done using Blue/Green guidelines. **Do not do a major version upgrade directly on a machine already running Tableau Server.** Even if you follow the steps below, Tableau Server will be in an unstable state if it starts at all. **Doing a major OS version upgrade directly on a machine that is running Tableau Server will render your Tableau Server installation unsupported.** For details on Blue/Green upgrades, see [Using a Blue/Green approach for upgrading Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/server-upgrade-blue-green.htm). To do a minor version update or patch of the operating system or Linux kernel of a computer running Tableau Server: 1. Use TSM to stop the Tableau Server: At a command prompt, type: `tsm stop` and wait until all services are completely stopped. 2. Stop the TSM administrative services by running the `stop-administrative-services` script, by default: `/opt/tableau/tableau_server/packages/scripts./stop-administrative-services` 3. Patch the operating system as instructed by your IT Team or operating system vendor for all nodes in the cluster. 4. If the patch requires a reboot of the operating system, make sure that all hosts in the Tableau Server cluster complete the reboot before restarting Tableau Server. 5. Start Tableau Server with TSM: At a command prompt, type: `tsm start` and wait until all services are completely started. [Skip to main content](#main-content) # Build a Multi-Fact Relationship Data Model Analysis often involves bringing together tables of data that don't have a direct relationship to each other yet both relate to the same, common information such as date or location. This type of analysis is sometimes referred to as multi-fact analysis with shared dimensions. To perform this kind of analysis in Tableau, create a data source that uses multiple base tables connected by shared tables. - _Base tables_ are the left-most tables in the data model on the Data Source tab. For guidance on how to determine which tables to use as base tables, see [When to Use a Multi-fact Relationship Model](https://help.tableau.com/v0.0/server-linux/en-us/datasource_mfr_when_to_use.htm). - _Shared tables_ are downstream tables with multiple incoming relationships. These tables contain fields that can stitch together unrelated fields during analysis in a viz. Date and Location are examples of commonly shared tables. ## Build the model Building a multi-fact relationship data model is essentially the same as creating any other data source that uses relationships, but with two additional pieces: additional base tables and multiple incoming relationships to shared tables. 1. [Connect to your data](https://help.tableau.com/current/pro/desktop/en-us/basicconnectoverview.htm). You can use [multiple data connections](https://help.tableau.com/current/pro/desktop/en-us/datasource_plan.htm#tableau-data-sources) if your tables aren't all in the same database. 2. Drag a table to the canvas to create the first base table. 3. Drag another table from the left pane to the New Base Table drop area. ![the data modeling canvas with an existing base table and a drop area for New Base Table](/tableau/next/en-us/server-linux/en-us/Img/mfr_new_base_table.png) Tableau shows a warning that you're building a data model with multiple base tables. We recommend that you only set up a multiple base table model if your data needs it. Otherwise, use a single base table model to avoid the complexities that come with a multiple base table model. ![a data model with two base tables, one with a warning for Multiple base tables](/tableau/next/en-us/server-linux/en-us/Img/mfr_multi_base_table_warning.png) 4. Drag another field to the canvas and relate it to one of the base tables. [Configure each relationship if necessary](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm#create-and-define-relationships). ![a downstream table being added to the data model](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_downstream.png) 5. Hover over the not-yet-related base table to bring up a plus sign (affectionately known as a "meatball"). ![the Clubs base table with a cursor over it and the plus sign "meatball" showing](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_meatball_base.png) 6. Drag the plus sign icon to the shared table to create a new incoming relationship (also known as a "noodle"). ![a meatball dragging a new noodle to an existing downstream table](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_meatball.png) 7. _Optional:_ Continue adding downstream tables and base tables. Click and drag the plus sign icon to build shared tables as needed. **Note**: Rather than starting with the base tables, you can also build a single base table model first and add more base tables later. ## Explore the model A data model with multiple base tables is built with relationships, but not all tables are related to each other to the same degree. Each base table defines a _tree_, which contains every table related to that base table, either directly related or downstream from a related table. Shared tables exist in multiple trees. For more information about degrees of relatedness, see [About Multi-fact Relationship Data Models](https://help.tableau.com/v0.0/server-linux/en-us/datasource_mfr_multiple_base_tables.htm). When you view a model with multiple base tables, there are various options for exploring and managing the data model. These options are especially useful when a data model is complex. ![a data model with four base tables and multiple shared tables as well as unshared downstream tables](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_complex_model.png) An example of a complex data model with four base tables, multiple shared tables, and downstream tables. The downstream tables are both shared and unshared between the base tables. 2024.2 introduced some new layout details for the data model. In a multi-fact relationship data model, relationships bundle together to help track how many incoming relationships a table has. Shared tables (and downstream shared tables) have a bolder outline than tables that aren't shared. ### Terminology Tables in a multiple base table data model have specific roles. Base tables and shared tables are the only tables that must exist in a multi-fact relationship data model. (Without more than one base table, it's not a multi-fact relationship data model. Without a shared table connecting the base tables, it's not a valid data model.) Because of the often complex nature of these models, it's useful to have a shared terminology: - _Base tables_ are on the far left and have no incoming relationships. - In the example, Inventory, Marketing, Sales, and Support are base tables. - _Sub-base tables_ are between a base table and a shared table. - In the example, Parts is a sub-base table. - _Shared tables_ have more than one incoming relationship. - In the example, Products, Dates, Customer, and Supplier are shared tables. - _Downstream shared tables_ have exactly one incoming relationship and have a shared table somewhere upstream of them. - In the example, Subcategory and Category are downstream shared tables. - _Downstream unshared tables_ have exactly one incoming relationship and have no shared tables upstream of them. - In the example, there are no downstream unshared tables. ![A data model laying out the terms base table, sub-base table, downstream unshared table, shared table, and downstream shared table.](/tableau/next/en-us/server-linux/en-us/Img/mfr_terminology.png) Test your understanding: identify the types of tables in the example data source ![a data model with four base tables and multiple shared tables as well as unshared downstream tables](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_complex_model.png) - **Base tables**: Inventory, Marketing, Sales, and Support - **Sub-base table:** Parts - **Shared tables:** Products, Dates, Customer, and Supplier - **Downstream shared tables:** Subcategory and Category - **Downstream unshared tables:** none ### Identify a relationship tree Hover over a table to highlight the tables it's related to. Tableau emphasizes the tree for that table and deemphasizes unrelated tables. ![the complex model, with one base table's tree highlighted and the other tables dimmed](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_highlightedtree.png) The Marketing base table tree consists of two shared tables, Dates and Products, and downstream shared tables Subcategory and category. ### View relationship details Hover over a relationship or bundle of relationships to see the details in a tooltip. ![A triple noodle bundle, with a tooltip that has a row for each relationship's details](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_noodle_bundle.png) The incoming relationships to the Products table include three individual relationships to the Inventory, Marketing, and Sales base tables. ### Select a relationship When a relationship is selected, it's's highlighted in blue in the canvas and its details appear in the Table Details pane. The Table Details pane is where you can [inspect or modify the relationship clause](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm#create-a-relationship). There are multiple ways to select a relationship: - Click a relationship line (noodle) in the canvas. Every relationship has a clickable zone that selects just that noodle. - Right-click or control-click a table in the canvas to open its menu. Select the Select Relationship option and choose which table's relationship you want. - Click a bundle of relationships in the canvas to bring up a persistent tooltip (hovering over a bundle brings up the tooltip, click to make it persist). Then select a row in the tooltip details to highlight that relationship in the model. - Open the menu in the toolbar of the Table Details pane and select the desired relationship. You can also use this menu to select a specific table to see its preview in the pane. ![the menu in the Table Details pane](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_table_details_menu.png) ### Swap with base table Intermediate tables in a relationship between a base table and shared tables give you the option to swap the downstream table with the base table. This is purely a visual change to aid with conceptual understanding and doesn't change the structure of the data model. Right-click or control-click a downstream table and select Swap with base table (table name). The swap option is also only present on the downstream table and not the base table. The swap option isn't available for tables which would alter the data model if swapped, such as shared tables or downstream shared tables. Only downstream unshared tables or sub-base tables can be swapped with base tables. #### _Example_ In this example, the **Parlor Info** and the **Ice Cream Sales** tables can be swapped without changing the data model's fundamental structure. No other tables can be swapped. - Ice Cream Sales is related to both Parlor Info and the shared Date table. - Parlor Info is related to both Ice Cream Sales and the shared Location table. - Weather is related to both the shared tables of Date and Location. These two models are conceptually equivalent: ![two versions of equivalent data models where a base table and its unshared downstream table are switched](/tableau/next/en-us/server-linux/en-us/Img/mfr_swapbase_icecream.png) ### Collapse a base table You can also collapse a relationship path, or tree, to just its base table to simplify the view of the data model temporarily. Click the Collapse ![](/tableau/next/en-us/server-linux/en-us/Img/mfr_icon_collapse.png) or Expand ![](/tableau/next/en-us/server-linux/en-us/Img/mfr_icon_expand.png) buttons on a base table to collapse or expand its entire tree. Alternatively, right-click or ctrl-click on a downstream table and select Collapse this path or Collapse other paths. This option isn't available on shared tables or tables downstream of shared tables. Collapsing a tree to its base table is purely visual and won't trigger the Unrelated Tables alert. A collapsed path is indicated by a base table with a stacked table and an Expand button. Collapsing affects all tables and relationships that are relevant only to that tree, so tables that are shared with an uncollapsed path aren't hidden. Use the Expand ![](/tableau/next/en-us/server-linux/en-us/Img/mfr_icon_expand.png) button to re-open the base table and everything in the tree. ![the support base table's tree being collapsed and expanded](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_collapsetree_gif.gif) ## Troubleshooting ### Create a single data source All tables must be related to the entire data source in some way. If there are any tables that aren't related to the overall data model, an alert appears. The alert remains until no tables or trees are fully separate from the rest of the data model. When the alert is active, the data source can't be published and you can't use the data source in an analysis. You can open the alert and set Visually Separate Unrelated Tables to identify which tables triggered the alert. This option is useful when you have a complex model and need to identify which table or tables aren't yet related to the rest of the data model. #### _Example_ In the steps under [Build a model](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_build.htm#Build), an alert appears in Step 4 before a relationship is added to connect the second base table. ![An unrelated table alert message](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_unrelated_alert.png) Setting Visually Separate Unrelated Tables to On moves the table **Clubs** underneath the Unrelated Tables line. Relating **Clubs** to **Students** resolves the alert. ![A data model with an unrelated table below a dotted red line labled Unrelated Tables](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_visuallyseparate.png) #### Resolve a cycle Even if some tables aren't directly related to each other, the entire data model must be a cohesive whole. In this example, each base table defines a tree but there's no shared table connecting them. This isn't a valid model for analysis. ![A data model with two base tables whose distinct trees don't overlap](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_unrelated1.png) The two groups of related tables need to be combined via a shared table... ![The same data model, now connectted with a shared table](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_unrelated2.png) ...or the data model needs to be created as two separate data sources. ![The same data model, broken into two data sources](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_unrelated3.png) ### Data model restrictions Some relationship paths between tables are not supported in a multi-base table model. If you're unable to drop the meatball when you attempt to create a second incoming relationship on a table, make sure the structure you're trying to create is supported in Tableau. Examples of unsupported models include: #### Cycles Cycles—where there's more than one relationship path from an upstream table to the same downstream table—are not supported. This unsupported structure is sometimes called a bowtie. To model this kind of relationship between tables in Tableau, use multiple base tables instead of a bowtie by converting the downstream table to another base table. ![a diagram of a bowtie and another diagram with the downstream table changed to an additional base table](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_bowtie_tableauified.png) The data model must be a _directed acyclical graph_. This means every incoming relationship to a table must be traceable upstream to a different base table.

Not supported. Table X has two incoming relationships that are both from tables downstream from Base Table A	Supported. Tables S and T both have multiple incoming relationships, but each one is from a different base table.	Supported. Although it may visually look like there's a cycle, the incoming relationships for both Table S and Table T can be traced back to different base tables.

#### Nested shared tables Nested shared tables are not supported. Any tables downstream from a shared table (a table with multiple incoming relationships) can only have one incoming relationship. ![unsupported model with a nested shared table](/tableau/next/en-us/server-linux/en-us/Img/mfr_build_nestedshared.png) Not supported. Table T is downstream from a shared table and can't receive an additional incoming relationship. [Skip to main content](#main-content) # Cancel TSM Jobs TSM Jobs can be canceled through TSM web interface or TSM CLI. There are many TSM jobs, but only certain jobs can be canceled once they are in progress. Any job that hasn’t yet started can be canceled using TSM CLI. **TSM web interface**: For jobs that can be canceled while they are running, the Cancel option is available in the Job dialog box as shown below: ![Cancel Running Job confirmation window.](/tableau/next/en-us/server-linux/en-us/Img/tsm-job--confirm-cancel.png) **TSM CLI:** To cancel jobs using TSM CLI, see [tsm jobs](https://help.tableau.com/v0.0/server-linux/en-us/cli_jobs_tsm.htm). To see more information about TSM jobs in general, see [Tableau Service Manager Jobs](https://help.tableau.com/v0.0/server-linux/en-us/tsm-jobs.htm). ## Canceling Jobs that are in progress Only certain jobs can be canceled while they are already running: Cleanup, Decommission File Store, Generate Backup, Restart Server, Start Server. The cancel behavior can be different depending on the job and the state of the job at the time it was canceled. This is explained in detail below: - **Cleanup:** If you cancel a cleanup job, it will stop any services that were started in order to do the cleanup. Depending on when it was canceled, some files may be deleted and some may not have been deleted yet resulting in partial cleanup. - **Decommission File Store:** If you cancel this job, it returns the Tableau Server File Store topology to the state that it was prior to starting the decommissioning process. - **Generate Backup:** If you cancel this job, any services used for backup are stopped and Tableau Server will try to delete any files that it created as part of the backup process. - **Restart Server**: - Job is canceled when Tableau Server processes are stopping: The job is canceled, but the services will try to get to a stopped state. - Job is canceled while Tableau Server processes are restarting: The job is canceled, but the services will try to restart. - **Start Server**: The job will be canceled, but the processes will still try to start. - **Stop Server**: The job will be canceled, but the services will try to stop. Here are some of the main reasons why you may want to cancel a job: 1. Since tsm jobs can only be run one at a time, you might need to cancel a current job if you need to run another job instead. 2. If the running job includes changes to the Tableau Server that you did not intend to make. [Skip to main content](#main-content) # Change Logging Levels By default, Tableau Services Manager (TSM) and Tableau Server log events at the **Info** level. You can change this if you need to gather more information (if you are working with Tableau Support, for example). As a best practice you should not increase logging levels except when troubleshooting an issue, as instructed by Support. You should only set a logging level to debug when investigating a specific issue. Changing log levels can have these impacts: - Increasing the log level to `debug` or `trace` increases the amount of information being logged and can have a significant impact to performance. Reproduce the issue and then reset the logging level back to info. - Setting the log level to `warn` or `error` can reduce the amount of information so much that it is not useful for Tableau Support. **Note:** When logging at the `DEBUG` level, full environment information is gathered when Tableau starts. This means that if you have any sensitive information in an environment variable, it may be included in a log. Logging at the default `INFO` level only gathers safe environment information. ## Logging Levels The following logging levels are listed in order of increasing amount of information logged: - off - fatal - error - warn - info (the default) - debug - trace ## Change Logging Levels Set logging levels for TSM and Tableau Server processes using **tsm configuration set** configuration keys. The key you use depends on which component of TSM or Tableau Server you want to change the logging level for. ### Dynamic log level configuration In version 2020.2 we introduced dynamic configuration. The capability has been expanded in subsequent releases. If you are only changing logging levels for one or more of these components, and are running the appropriate version of Tableau, you can change the logging levels without restarting Tableau Server. These logging levels are dynamically configurable, beginning with these versions: - 2020.2 - tsm services (`tsm.log.level`) and control application services (`tsm.controllerapp.log.level`). - 2020.3 - backgrounder (`backgrounder.log.level`), cluster controller (`clustercontroller.log.level`), data server (`dataserver.log.level`), file store (`filestore.log.level`), data source properties (`tdsservice.log.level`), and VizQL server (`vizqlserver.log.level`). - 2020.4 - adds interactive microservice container (`tomcatcontainer.log.level`) and application server (`vizportal.log.level`). ## Configuration Keys for Changing Logging Levels This table includes both dynamically configurable keys and those that are not dynamically configurable.

Configuration key

Location of affected logs

(path begins with /var/opt/tableau/tableau_server/data/tabsvc/logs/)

tsm.log.level

Changes TSM logging levels for: activationservice, appzookeeper, backuprestore, clientfileservice, databasemaintenance, licenseservice, siteimportexport, tabadminagent, tabadmincontroller, tabsvc

/<service>/<service>_node<n>-<instance>.log

example: /clientfileservice/clientservice_node1-0.log

tsm.controlapp.log.level

Changes TSM logging levels for: control applications

/<service>/control_<service>_node<n>-<instance>.log

examples: /clientfileservice/control_clientservice_node1-0.log

/filestore/control_filestore_node1-0.log

<process>.native_api.log.level

Valid process names are backgrounder, vizportal, vizqlserver, dataserver

Note: These are not dynamically configurable.

/vizqlserver/*.txt

backgrounder.log.level

Changes logging levels for: Backgrounder

/backgrounder/*.log

clustercontroller.log.level

Changes logging levels for: Cluster Controller

/clustercontroller/*.log

dataserver.log.level

Changes logging levels for: Data Server

/dataserver/*.log

filestore.log.level

Changes logging levels for: File Store

/filestore/*.log

gateway.log.level

Changes logging levels for: Gateway control processes

/gateway/*.log

gateway.httpd.loglevel

Note: added in version 2021.3.0

Changes logging levels for: Gateway

/gateway/*.log

hyper.log.level

Changes logging levels for: Hyper

/hyper/*.log

tdsservice.log.level

Changes logging levels for: Data Source Properties service

/tdsservice/*.log

tomcatcontainer.log.level

Changes logging levels for microservices in: Interactive Microservice Container and Non-Interactive Microservice Container

/tomcatcontainer/*.log

vizportal.log.level

Changes logging levels for: Application Server

/vizportal/*.log

vizqlserver.log.level

Changes logging levels for: VizQL Server

/vizqlserver/*.log

For more information, see [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm). If you are only changing dynamically configurable logging levels, you do not need to stop or start the server (for more information, see [Dynamic log level configuration](#DynamicLogLevel) above). If you are changing other logging levels, you may need to stop Tableau Server before changing the logging levels, and restart it afterward. If this is the case, you will be prompted. On a multi-node installation of Tableau Server, set logging levels from the initial node. To change the logging level: 1. (Optional for dynamically configurable logging levels in 2020.2.0 and later) Stop Tableau Server by opening a command prompt and typing: `tsm stop` 2. Set the logging level to by typing `tsm configuration set -k -v ` where `` is one of the keys in the above table and `` is a valid logging level. Examples: - tsm configuration set -k backgrounder.native\_api.log.level -v debug - tsm configuration set -k tsm.log.level -v debug - tsm configuration set -k tsm.controlapp.log.level -v debug 3. Apply pending changes by running the `tsm pending-changes apply` command. 4. (Optional, only if server is stopped) Start Tableau Server by running the following command: `tsm start` ## Reset Logging Levels After you reproduce and gather information about the issue, reset the logging levels to avoid lingering performance impact and additional disk space use. In Tableau Server 2026.2 and later, you can view and reset all service logging levels to their default values with `tsm maintenance log-levels` commands. For more information, see [tsm maintenance](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm). - To see all log level configurations before resetting, run: `tsm maintenance log-levels list` - To set all log level configurations to their default values, run: `tsm maintenance log-levels reset` For earlier versions of Tableau Server, or to reset specific keys, run the `tsm configuration set` command with the `-d` option. Examples: - tsm configuration set -k backgrounder.native\_api.log.level -d - tsm configuration set -k tsm.log.level -d You must apply pending changes after resetting log levels. If you’re resetting log levels for Tableau Server processes, check the pending changes list. If the update requires a restart, stop the server, apply the changes, and then start it again. [Skip to main content](#main-content) # Change Salesforce.com OAuth to Saved Credentials By default, the Salesforce.com connector uses a managed keychain for OAuth tokens that are generated for Tableau Server by the data provider and shared by all users in the same site. You can configure Tableau Server with saved client ID and client secret. There are three scenarios where you might want to do this: - **Salesforce connector**—If you're using the Salesforce connector, you can configure Tableau Server with an OAuth client ID and secret, so the connector can use saved credentials. - **Write to CRM Analytics**—If you're writing Tableau Prep flow data to Salesforce CRM Analytics (version 2022.3 and later), configure Tableau Server with an OAuth client ID and secret, so the flow can run in Tableau Server using saved credentials. - **Einstein Discovery**—If you are integrating Einstein Discovery extensions with Tableau Server, you need to do this OAuth client ID and secret configuration. The ability to integrate Einstein Discovery and Tableau Server was added in version 2021.1.0. For more information, see [Configure Einstein Discovery Integration](https://help.tableau.com/v0.0/server-linux/en-us/config_einstein_extensions.htm). This topic describes how to set up your Salesforce.com data sources and Einstein Discovery extensions for OAuth saved credentials. Complete these steps for each Tableau Server instance. For more information about managed keychain and saved credentials, see [OAuth Connections](https://help.tableau.com/v0.0/server-linux/en-us/protected_auth.htm) **Notes:** - The Salesforce connector requires managed keychain (default), server-wide OAuth, or site-specific OAuth. - To use saved credentials for a site, server-wide OAuth must be configured first. - Server-wide OAuth can be used whether site-wide OAuth is configured. - If using site-specific OAuth, each site must be configured individually. - To support live connection prompts, editing connections, and web authoring, convert managed keychain to saved credentials to avoid errors. ### Summary of steps Set up OAuth by following these general steps: 1. Configure application integration by creating an external client app (recommended) or connected app (deprecated) in Salesforce. 2. Use the information you obtained in step 1 to configure Tableau Server. 3. (Optional) Configure site-specific OAuth. ## Step 1: Configure app integration in Salesforce To enable Tableau integration with Salesforce, you must first configure application integration in Salesforce. We strongly recommend using external client apps. If available, you can use Salesforce connected apps. ### Salesforce external client app (recommended) Starting in Spring '26, Salesforce, external client apps are the next generation of connected apps and are recommended for enabling Tableau integration with Salesforce. 1. Sign in to your Salesforce.com developer account, click your user name in the upper-right of the page, and then select Setup. 2. In the left navigation pane, under Apps, select App Manager. 3. In the Lightning Experience App Manager, click New External Client App. 4. In the External Client App Manager, configure required Customer Key, Customer Secret, and the Callback URL needed in Step 2. 5. Click Create. 6. After you create the app, select the Settings tab. 7. Check the Consumer Key and Secret in the OAuth Settings. When finished, go to **Step 2: Configure Tableau Server for Salesforce.com OAuth**. For more information about creating an external client app, see [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&type=5) in the Salesforce Help. ### Salesforce connected app (deprecated) > [!WARNING] > > **Important:** Starting in the Spring '26 release of Salesforce, connected app creation is restricted. You can continue to use existing connected apps during and after Spring '26 but using external client apps are strongly recommended. For more information, see the following in the Salesforce Help: [New connected apps can no longer be created in Spring '26](https://help.salesforce.com/s/articleView?id=005228017), [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&type=5), and [Connected App to External Client App Migration.](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_to_external_client_app_migration.htm&type=5) **Note:** This procedure documents the process in Salesforce Lightning. If you are using the traditional interface, the navigation may be different but the configuration is the same. 1. Sign in to your Salesforce.com developer account, click your user name in the upper-right, and then select Setup. 2. In the left navigation pane, underApps, search for "External Client Apps" and then select External Client App Settings. 3. Click New Connected App. 4. In Basic Information, give the app a name, tab through the api field so it will self-populate in the correct format, and enter a contact email for the app. 5. In the API \[Enable OAuth Settings\] section, select Enable OAuth Settings. 6. In the new OAuth settings that appear, for Callback URL, type the fully qualified domain name of your server, using the `https` protocol, and append the following text to the URL: `auth/add_oauth_token`. For example: `https://www.your_tableau_server.com/auth/add_oauth_token` 7. Move the following items from Available OAuth Scopes to Selected OAuth Scopes: - Access the identity URL service (id, profile, email, address, phone) - Manage user data via APIs (api) - Perform requests any time (refresh\_token, offline access) 8. Click Save. After you save the app, Salesforce populates the API section with the following IDs that you will use to configure Tableau Server: - Consumer Key - Consumer Secret - Callback URL ## Step 2: Configure Tableau Server for Salesforce.com OAuth Once you've enabled Tableau integration with Salesforce and you have the Customer Key, Customer Secret, and the Callback URL, you can configure Tableau Server for Salesforce data connections and outputs, and Einstein Discovery. 1. On the Tableau Server computer, at a command prompt, run the following commands: `tsm configuration set -k oauth.salesforce.client_id -v ` `tsm configuration set -k oauth.salesforce.client_secret -v ` `tsm configuration set -k oauth.salesforce.redirect_uri -v ` 2. (Optional) To change the default login server, type the following command: `tsm configuration set -k oauth.salesforce.server_base_url -v ` 3. Enter the following command to apply changes: `tsm pending-changes apply` If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). ## Configure custom OAuth for a site You can configure a custom Salesforce OAuth client for a site. Consider configuring a custom OAuth client to 1) override an OAuth client if configured for the server or 2) enable support for securely connecting to data that requires unique OAuth clients. When a custom OAuth client is configured, the site-level configuration takes precedence over any server-side configuration and all new OAuth credentials created use the site-level OAuth client by default. No Tableau Server restart is required for the configurations to take effect. **Important:** Existing OAuth credentials established before the custom OAuth client is configured are temporarily usable but both server administrators and users must update their saved credentials to help ensure uninterrupted data access. ### 1: Prepare the OAuth client ID, client secret value, and redirect URL Before you can configure the custom OAuth client, you need the information listed below. After you have this information prepared, you can register the custom OAuth client for the site. - **OAuth client ID and client secret value:** First register the OAuth client with the data provider (connector) to retrieve the client ID and secret value generated for Tableau Server. - **Redirect URL:** Note the correct redirect URL. You will need this during the registration process in **Step 2** below. https://.com/auth/add\_oauth\_token For example, https://example.com/auth/add\_oauth\_token ### 2: Register the OAuth client ID and client secret Follow the procedure described below to register the custom OAuth client to the site. 1. Sign in to your Tableau Server site using your admin credentials and navigate to the Settings page. 2. Under OAuth Clients Registry, click the Add OAuth Client button. 3. Enter the required information, including the information from **Step 1** above: 1. For Connection Type, select the connector whose custom OAuth client you want to configure. 2. OAuth Instance URL is required if multiple OAuth clients are being registered. Otherwise, it is optional. 3. For Client ID, Client Secret, and Redirect URL, enter the information you prepared in **Step 1** above. 4. Click the Add OAuth Client button to complete the registration process. ![A form for the creation of an OAuth client, including fields for connection type, OAuth instance URL, client ID, client secret, and redirect URL.](/tableau/next/en-us/server-linux/en-us/Img/oauth_custom.png) 4. (Optional) Repeat step 3 for all supported connectors. 5. Click the Save button at the bottom or top of the Settings page to save changes. ### 3: Validate and update saved credentials To help ensure uninterrupted data access, you (and your site users) must delete the previously saved credentials and add it again to use the custom OAuth client for the site. 1. Navigate to your My Account Settings page. 2. Under Saved Credentials for Data Sources, do the following: 1. Click Delete next to the existing saved credentials for the connector whose custom OAuth client you configured in **Step 2** above. 2. Next to connector name, click Add and follow the prompts to 1) connect to the custom OAuth client configured in **Step 2** above and 2) save the latest credentials. ### 4: Notify users to update their saved credentials Make sure you notify your site users to update their saved credentials for the connector whose custom OAuth client you configured in **Step 2** above. Site users can use the procedure described in [Update saved credentials](https://help.tableau.com/v0.0/server-linux/en-us/manage_stored_credentials.htm#oauth_update_credentials) to update their saved credentials. ## Manage access tokens After you configure the server for OAuth, you can allow users to manage their own access tokens in their profile settings, or you can manage the tokens centrally. For more information, see [Allow Saved Access Tokens](https://help.tableau.com/v0.0/server-linux/en-us/allow_saved_tokens.htm). [Skip to main content](#main-content) # Changing IdPs in Tableau Server for OpenID Connect This topic provides information about changing an identity provider (IdP) if you have configured Tableau Server to use OpenID Connect. ## Change providers You might decide to change the IdP that Tableau Server is configured to use. To do so, you follow the procedure that you used to configure the first IdP: establish an account, get a customer ID and secret, configure Tableau Server with that information, and provide the IdP with the redirect URL for Tableau Server. For more information, see [Configure Tableau Server for OpenID Connect](https://help.tableau.com/v0.0/server-linux/en-us/openid_auth_server_config.htm). ### Reset user identifiers However, you also need to perform an additional step: you must clear any user identifiers (`sub` values or claims) that have already been associated with Tableau Server users. The new IdP will have different `sub` values for each user, and you must clear the existing ones so that Tableau Server can store a new `sub` value when the user signs in using the new IdP. To clear sub values for users, use the `tabcmd reset_openid_sub` command. You can reset (that is, clear) `sub` values for an individual user, as in the following example: `tabcmd reset_openid_sub --target-username jsmith` You can also clear the sub value for all users using this command: `tabcmd reset_openid_sub --all` **Note:** Clearing user identifiers for members of an [identity pool](https://help.tableau.com/v0.0/server-linux/en-us/identity_pools.htm) is not supported. [Skip to main content](#main-content) # Changing the Identity Store Infrastructure or business changes may require you to change the identity store on Tableau Server. There are two kinds of identity stores: local and external. When you installed Tableau Server you configured either a local identity store or an external identity store. When you configure Tableau Server with a local identity store, all user and group information is stored and managed in the Tableau Server repository. In the local identity store scenario, there is no external source for users and groups. When you configure Tableau Server with an external store, all user and group information is stored and managed by an external directory service. Tableau Server must synchronize with the external identity store so that local copies of the users and groups exist in the Tableau Server repository, but the external identity store is the authoritative source for all user and group data. Examples of external identity stores are OpenLDAP and Active Directory. For more information about the Tableau identity store, see [Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm). You can change from local store to an external store, or you can change from an external store to a local store. In either case, to change the identity store type, you complete these steps: 1. Uninstall and then reinstall of Tableau Server. The procedure for full uninstall and clean install are at the end of this topic. 2. Restore content and permissions. In these steps the term "restore" does not refer to using the `TSM maintenance restore` command to restore the backup you are making. You cannot restore a backup (`.tsbak`) created on a Tableau Server instance that uses a different identity store than the target Tableau Server. The backup is a best practice safeguard, in case you need to go back to your original Tableau Server configuration. ![](/tableau/next/en-us/server-linux/en-us/Img/Road-sign-alert.png) ## Warning Changing the installation type on Tableau Server can be a complicated and time-consuming process. To avoid data loss or orphaning of content or users, you'll need to plan this process carefully. In all cases, user filters applied to workbooks and data sources will need to be updated manually after the change. Most importantly, determine how you will transition content and permissions to the new identity store after you reinstall Tableau Server. ## Methods for restoring content and permissions The following list describes two methods for restoring content and permissions after you reinstall Tableau Server. Select the method that best fits with your environmental requirements. - **Method 1: Use site export and import**—In this method, you start by exporting each site in your existing deployment. Then, you install the new server and configure it for the new identity store type. You then create new users in the default site on the new server. Finally, you import all the original sites. During the import stage, you can map the original identities to the new users that you created in the default site. **Note:** When migrating sites between instances of Tableau Server, the target site must be on a version of Tableau Server that is the equal to or later than the version of Tableau Server for the source site. Both the source and target sites must be from supported versions of Tableau Server. Because this method exports all content and permissions at each site, it is the best method for organizations that require a high fidelity replica of the content and permissions after the identity store change is complete. Some organizations require an identity store change as the result of an authentication change. In these cases, a different user name syntax is a often a requirement in the new model. This method, which includes a process of mapping original user names to new names, provides flexibility for such scenarios. - **Method 2: Fresh installation; users republish content**—In this method, you install a new version of Tableau Server and select the new identity store type during setup. You also create new sites. You then create users and give them access, and they republish their workbooks and data sources. Unlike the other method, in this one, you do not reuse any of your existing Tableau Server infrastructure. This method is most appropriate for smaller deployments with fairly autonomous and data savvy users. From an administrative perspective, this method is the simplest, since you're not actively porting over content. However, because you rely entirely on users to republish content, this method may not be successful for large organizations or for those where centralized oversight of content is required. ## User filters User filters are domain-specific. Therefore, when the domain of Tableau Server changes or authentication type changes, filters no longer function as expected. Although the user filters are generated by Tableau Server, after they are set by the user, the filters are stored in the workbooks and data sources. Neither of these methods for changing the identity store modifies the contents of the workbooks or data sources. As you plan the identity store change, you must also include a final task to correct user filtering in all workbooks and data sources with Tableau Desktop. ## User names and the Tableau Identity store If you are using Method 1, it's helpful to understand how Tableau Server stores user names in the Tableau identity store. Tableau stores all user identities in the repository, which coordinates content permissions and site membership with various services in Tableau Server. Generally, an identity store configured for Active Directory store user names in the format, `domain\username`. Some organizations use a UPN (`jsmith@domain.lan`). On the other hand, organizations that configure Tableau Server with local identity store usually create standard, truncated user names, such as `jsmith`. In all cases, these user names are literal strings that must be unique in the Tableau identity store. If you are changing from one identity store type to another, then your target authentication, SSO, or user provisioning solution may require a specific user name format. Therefore, to maintain all permissions, content, and user viability, one of the following must be true after you change the identity store type: - The new user names must match the original user names, or - The original user names must be updated to match a new format. If an authentication change is driving the identity store change, then the target authentication scheme will likely impose a user name syntax that is different than your original user names. Method 1 includes a process where you can map original user names to new user names. It's possible that the original user name format will work with the new authentication type. For example, if you used UPN names in a local identity store deployment, you might be able to use the same user names in an Active Directory deployment. You could also use the `domain\username` format for local identity store, as long as users continue to use that format to sign in to Tableau Server. If you are changing from local identity store to an external Active Directory store, review the topic, [User Management in Deployments with External Identity Stores](https://help.tableau.com/v0.0/server-linux/en-us/users_manage_ad.htm), as part of your planning process. ## Method 1: Use site export and import You must use the same version of Tableau Server for the export and import operations. 1. Export all sites on your server. See [Export or Import a Site](https://help.tableau.com/v0.0/server-linux/en-us/sites_exportimport.htm). 2. [Back up, remove, and then reinstall](#Back) . 3. Create new users on Tableau Server. You should have a new user that corresponds to each user on the original server. 4. Import the sites that you exported in Step 1. See [Export or Import a Site](https://help.tableau.com/v0.0/server-linux/en-us/sites_exportimport.htm). During import, you will be prompted to map the new users to the original users. ## Method 2: Fresh installation—users republish content Even if you do not plan to port content as part of your identity store change, we recommend that you back up the server. 1. [Back up, remove, and then reinstall](#Back) . 2. Create users, sites, and groups. 3. Inform your users of the new Tableau Server, provide them with credentials, and allow them to republish their content. ## Back up, remove, and then reinstall Both methods include the following steps: 1. Back up Tableau Server 2. Remove Tableau Server. 3. Reinstall Tableau Server with the new identity store type. ### Step 1: Back up Tableau Server As a best practice, you should back up the server before proceeding. Follow the procedure, [Create a backup using the TSM command line interface (CLI)](https://help.tableau.com/v0.0/server-linux/en-us/db_backup.htm#tsm-cli-steps). Run the `backup` command with the `–d` option. The `–d` option adds the datestamp. When you are finished, copy the backup file (`.tsbak`) to a safe location that is not a part of your Tableau Server installation. ### Step 2: Remove Tableau Server You must completely remove Tableau Server from the computer. See [Remove Tableau Server from Your Computer](https://help.tableau.com/v0.0/server-linux/en-us/remove_tableau.htm). ### Step 3: Reinstall Tableau Server with new authentication type 1. Go to the Tableau Customer Portal, sign in with your Tableau user name and password, and then download Tableau Server. 2. Install Tableau Server. See [Install and Configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm) more information. During installation, you will select the new identity store type. See [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm). [Skip to main content](#main-content) # Chargeback Reports Chargeback reports show usage on a per-project or per-site basis and are available for allowed users through the _Admin_ menu. The report is generated as a Tableau workbook using a generated extract, allowing you to modify the report or reuse the extract as needed. The _Chargeback Overview_ worksheet shows a breakdown of various metrics based on site and/or project: ![Overview](/tableau/next/en-us/server-linux/en-us/Img/rmt-rpts-chgback_overview.png) Overview Dollar amounts can be customized using the total cost field, and by adjusting the cost weights for each metric. Clicking on a project or site navigates to a customized invoice-style detail report for that project/site: ![Detail](/tableau/next/en-us/server-linux/en-us/Img/rmt-rpts-chgback_detail.png) Detail ## Security User access is controlled through the _Generate Chargeback Reports_ server role. ## Data Generation Data for the chargeback report is aggregated at the daily level, with the following metrics included in the data set: | Metric | Description | | --- | --- | | Extract File Usage | The size, in Kilobytes, of extract files is collected once per day. For the default report this is simply totaled across the time period for ratio/comparison purposes between projects/sites. | | Extract Query Duration | The length of time, in milliseconds, that queries running against extract files ran, totaled per day. | | Extract Refresh Task Duration | The length of time, in milliseconds, that extract refresh background tasks ran, totaled per day. | | Query Duration | The length of time, in milliseconds, that queries ran, totaled per day. This includes both extract and non-extract queries. | | View Request Duration | The length of time, in milliseconds, that requests to render views ran, totaled per day. This includes the duration of any data queries that blocked view rendering. | ### Who can do this Resource Monitoring Tool Administrator or a Resource Monitoring Tool user with **Server/Environment Management** role. [Skip to main content](#main-content) # Choose the Right Story Type for Your Tableau Desktop Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). When you [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/server-linux/en-us/data_stories_create.htm), it's important to choose the right type of story for your data. Do you want your story about trends over time? Or do you want your story about two values that you're comparing? To help you tell the right story, this topic describes the different types of stories, including an example of each story type. ## Continuous Continuous stories are best for analyzing trends or progress over time. When you create a continuous story, it includes content for performance, segments, volatility, and trend lines. The story also includes contribution analysis and correlation for stories that use more than one dimension. To use a continuous story, your worksheet must have: - 1 dimension that has between 1-10 measures - 2 dimensions and up to 3 measures The following example is a continuous story for a line chart that has a single dimension and multiple measures: ![Three line charts with a continuous story example](/tableau/next/en-us/server-linux/en-us/Img/data_stories_continuous.png) ## Discrete Discrete stories are best for comparing values and understanding the distribution of data in each value. When you create a discrete story, the story includes content about the distribution and groupings or clusters across the data. And the story includes contribution analysis for worksheets that use multiple dimensions. Consider using a discrete story when you want to: - Understand drivers of your key performance indicators (KPIs) in sales reports. - Identify and understand outliers quickly during data discovery. - Identify trends that aren't easily observable in the visual when performing an audit. - Uncover complex utilization insights instantly for geographic analysis. - Identify and call out key relationships, for example, between sales and profit. To use a discrete story, your worksheet must have: - 1 dimension that has between 1-10 measures - 2 dimensions and up to 3 measures The following example is a discrete story for a bar chart that has a single dimension and two measures: ![A bar chart with a discerete story example](/tableau/next/en-us/server-linux/en-us/Img/data_stories_discrete.png) ## Percent of whole Percent of whole stories are best for pie charts. To use a percent of whole story, your worksheet must have: - 1 dimension - 1 measure The following example is a percent of whole story that uses a pie chart with a single dimension and a single measure: ![A pie chart with a percent of whole story example](/tableau/next/en-us/server-linux/en-us/Img/data_stories_percent.png) ## Scatter plot Scatter plot stories are best for understanding the relationship between two measures. When you create a scatter plot story, the story includes content about the relationship (regression) between two measures. And the story includes content about groups (clusters) within the data, when they exist. Consider using a scatter plot story when you want to: - Call out relationships between two measures to identify impact (regression analysis). - Identify and understand outliers that are above or below defined thresholds. - Analyze how your data is distributed. To use a scatter plot story, your worksheet must have: - 1 dimension - 2 or 3 measures **Note:** When you create your scatter plot story, the first measure you select is treated as the independent variable and the second measure is the dependent variable. The following example is a scatter plot story that uses a scatter plot that has a single dimension and two measures: ![A scatter plot chart with a scatter plot story example](/tableau/next/en-us/server-linux/en-us/Img/data_stories_scatter.png) [Skip to main content](#main-content) # Clear Saved Data Connection Passwords As the server administrator, if you enable users to save data source passwords, server users can save data source passwords across multiple visits and browsers so they are no prompted for their credentials each time they connect to a data source. You can reset the data source passwords for all Tableau Server users. Doing this forces them to sign in to the data sources the next time they visit a view that requires database authentication. Server users can also clear their saved data connection passwords on an individual basis using their [User Preferences](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm) page. ### To clear saved data connection passwords for all server users: 1. In a single-site server, click Settings \> General. On a multi-site server, select Manage all sites, then click Settings > General. ![General tab of the Tableau site settings page.](/tableau/next/en-us/server-linux/en-us/Img/maintenance1a.png) 2. Under Saved Credentials, click Clear All Saved Credentials. ![Saved Credentials settings with the button to clear all saved credentials highlighted.](/tableau/next/en-us/server-linux/en-us/Img/maintenance5.png) [Skip to main content](#main-content) # Clickjack Protection Tableau Server includes protection against clickjack attacks. _Clickjacking_ is a type of attack against web pages in which the attacker tries to lure users into clicking or entering content by displaying the page to attack in a transparent layer over an unrelated page. In the context of Tableau Server, an attacker might try to use a clickjack attack to capture user credentials or to get an authenticated user to change settings on your server. For more information about clickjack attacks, see [Clickjacking](https://owasp.org/www-community/attacks/Clickjacking) on the Open Web Application Security Project website. **Note**: Clickjack protection was available in previous versions of Tableau Server, but was disabled by default. New installations of Tableau Server 9.1 and later will always have clickjack protection on unless you explicitly disable it. ## Effects of clickjack protection When clickjack protection is enabled on Tableau Server, the behavior of pages loaded from Tableau Server changes in the following ways: - Tableau Server adds the `X-Frame-Options: SAMEORIGIN` header to certain responses from the server. In the current versions of most browsers, this header prevents the content from being loaded into an ** [Skip to main content](#main-content) # Distributed and High Availability Tableau Server Installations This topic describes different installation deployment types for Tableau Server. ## Validating your server deployment plan Before you commit to installing a new Tableau Server deployment in your organization, be sure to carefully evaluate your options. For most organizations, Tableau Cloud will provide a more reliable, performant, and cost-effective analytics solution when compared to self-hosting Tableau Server. For information about the viability of Tableau Cloud for your organization, review this blog post, [Should I move my analytics to the cloud?](https://www.tableau.com/blog/should-i-move-my-analytics-cloud) Already running Tableau Server and want to migrate to Tableau Cloud? See [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm). ## Installation types The most basic way to run Tableau Server is to install a single node. With this type of installation you have a fully functional Tableau Server, with all Tableau Services Manager (TSM) and Tableau Server processes running on that single node, but this may not be the optimal way to use Tableau Server. You can decide how to install Tableau based on your organization's needs, and your resources, adding additional nodes and configuring Tableau for high availability. Your installation options include: - **Single-node installation**—This type of installation is reasonable for testing, running trials, and for environments that can handle occasional downtime and system availability due to lack of redundancy. All server processes are running on a single machine. There is less redundancy and fewer safeguards in the event of a problem with one of the server processes. You also need to make sure the computer you install Tableau Server on has adequate resources to handle the processes and the demands of users and data. - **Distributed installation**—This type of installation is also called a multi-node installation and requires multiple computers so you can install and run server processes on those distributed nodes. Spreading the server processes out over multiple nodes can extend the reliability and efficiency of Tableau Server by providing redundancy and additional computing power. With the right configuration, a distributed installation can also provide you with automatic repository failover. For more information on failover, see [Repository Failover](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_failover.htm) . - **Highly available (HA) installation**—An HA installation of Tableau Server is a special type of multi-node installation with a minimum of three nodes and multiple instances of key processes (the Repository, File Store/Data Engine (Hyper), Coordination Service, and Client File Service) on different computers. With an HA installation, there is built-in redundancy of those key processes, including multiple File Stores, and automatic Repository failover. The goal is to minimize system downtime by eliminating single points of failure, and enabling detection of failures with failover where possible. Downtime is still possible in the event of an initial node failure, or when a node running Application Server (VizPortal) is recovering from a failure. Dashboards and views may load more slowly than expected, and timeouts are possible, depending on how your system is configured and being used. For more information about initial node failure, see [If an initial node fails](#IfInitialNodeFails) below. The first computer you install Tableau on, the "initial node," has some unique characteristics. Three processes run only on the initial node and cannot be moved to any other node except in a failure situation, the License Service (License Manager), Activation Service, and TSM Controller (Administration Controller). Tableau Server includes a script that automates moving these processes to one of your other existing nodes so you can get complete access back to TSM and keep Tableau Server running. Two other processes are initially included on the initial node but can be added or moved to additional nodes, the CFS (Client File Service) and the Coordination Service. Depending on how your installation was configured with CFS and Coordination Service, you may also need to take steps to redeploy these. For information about moving the License service and TSM Controller from the initial node to another node, see [Recover from an initial node failure](#Recover) below. ### External repository For optimal performance for Tableau Server we recommend isolating the repository on a dedicated node in your deployment. If you have an Advanced Management license, consider running the repository as an external database. If your organization has a peak load of more than 1000 VizQL sessions per hour, we also recommend running Tableau Server on Linux. In this scenario, VizQL sessions refer to any user actions that display or generate visualizations from Tableau Server. For more information, see [Tableau Server External Repository](https://help.tableau.com/current/server-linux/en-us/server_external_repo.htm). ## Prerequisite These instructions assume that your cluster meets the [Distributed Requirements](https://help.tableau.com/v0.0/server-linux/en-us/distrib_requ.htm). All nodes in a multi-node cluster must have the same type of operating system and the same major version of that operating system. For example, all RHEL 9 nodes. You cannot install a multi-node instance of Tableau Server on a combination of Linux and Windows nodes. ### Licensing You must have a valid Tableau Server product key. The type of license you have may determine how many nodes you can install Tableau on. For more information on licensing, see [Licensing Overview](https://help.tableau.com/v0.0/server-linux/en-us/license_server_overview.htm). ## Creating a distributed Tableau Server installation These are the general steps you follow to create a distributed installation of Tableau Server: 1. Begin by installing Tableau Server on your initial node. For details, see [Install and Configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm). 2. Generate a node configuration (bootstrap) file on the initial node. For details, see [Generate the node bootstrap file](https://help.tableau.com/v0.0/server-linux/en-us/install_additional_nodes.htm#Generate_bootstrapCLI). 3. Install Tableau Server on an additional node using the node bootstrap file. For more information, see [Install and initialize an additional node](https://help.tableau.com/v0.0/server-linux/en-us/install_additional_nodes.htm#Install_additional_nodeCLI). 4. Configure your additional node with the processes you want to run on it. For more information, see [Configure the additional node](https://help.tableau.com/v0.0/server-linux/en-us/install_additional_nodes.htm#Config_additnl_nodeCLI). 5. Repeat Steps 3 and 4 for any additional nodes you want to install. 6. Deploy a new Coordination Service ensemble. For more information, see [Deploy a Coordination Service Ensemble](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_zk.htm) . 7. Add Client File Service to every node that is running the Coordination Service. For more information, see [Configure Client File Service](https://help.tableau.com/v0.0/server-linux/en-us/distrib_cfs.htm) . ## Creating a highly available (HA) Tableau Server installation A high availability Tableau Server installation is a special type of distributed installation, designed to accommodate failure in key server components without loss of complete server functionality. To create an HA installation, follow the same steps you take to create a distributed deployment but include additional steps to make the deployment highly available. These additional steps include adding at least two additional nodes (for a minimum of three nodes in the cluster), adding a second instance of the repository, and second instances of the data engine/file store, adding additional gateway processes, and deploying a Coordination Service ensemble. You can also add a load balancer to distribute requests among the gateways. At a high level, these are the steps you follow to create a highly available installation of Tableau Server: 1. Begin by installing Tableau Server on your initial node. For details, see [Install and Configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm). 2. Generate a node configuration (bootstrap) file on the initial node. For details, see [Generate the node bootstrap file](https://help.tableau.com/v0.0/server-linux/en-us/install_additional_nodes.htm#Generate_bootstrapCLI). 3. Install Tableau Server on at least two additional nodes using the node bootstrap file. For more information, see [Install and initialize an additional node](https://help.tableau.com/v0.0/server-linux/en-us/install_additional_nodes.htm#Install_additional_nodeCLI). 4. Configure each additional node with the processes you want to run on it. These must include a second copy of the Tableau Server repository, and a second copy of the data engine and file store, as well as additional instances of the gateway. For more information, see [Configure the additional node](https://help.tableau.com/v0.0/server-linux/en-us/install_additional_nodes.htm#Config_additnl_nodeCLI). 5. Deploy a Coordination Service ensemble. For more information, see [Deploy a Coordination Service Ensemble](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_zk.htm) . 6. Add Client File Service to every node that is running the Coordination Service. For more information, see [Configure Client File Service](https://help.tableau.com/v0.0/server-linux/en-us/distrib_cfs.htm) . 7. (Optional) Configure a load balancer. For more information, see [Add a Load Balancer](https://help.tableau.com/v0.0/server-linux/en-us/distrib_lb.htm). For details on how to create a three-node HA installation, see [Example: Install and Configure a Three-Node HA Cluster](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_install_3node.htm). ## If an initial node fails If there is a problem with the initial node and you have redundant processes on your other nodes, there is no guarantee that Tableau Server will continue to run. - Tableau Server can continue to run for up to 72 hours after an initial node failure, before the lack of the licensing service impacts other processes. If so, your users _may_ be able to continue to sign in and see and use their content after the initial node fails, but you will not be able to reconfigure Tableau Server because you won't have access to the Administration Controller. - If you are running a version of Tableau Server 2021.4.2 (or older) that is configured for ATR, then problems with the initial node will render all server functionality unavailable. This is true whether the node has a problem or if you intentionally stop it (for instance, to do a system-level patch). Even when configured with redundant processes, _it is possible that Tableau Server may not continue to function after the initial node fails_. This is true even when an installation is configured for high availability. This means you should make a point of moving the two unique processes to another of your running nodes as soon as possible. If your initial node fails for reasons that are recoverable in a relatively short amount of time (for example, a hardware failure you can correct), you should first attempt to bring the node back up without using the procedure below. ## Recover from an initial node failure With a Tableau Server installation, the initial node includes two services that are only installed on that node, the License service, and the TSM Controller. If there is a problem with the initial node, Tableau Server may not continue to function, even when configured for high availability. To recover from a situation where the initial node fails, you can move the TSM Controller and the License service to one of your already configured nodes. This allows you to recover from the failure while using resources you already have in the cluster. You do not have to configure a standby initial node in case the initial node fails. For details on how to recover from a failure on the initial node, see [Recover from an Initial Node Failure](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_init_node_fail.htm). ## Configure Coordination Service ensemble on additional nodes Configuring a Coordination Service on multiple nodes provides additional duplication of processes and so reduces the possibility of server downtime due to an issue with one of the Coordination Service nodes. For details on how to deploy a Coordination Service ensemble on your cluster, see [Deploy a Coordination Service Ensemble](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_zk.htm) . ## Add Client File Service (CFS) to additional nodes Tableau Server requires at least one instance of Client File Service (CFS). Adding additional instances of CFS to other nodes provides additional duplication of processes and so reduces the possibility of server downtime due to an issue with one of the CFS nodes. We recommend that you configure an instance of CFS on each of the nodes where you deploy the Coordination Service. For details on how to configure CFS on other nodes, see [Configure Client File Service](https://help.tableau.com/v0.0/server-linux/en-us/distrib_cfs.htm) . ## Tableau Server service license check A number of processes are installed when you install Tableau Server. Some of these processes are dependent on the existence of a valid Tableau Server license while other installed processes are not. The subset of Tableau Server that require a valid Tableau Server license are considered "licensed processes." When a licensed process starts or restarts, the process checks with the Tableau Server License Manager service on the initial node to verify there is a valid license. When the License Manager validates the license, the process is fully functional and able to respond to requests from other Tableau Server processes. Once a licensed process has received confirmation from the License Manager, the process does not need to reconfirm the license for 72 hours, or until the process restarts. If the process is not able to verify that it is licensed (if the primary node is unavailable, for example) it cannot run, but it continues to check for a valid license until it confirms the license. To see when the last licensing check occurred, look at the log files in the `/var/opt/tableau/tableau_server/data/tabsvc/logs/licenseservice` directory. For more information about licensed processes, see [Licensed processes](https://help.tableau.com/v0.0/server-linux/en-us/processes.htm#LicensedProcess). ## Other articles in this section [Skip to main content](#main-content) # Distributed Installation Recommendations When you add nodes to a Tableau Server installation, you must decide how many processes to run on each computer. This page provides some general recommendations that are intended only as a starting point. In addition to these general recommendations, you should also: - Understand how your organization uses Tableau Server and tune your configuration for your use case—for example, whether you want to optimize for user response or for extract refreshes. - Perform thorough performance testing to identify the best places to adjust process configuration. For more information on tailoring a Tableau Server installation to your organization's needs, see [Performance Tuning](https://help.tableau.com/v0.0/server-linux/en-us/perf_tuning.htm). For more information on the requirements for a distributed installation and for information on configuring additional nodes, see [Distributed and High Availability Tableau Server Installations](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha.htm). ## Recommendations for all installations Although the computers that make up a Tableau Server cluster do not need to have identical hardware, they must all meet the same minimum system requirements. The recommendations on this page assume that the computers where you install Tableau Server have eight cores or more. The following recommendations apply to all server configurations: - Run Backgrounder processes on a dedicated computer if you plan on refreshing extracts frequently. Backgrounder processes are generally the most CPU intensive and can slow down other processes on the same computer. - If you plan to refresh extracts frequently or if you plan to refresh large extracts, increase the number of processes for Backgrounder processes. - Run VizQL processes on a different computer than Backgrounder processes. Having them on the same machine means that extract refreshes can affect user views. - The instance of Data Engine installed on the node where File Store is installed is used for querying data for view requests. Consider separating the File Store process from the backgrounder processes to help minimize the backgrounder tasks from affecting user views. - **Optimizing with topology configurations:** - Co-locating File Store on the same node as the Administration Controller can reduce the length of time it takes to back up Tableau Server by reducing or eliminating the need to transfer data between nodes during the backup process. This is especially true if your organization uses many extracts. - Co-locating the repository (pgsql) with the Administration Controller node can also help to reduce back up time, but the time savings is less significant than that of the File Store. The Administration Controller is usually on the initial node, unless you have had an initial node failure and moved the controller to another node. **Note:**In a distributed installation with three or more nodes, you can have a maximum of two repository instances (active and passive). You can also run Tableau Server with one repository, but doing this means there is no failover available for the repository. For more information, see [Tableau Server Repository](https://help.tableau.com/v0.0/server-linux/en-us/server_process_repository.htm). [Skip to main content](#main-content) # Distributed Requirements Before you start to configure a Tableau Server cluster, make sure you meet the following requirements. ## Hardware While the computers you use in your cluster must meet the requirements described in [Before you install...](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm), they do not need to be identical. ## Hardware Guidelines for High Availability Here are some guidelines for the systems you use for [failover and high availability](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha.htm): - **Failover—three computers**: To configure a cluster that provides failover support for the file store and repository processes, you need at least three computers or VMs: one for the initial Tableau Server node and two for additional nodes. - **Multiple gateways—three computers and a load balancer**: Adding multiple Gateway processes to your Tableau Server installation and using a load balancer to automatically distribute requests to those gateways enhances the reliability of Tableau further. To configure a cluster that provides failover support and multiple gateways, you need to add a load balancer to front your three-node cluster. - **Failover & multiple gateway support—three computers and a load balancer**: To configure a cluster that provides the above plus support for multiple gateways, you need at least three computers or VMs, and a load balancer to front the cluster. - **High availability—three computers and a load balancer**: To configure for high availability, you need the resources described above. - **Initial computers**: If you configure for high availability, the initial Tableau Server node may be running few or no Tableau Server processes. Therefore, the computer that serves as the initial node does not need as many cores as the ones running your additional nodes. You will, however, need adequate disk space for backups because the initial computer is used during the backup and restore processes. In addition to the amount of space needed for the backup file, you need temporary disk space. For details on disk space requirements, see [Disk Space Usage for Backup and Restore](https://help.tableau.com/v0.0/server-linux/en-us/db.htm#backupDiskSpace). ## Software Requirements for Multi-node Server - All nodes in a multi-node installation must be running the same version of Tableau Server. - All nodes in a multi-node cluster must have the same type of operating system and the same major version of that operating system. For example, all RHEL 9 nodes. You cannot install a multi-node instance of Tableau Server on a combination of Linux and Windows nodes. ## Installation location Keep in mind the following requirements and limitations: - The installation and data directory locations for Tableau Server must be the same on all nodes in a cluster. - You can specify a non-default install location on RHEL-like distributions, but cannot change the location on Ubuntu. For more information, see [Installation directory](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm#InstallDir). - When you initialize Tableau you can specify a non-default location for the data directory. For more information, see [Data directory](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm#Data). ## Networking and Ports - **Ports**: As with any distributed system, the computers or VMs you use need to be able to communicate with one another. For information on how Tableau Services Manager handles port mapping, see [Tableau Services Manager Ports](https://help.tableau.com/v0.0/server-linux/en-us/ports.htm). - **Latency**: Network latency between server nodes can impact Tableau Server performance. Be aware of possible latency issues, especially if you run into performance problems. To reduce network latency, you can take steps such as locating your gateways and data sources in proximity to Tableau Server. - **Static IP addresses**: Any computer running Tableau Server, whether it's a single server installation or part of a cluster, must have a static IP address. - **Discoverable**: Each node in the cluster must be discoverable from other node computers using DNS or a local host file. - **Time zone and time**: Each node in the cluster must be in the same timezone, with their system clocks synchronized. This may happen automatically. For example, if your nodes are all in the Active Directory domain, the domain controller usually handles this. If you are not sure your cluster meets this requirement, consult with your internal IT experts. ## Best Practices Here are some things to keep in mind before you start to install and configure: - **IP addresses or computer names**: As mentioned above, each computer in the cluster must use a static IP address. - **Backup**: It's a best practice to create a backup prior to making significant system changes. See [Back up Tableau Server Data](https://help.tableau.com/v0.0/server-linux/en-us/db_backup.htm) for steps. ## SSL If you are planning to configure SSL for a highly available Tableau Server cluster with multiple gateways and a load balancer ([learn more](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha.htm)), make sure that the SSL certificate you use was issued for the load balancer's host name. See [Configure SSL for External HTTP Traffic to and from Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/ssl_config.htm) for other details. [Skip to main content](#main-content) # Domain Trust Requirements for Active Directory Deployments When you run Tableau Server in an Active Directory environment across multiple domains (either in the same Active Directory forest or in different forests), some Tableau functionality is dependent on the trust relationship between the domains. For example, some administrators manage users in domains that are separate from where they deploy server applications, such as Tableau Server. In other organizations, a Tableau Server deployment might be shared with external partners or with different partners in the organization. Finally, Windows-authenticated data sources, such as SQL Server, MSAS, or Oracle, that Tableau Server connects to may also be in other domains. If it's feasible, we recommend configuring two-way trust between all domains that interact with Tableau Server. If this is not possible, Tableau Server can be configured to support user authentication where a one-way trust has been configured. In this case, a one-way trust between domains is supported when the domain in which Tableau Server is installed is configured to trust the domain where user accounts reside. The following illustration shows one-way trust between the domain where Tableau Server is installed and the domain where user accounts reside: ![Two triangles, one labeled "users.lan" and the other "dev.local", with an arrow denoting "trust" directed towards the former.](/tableau/next/en-us/server-linux/en-us/Img/runas_oneway_trust.png) In this scenario, Tableau Server is in the dev.local domain, and users from the users.lan Active Directory domain are imported into Tableau Server. A one-way trust is required for this scenario; specifically, the dev.local domain is configured to trust the users.lan domain. Users in the users.lan domain can access Tableau Server in the dev.local with their normal Active Directory credentials. However, you may need to update the domain nickname on Tableau Server before users log on with the nickname. Refer to the [Tableau Knowledge Base](http://kb.tableau.com/articles/Issue/users-from-new-domain-unable-to-log-in-and-do-not-appear-in-user-list) for more information. When you configure Tableau Server for this scenario, specify the primary user domain during installation. See [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm). To ensure that Tableau Server can connect to other Active Directory domains, you must also specify other domains that Tableau Server connects to by setting the `wgserver.domain.accept_list` option with TSM. For more information, see [wgserver.domain.accept\_list](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#wgserver-domain-acceptlist). ### Duplicate bind accounts for domain trust Tableau Server on Linux relies on JDK's LDAP implementation that uses a simple bind to authenticate with Active Directory. Simple bind is not domain-aware and as a result, does not support a cross-domain bind. When you set up the initial identity store, you must supply the bind account that you will use to authenticate to Active Directory. To enable cross-domain trust and directory look-ups, you must duplicate this bind account in every target domain. Each bind account in each domain must use the same username (`sAMAccountName` or `dn`) and password. Kerberos single sign-on is supported in this one-way trust scenario. Review [User Management in Deployments with External Identity Stores](https://help.tableau.com/v0.0/server-linux/en-us/users_manage_ad.htm) to understand how multiple domains, domain naming, NetBIOS, and Active Directory user name format influence Tableau user management. ### Connecting to live data in one-way trust scenarios In the one-way trust scenario, users connecting to Tableau Server can connect to live data that's hosted in the cloud or on any other data source on premises that does not rely on Windows authentication. Data sources that require Windows-authentication might have additional authentication requirements that complicate the scenario, or that can even prevent Tableau Server users from connecting. This is because Tableau Server uses a service account for authentication with such data sources. If you are running Tableau Server in a different domain than data sources that use Windows authentication, verify that the service account that is used for Tableau Server can access the data source. [Skip to main content](#main-content) # Dynamic Scaling in a Container - Tableau Server Backgrounders ## Introduction The dynamic scaling of Backgrounder in a container enables various scaling strategies to be applied to backgrounder and scheduled jobs in Tableau Server. Autoscaling in this context means services can be independently scaled to handle variable task loads without requiring human intervention or impacting uptime of other server systems. The Tableau Server Containers which contain complete nodes of Tableau Server processes will continue to run as monolithic systems. Instead a smaller set of decoupled independent container services which comprise the "backgrounder" service role will be dynamicly scalable and handle computational load that would normally be handled by Tableau Server Containers. Backgrounder services are responsible for processing system tasks that include refreshing/creating extracts, sending subscriptions, checking data alerts, and many maintenance jobs. If there are times, for example, where it would be advantageous to refresh a large number of datasets or compute a swath of computationally expensive data alerts, you can now leverage Kubernetes to scale up compute power to complete those tasks efficiently. This guide is covers the configuration and deployment requirements for Autoscaling Backgrounders in Kubernetes. This document is a supplement to the [Tableau Server in a Container](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container.htm) documentation. ## Prerequisites Autoscaling Backgrounders is only available in Kubernetes and is based on Tableau Server in Containers. In order to use the autoscaling backgrounders feature, you must satisfy certain prerequisite: - Tableau Server must have Advanced Management capabilities. For more information, see [About Tableau Advanced Management on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm). - You must be using Role-based licensing. Core licenses are not supported. For details on licensing, see [Understanding License Models and Product Keys](https://help.tableau.com/v0.0/server-linux/en-us/license_product_keys.htm). - The following Advanced Management features must be enabled: - [Tableau Server External File Store](https://help.tableau.com/v0.0/server-linux/en-us/server_external_filestore_storage.htm) - [Tableau Server External Repository](https://help.tableau.com/v0.0/server-linux/en-us/server_external_repo.htm) - You must have a Kubernetes cluster version 1.20 or later and understand how to use and manage it. ## Limitations - This feature only works as a part of a Linux-based deployment. - Flow jobs are not supported on the autoscaling backgrounders. Flow jobs will be handled by the backgrounder services that continue to run in the Tableau Server container. ## Creating Tableau Server and Backgrounder Pod Images The first step for using autoscaling backgrounders in containers is to create the service images that comprise the Tableau Server installation. These images will include the Tableau Server image, as well as images for the separate backgrounder and supporting services. You use the same build tool that is used to create the comprehensive all-in-one Tableau Server container image, but the tool must be version 2022.3.0 or later, you must have an Advanced Management license, and you need to use a special flag when building the images. 1. To create the service images, run this command: build-image --accepteula -i --backgrounder-images This creates the Tableau Server and four new images. These additional images contain individual services that comprise the new autoscalable backgrounder pod. The `docker images` command lists the images created in the local docker repository: hyper 20214.21.1117.1006 52fd9843c178 10 seconds ago gateway 20214.21.1117.1006 2308e602a2a3 11 seconds ago backgrounder 20214.21.1117.1006 4540e459cf23 12 seconds ago dataserver 20214.21.1117.1006 c5345ed47f51 12 seconds ago tableau\_server\_image 20214.21.1117.1006 b27817047dd1 7 minutes ago The hyper, gateway, backgrounder, and dataserver images comprise the new Backgrounder pod. Custom drivers, installation scripts, and properties will be shared across all five of these images. For more information, see [Customizing the image](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container_setup-tool.htm#CustomizingImage). 2. Publish all of these images to your internal image repository for deployment. ## Deployment Guide The following information provides context for how to deploy Tableau Server in a Container and with Autoscaling Backgrounders. This information assumes you already understand and know how to deploy Tableau Server in a self-container container. For more information, see [Tableau Server in a Container](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container.htm). The three Kubernetes configuration files in the Kubernetes Configuration section are templates that can be used to set up the deployment. The other sections in this guide cover the requirements and details of the deployment. Deployment of Tableau Server and Autoscaling Backgrounders should be as simple as deploying the populated Kubernetes Configuration files at the bottom of the guide: kubectl apply -f ### Backgrounder Jobs Backgrounder pods assist the Tableau Server in a Container compute additional scheduled workloads in parallel. Backgrounder handles extract refresh, subscription, alert, flow, and system workloads. Distributing jobs among backgrounder pods means there will be more compute resources available for Tableau Server to handle other tasks, like interactive user activities like rendering workbooks and dashboards. Flow jobs are the only type of backgrounder job that does not run in the backgrounderFor details about Backgrounder jobs, see [Managing Background Jobs in Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/server_backgrounder_job_management.htm). Backgrounder pods can handle any kind of load, except flow jobs, which must be run in the main Tableau Server containers, which continue to run the backgrounder service. The Node Roles feature give users the flexibility to dedicate backgrounder pods for specific type of jobs. This feature is an extension of the Node Roles Feature on Tableau server. The detailed description about different node roles can be found here. Note, by default flow jobs are disabled on the backgrounder pods (i.e. the role is set to "no-flows") since the backgrounder pods are unable to run flow jobs. To setup up node roles for backgrounder, you need to set the environment variable `NODE_ROLES` as part of kubeconfig for the container running backgrounder service. For example to set backgrounder to run only extract-refresh jobs, set up `NODE_ROLES` environment variable to extract-refreshes as shown below: #### NODE\_ROLE\_CONFIG containers: - name: backgrounder image: # Backgrounder Image ports: - containerPort: 8600 volumeMounts: - name: logmount mountPath: /var/log/tableau - name: clone-volume mountPath: /docker/clone - name: dataengine-volume mountPath: /docker/dataengine - name: temp mountPath: /var/opt/tableau/tableau\_server/data/tabsvc/temp env: - name: ROOT\_LOG\_DIR value: /var/log/tableau - name: CLONE\_ARTIFACT\_DIR value: /docker/clone/clone-artifacts - name: FILESTORE\_MOUNT\_PATH value: /docker/dataengine - name: NODE\_ROLES value: extract-refreshes The Tableau Server pods will have at least one backgrounder configured in their topology, which is required to ensure there is always a place to run backgrounder jobs. By default, TSM will require that there must be a backgrounder able to handle every role of background job. In some scenarios, you may want to have backgrounder pods handle all jobs of a particular type. To do so, you must set the Server configuration key `topology.roles_handle_all_jobs_constraint_disabled` to `true`, which will disable the requirement that the TSM topology handle all job types. With this parameter set, the backgrounder role for the Tableau Server backgrounder instance could be set to `no-extract-refreshes` and the role for the backgrounder pods could be set to `extract-refreshes`, which would ensure that all extract refresh jobs run only on the backgrounder pods. **Note:** Disabling this constraint allows you to configure roles such that some job types are never scheduled. The role configuration of TSM backgrounders and backgrounder jobs must be set carefully because TSM will no longer be verifying that all backgrounder job types can be scheduled. ### Tableau Server in a Container Pods The containers with Tableau Server as part of the autoscaling backgrounder pods deploy in almost the same way that our existing Tableau Server in a Container does. There are a few key requirement changes: - A network file share is _required_ to transfer configuration between the Tableau Server container and the backgrounder pods. - You must enable and use the External Filestore feature. This also requires a dedicated network file share. ### Backgrounder Pods Backgrounder pods consist of four independent service containers working together: **gateway**, **hyper**, **dataserver**, and **backgrounder**. You may deploy these pods like typical independent Kubernetes container pods. The pods have the following requirements: - Backgrounder pods must be able to reach the Tableau Server node using hostname DNS resolution. - External Filestore and Clone network file shares must be provided. **Note:** Backgrounder pods are configured with an init-container to wait until the Tableau Server container has successfully produced clone configuration output before proceeding to run. #### Logs Backgrounder pod services (like Tableau Server) still write logs predominately to disk. Because the backgrounder pods can be scaled in and out, they are ephemeral so it is essential to ensure that logs are stored off of the pods. Many customers with existing K8s environments will already be using a log aggregation service of some type to collect the logs from the pods they deploy. Examples of log aggregation services are Splunk, and fluentd. We strongly recommend that customers use some sort of log aggregation service to collect the logs from their backgrounder pods. To make log management easier, the kubeconfig we provide configures each service in the pod to write to a shared log volume. The path of the directory in each service container is specified by the `ROOT_LOG_DIR` environment variable. If you need to open a support case and provide logs, you will provide two sets of logs: ziplogs gathered from the main Server containers, and logs from the backgrounder pods (either retrieved from your log aggregation service, or using the manual process below). For customers that are unable to use a log aggregation service, logs can be retrieved manually from the pods. **Note:** Logs from any pod that did not use a Persistent Volume Claim for the volume containing the logs will be lost when the pod is scaled down! All the relevant logs are available at the `/var/log/tableau` directory (configurable via the `ROOT_LOG_DIR` environment variable) inside the backgrounder pod. We highly recommend you mount a PersistantVolumeClaim at this location so that logs are available when the pod dies. ##### Collecting logs when the backgrounder pod is running: Create a tar file of the logs inside the container: kubectl exec -it -- bash -c "tar -czf /docker/user/backgrounder-pod-logs.tar.gz /var/log/tableau" Copy the tarfile to outside the container: kubectl cp :docker/user/backgrounder-pod-logs.tar.gz ./backgrounder-pod-logs.tar.gz ##### Collecting logs when the backgrounder pod has exited (or failed to start) Attach any long-running pod with PersistantVolumeClaim mount which is used for backgrounder pod deployment logs. One example configuration: apiVersion: v1 kind: Pod metadata: name: namespace: spec: containers: - name: get-logs-pod image: busybox:1.28 securityContext: runAsUser: 0 allowPrivilegeEscalation: true command: \['sh', '-c', "while :; do sleep 5; done"\] volumeMounts: - name: logmount mountPath: /var/log/tableau restartPolicy: Never volumes: - name: logmount persistentVolumeClaim: claimName: logvolume Create a tar file of the logs inside container: kubectl exec -it -- bash -c "tar -czf /backgrounder-pod-logs.tar.gz /var/log/tableau" Copy the tarfile to outside the container: kubectl cp :/backgrounder-pod-logs.tar.gz ./backgrounder-pod-logs.tar.gz #### Live Configuration Changes If you make configuration changes in Tableau Server in a Container (for example using the tsm command line) and want those configuration changes to be represented in Backgrounder pods, you need to run the `[tsm settings clone](https://help.tableau.com/v0.0/server-linux/en-us/cli_settings_tsm.htm#TSMSettingsClone)` command to produce a new set of clone configuration files ("clone payload"). 1. Use TSM to make configuration changes in the Tableau Server in a Container pod and apply the configuration changes to the server. 2. Run the following command in the Tableau Server in a Container pod: \## Run this command in the Tableau Server in a Container pod. tsm settings clone -d $CLONE\_ARTIFACT\_DIR This command creates a new set of configuration files and writes it to the Clone NFS drive location. 3. Redeploy your backgrounder pods. The pods should be configured to use the Clone NFS drive and will pick up the new configuration. ### Scaling Strategies Backgrounder pods can be scaled in Kubernetes using a variety of techniques and strategies. We provide an example scaling strategy that changes Backgrounder pod pool size based on a time schedule. Note that CPU and memory utilization are **not** good metrics for scaling Backgrounder pods. Memory and CPU utilization do not accurately portray the overall load demand on the cluster. For example, a Backgrounder pod could be at max utilization to refresh an extract, but there are no additional jobs waiting in the Backgrounder job queue. In this case autoscaling would not improve job throughput. #### Scheduled Scaling Standard Kubernetes mechanisms using cron jobs allow you to schedule a scaling solution. An example Kubernetes configuration for this is provided in the Kubernetes Configuration section below. ## Kubernetes Configuration ### New Environment Variables In addition to the standard Tableau Server container environment variables (see [Initial Configuration Options](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container_image.htm#InitialConfigOptions-container)), there are some new required environment variables that must be set in the Kubernetes Configuration.

Environment Variable	Recommended Value	Description
`FILESTORE_MOUNT_PATH`	`/docker/dataengine`	External Filestore directory mount location. This directory should point to the dataengine NFS directory mounted inside each deployed Tableau container. For more information about External Filestore, see Tableau Server External File Store. The value should be the same for the Tableau Server in a Container pod and the Backgrounder pod.
`CLONE_ARTIFACT_DIR`	`/docker/clone/clone-artifacts`	Clone configuration directory mount location. This directory should point to an NFS directory mounted inside each Tableau container. Tableau Server will ouput configuration data that Backgrounder Pods consume to become members of the cluster.
`ROOT_LOG_DIR`	`/var/log/tableau`	(Backgrounder pods only) Common log directory location for all services running in a backgrounder pod.

### Backgrounder Pod Ports Backgrounder pods consist of four services, each by default is set to run on a specified port. If you want to change the port the service attaches to inside the container, you need to supply the key that corresponds to the service's port assignment. This kind of configuration should not be necessary in most cases, unless there is a sidecar container or some other additional component that is being added to the pod and conflicts with a service's port. | Port Environment Variable | Default | | --- | --- | | `BACKGROUNDER_PORT` | `8600` | | `DATASERVER_PORT` | `8400` | | `HYPER_PORT` | `8200` | | `GATEWAY_PORT` | `8080` | Dataserver also uses port 8300, which cannot be reconfigured. ### Shared Network Directory This deployment of Tableau Server requires two network shares to function properly. Note in all Tableau Server and Backgrounder od Kubernetes configuration templates these network directories are present: - **Dataengine Directory** (`FILESTORE_MOUNT_PATH`): Backgrounder Pods require the External Filestore feature. This network share contains extracts and other file-based artifacts that will be shared between Tableau Server and Backgrounder Pods. - **Clone Directory** (`CLONE_ARTIFACT_DIR`): Tableau Server writes static connection and configuration information to a network share. Backgrounder pods will consume this information to become members of the Tableau Server cluster. In future pre-releases this configuration will be incorporated into the standard life cycle of Kubernetes configuration. **Important:** If you want to redeploy the cluster entirely (including a new Tableau Server Container), you must purge the contents of the clone NFS mount (otherwise backgrounder pods will attempt to attach to the old server). ### Kubernetes Configuration Examples **Note:** The configuration examples include use of a readiness probe. You can use the readiness probe when your Tableau Server Container deployment is a single-node TSM deployment (the deployment can include multiple backgrounder pods). You cannot use a readiness probe with multi-node Tableau Server in a Container deployments. #### Tableau Server Container Config \--- apiVersion: v1 kind: Service metadata: name: namespace: spec: selector: app: ports: - protocol: TCP port: 8080 nodePort: name: http - protocol: TCP port: 8443 nodePort: name: https type: NodePort \--- apiVersion: v1 kind: ConfigMap metadata: name: configfile namespace: data: config.json: |- { "configEntities": { "identityStore": { "\_type": "identityStoreType", "type": "local" } }, "configKeys" : { "tabadmincontroller.init.smart\_defaults.enable" : "false", "wgserver.domain.ldap.starttls.enabled" : "false" }, "daysLeftForMaintenanceExpiring" : 0 } \--- apiVersion: v1 kind: ConfigMap metadata: name: extrepojsonfile namespace: data: config.json: |- { "flavor":"generic", "masterUsername":"", "masterPassword":"", "host":"", "port":5432, "prerequisiteCheckEnabled":false, "requireSsl":false } \--- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: datadir1 namespace: spec: accessModes: - ReadWriteOnce resources: requests: storage: 50Gi \--- \# This is required for multi-node tableau server in container apiVersion: v1 kind: PersistentVolume metadata: name: bootstrapnfs namespace: spec: accessModes: - ReadWriteMany capacity: storage: 1Gi nfs: server: path: \--- \# This is required for multi-node tableau server in container apiVersion: v1 kind: PersistentVolumeClaim metadata: name: bootstrapnfs namespace: spec: accessModes: - ReadWriteMany storageClassName: "" resources: requests: storage: 1Mi \--- apiVersion: v1 kind: PersistentVolumn metadata: name: clonenfs namespace: spec: accessModes: - ReadWriteMany capacity: storage: 1Gi nfs: server: path: \--- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: clonenfs namespace: spec: accessModes: - ReadWriteMany storageClassName: "" resources: requests: storage: 1Mi \--- apiVersion: v1 kind: PersistentVolume metadata: name: dataenginenfs namespace: spec: accessModes: - ReadWriteMany capacity: storage: 1Gi nfs: server: path: \--- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: dataenginenfs namespace: spec: accessModes: - ReadWriteMany storageClassName: "" resources: requests: storage: 1Mi \--- apiVersion: v1 kind: Secret type: Opaque metadata: name: tableau-server-in-a-container-secrets namespace: stringData: license\_key: # Tableau License Key String tableau\_username: # Initial admin username in Tableau Server tableau\_password: # Initial admin password \--- apiVersion: apps/v1 kind: StatefulSet metadata: name: tableau-server namespace: labels: app: spec: selector: matchLabels: app: replicas: 1 serviceName: template: metadata: labels: app: spec: securityContext: runAsUser: 999 fsGroup: 998 fsGroupChangePolicy: "OnRootMismatch" terminationGracePeriodSeconds: 120 dnsPolicy: "None" dnsConfig: nameservers: - # DNS IP for resolving container hostnames searches: - ..svc.. # SRV Record - .svc.. # SRV Record - svc.. # SRV Record - . # SRV Record options: - name: ndots value: "5" initContainers: # init containers are optional, to clear directory content if already exists - name: clean-bootstrap-dir image: busybox:1.28 securityContext: runAsUser: 0 allowPrivilegeEscalation: true volumeMounts: - name: bootstrap mountPath: /docker/config/bootstrap command: \['sh', '-c', 'rm -rf /docker/config/bootstrap/\* || true'\] - name: clean-clone-artifacts-dir image: busybox:1.28 securityContext: runAsUser: 0 allowPrivilegeEscalation: true volumeMounts: - name: clone mountPath: /docker/clone command: \['sh', '-c', 'rm -rf /docker/clone/clone-artifacts || true'\] containers: - name: # Name of container image: # Tableau Server in Container Image env: - name: LICENSE\_KEY valueFrom: secretKeyRef: name: tableau-server-in-a-container-secrets key: license\_key - name: FILESTORE\_MOUNT\_PATH value: /docker/dataengine - name: CLONE\_ARTIFACT\_DIR\_FOR\_INDEPENDENT\_CONTAINERS value: /docker/clone/clone-artifacts - name: SERVER\_FOR\_INDEPENDENT\_SERVICE\_CONTAINERS value: "1" - name: EXT\_REP\_JSON\_FILE value: /docker/external-repository/config.json - name: TABLEAU\_USERNAME valueFrom: secretKeyRef: name: tableau-server-in-a-container-secrets key: tableau\_username - name: TABLEAU\_PASSWORD valueFrom: secretKeyRef: name: tableau-server-in-a-container-secrets key: tableau\_password resources: requests: memory: 40Gi cpu: 15 limits: memory: 40Gi cpu: 15 ports: - containerPort: 8080 volumeMounts: - name: configmount mountPath: /docker/config/config.json subPath: config.json - name: externalrepomount mountPath: /docker/external-repository - name: datadir1 mountPath: /var/opt/tableau - name: bootstrap mountPath: /docker/config/bootstrap - name: clone mountPath: /docker/clone - name: dataengine mountPath: /docker/dataengine imagePullPolicy: IfNotPresent startupProbe: exec: command: - /bin/sh - -c - /docker/server-ready-check initialDelaySeconds: 300 periodSeconds: 15 timeoutSeconds: 30 failureThreshold: 200 readinessProbe: exec: command: - /bin/sh - -c - /docker/server-ready-check periodSeconds: 30 timeoutSeconds: 60 livenessProbe: exec: command: - /bin/sh - -c - /docker/alive-check initialDelaySeconds: 600 periodSeconds: 60 timeoutSeconds: 60 volumes: - name: configmount configMap: name: configfile - name: externalrepomount configMap: name: extrepojsonfile - name: datadir1 persistentVolumeClaim: claimName: datadir1 - name: bootstrap persistentVolumeClaim: claimName: bootstrapnfs - name: clone persistentVolumeClaim: claimName: clonenfs - name: dataengine persistentVolumeClaim: claimName: dataenginenfs #### Backgrounder Pod Config \--- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: logvolume namespace: spec: accessModes: - ReadWriteOnce resources: requests: storage: 20Gi \--- apiVersion: apps/v1 kind: Deployment metadata: name: backgrounder labels: app: backgrounder namespace: spec: replicas: 2 selector: matchLabels: app: backgrounder template: metadata: labels: app: backgrounder spec: securityContext: runAsUser: 999 runAsGroup: 998 fsGroup: 998 fsGroupChangePolicy: "OnRootMismatch" hostname: backgrounder dnsPolicy: "None" dnsConfig: nameservers: - # DNS IP for resolving container hostnames searches: - ..svc.. # SRV Record - .svc.. # SRV Record - svc.. # SRV Record - . # SRV Record options: - name: ndots value: "5" initContainers: - name: init-myservice image: busybox # This init-container is optional (as long as there is a mechanism to set the log volume directory permissions and the pod waits for clone artifacts) securityContext: runAsUser: 0 allowPrivilegeEscalation: true env: - name: CLONE\_ARTIFACT\_DIR\_FOR\_INDEPENDENT\_CONTAINERS value: /docker/clone/clone-artifacts volumeMounts: - name: logmount mountPath: /var/log/tableau - name: clone-volume mountPath: /docker/clone command: \['sh', '-c', "chmod 777 /var/log/tableau && while \[ ! -d ${CLONE\_ARTIFACT\_DIR\_FOR\_INDEPENDENT\_CONTAINERS} \]; do sleep 5; done"\] containers: - name: backgrounder image: # Backgrounder Image ports: - containerPort: 8600 imagePullPolicy: IfNotPresent readinessProbe: exec: command: - /bin/sh - -c - /tsm\_docker\_utils/status\_check.sh | grep -E 'ACTIVE|BUSY' periodSeconds: 30 timeoutSeconds: 60 livenessProbe: exec: command: - /bin/sh - -c - /tsm\_docker\_utils/status\_check.sh | grep -E 'ACTIVE|BUSY' initialDelaySeconds: 600 periodSeconds: 60 timeoutSeconds: 60 volumeMounts: - name: logmount mountPath: /var/log/tableau - name: clone-volume mountPath: /docker/clone - name: dataengine-volume mountPath: /docker/dataengine - name: temp mountPath: /var/opt/tableau/tableau\_server/data/tabsvc/temp env: - name: ROOT\_LOG\_DIR value: /var/log/tableau - name: CLONE\_ARTIFACT\_DIR\_FOR\_INDEPENDENT\_CONTAINERS value: /docker/clone/clone-artifacts - name: FILESTORE\_MOUNT\_PATH value: /docker/dataengine - name: dataserver image: # Dataserver Image ports: - containerPort: 8400 imagePullPolicy: IfNotPresent readinessProbe: exec: command: - /bin/sh - -c - /tsm\_docker\_utils/status\_check.sh | grep -E 'ACTIVE|BUSY' periodSeconds: 30 timeoutSeconds: 60 livenessProbe: exec: command: - /bin/sh - -c - /tsm\_docker\_utils/status\_check.sh | grep -E 'ACTIVE|BUSY' initialDelaySeconds: 600 periodSeconds: 60 timeoutSeconds: 60 volumeMounts: - name: logmount mountPath: /var/log/tableau - name: clone-volume mountPath: /docker/clone - name: dataengine-volume mountPath: /docker/dataengine - name: temp mountPath: /var/opt/tableau/tableau\_server/data/tabsvc/temp env: - name: ROOT\_LOG\_DIR value: /var/log/tableau - name: CLONE\_ARTIFACT\_DIR\_FOR\_INDEPENDENT\_CONTAINERS value: /docker/clone/clone-artifacts - name: FILESTORE\_MOUNT\_PATH value: /docker/dataengine - name: gateway image: # Gateway Image ports: - containerPort: 8080 imagePullPolicy: IfNotPresent readinessProbe: exec: command: - /bin/sh - -c - /tsm\_docker\_utils/status\_check.sh | grep -E 'ACTIVE|BUSY' periodSeconds: 30 timeoutSeconds: 60 livenessProbe: exec: command: - /bin/sh - -c - /tsm\_docker\_utils/status\_check.sh | grep -E 'ACTIVE|BUSY' initialDelaySeconds: 600 periodSeconds: 60 timeoutSeconds: 60 volumeMounts: - name: logmount mountPath: /var/log/tableau - name: clone-volume mountPath: /docker/clone - name: dataengine-volume mountPath: /docker/dataengine - name: temp mountPath: /var/opt/tableau/tableau\_server/data/tabsvc/temp env: - name: ROOT\_LOG\_DIR value: /var/log/tableau - name: CLONE\_ARTIFACT\_DIR\_FOR\_INDEPENDENT\_CONTAINERS value: /docker/clone/clone-artifacts - name: FILESTORE\_MOUNT\_PATH value: /docker/dataengine - name: hyper image: # Hyper Image ports: - containerPort: 8200 imagePullPolicy: IfNotPresent readinessProbe: exec: command: - /bin/sh - -c - /tsm\_docker\_utils/status\_check.sh | grep -E 'ACTIVE|BUSY' periodSeconds: 30 timeoutSeconds: 60 livenessProbe: exec: command: - /bin/sh - -c - /tsm\_docker\_utils/status\_check.sh | grep -E 'ACTIVE|BUSY' initialDelaySeconds: 600 periodSeconds: 60 timeoutSeconds: 60 volumeMounts: - name: logmount mountPath: /var/log/tableau - name: clone-volume mountPath: /docker/clone - name: dataengine-volume mountPath: /docker/dataengine - name: temp mountPath: /var/opt/tableau/tableau\_server/data/tabsvc/temp env: - name: ROOT\_LOG\_DIR value: /var/log/tableau - name: CLONE\_ARTIFACT\_DIR\_FOR\_INDEPENDENT\_CONTAINERS value: /docker/clone/clone-artifacts - name: FILESTORE\_MOUNT\_PATH value: /docker/dataengine volumes: - name: clone-volume nfs: server: path: - name: dataengine-volume nfs: server: path: /dataengine - name: logmount persistentVolumeClaim: claimName: logvolume - name: temp emptyDir: {} #### Scheduled Scaling Config apiVersion: v1 kind: ServiceAccount metadata: name: backgrounder-scaler-service-account namespace: # Namespace \--- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: scale-backgrounder-pods namespace: # Namespace subjects: \- kind: ServiceAccount name: backgrounder-scaler-service-account roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io \--- apiVersion: batch/v1beta1 kind: CronJob metadata: name: scale-up-job namespace: # Namespace spec: schedule: "0 7 \* \* \*" # Cron Job timing to scale up deployment replicas jobTemplate: spec: template: spec: serviceAccountName: backgrounder-scaler-service-account restartPolicy: OnFailure containers: \- name: scale image: bitnami/kubectl:1.21 imagePullPolicy: IfNotPresent args: \- scale \- --replicas=4 \- deployment/backgrounder \--- apiVersion: batch/v1beta1 kind: CronJob metadata: name: scale-down-job namespace: spec: schedule: "0 9 \* \* \*" # Cron Job timing to scale down deployment replicas jobTemplate: spec: template: spec: serviceAccountName: backgrounder-scaler-service-account restartPolicy: OnFailure containers: \- name: scale image: bitnami/kubectl:1.21 imagePullPolicy: IfNotPresent args: \- scale \- --replicas=2 \- deployment/backgrounder #### Kubernetes Job to clean Clone Configuration (Optional) This is a convenience Kubernetes job you might use during testing. If you want to clear out the clone configuration produced by Tableau Server in a Container between distinct deployment runs, you can run a job like this to clean the NFS. apiVersion: batch/v1 kind: Job metadata: name: delete-clone-artifacts-job namespace: manatee-cluster spec: template: spec: containers: \- name: delete-clone-artifacts image: busybox:1.28 command: \['sh', '-c', "rm -rf ${CLONE\_ARTIFACT\_DIR}"\] env: \- name: CLONE\_ARTIFACT\_DIR value: /docker/clone/clone-artifacts securityContext: runAsUser: 0 allowPrivilegeEscalation: true volumeMounts: \- name: clone-volume mountPath: /docker/clone restartPolicy: Never volumes: \- name: clone-volume nfs: server: # IP for shared NFS directory for clone output path: /clone [Skip to main content](#main-content) # Edit a Published Data Source Imagine that you’ve published a data source, and your team is using the data source across a number of workbooks. This is a good start, but you have some changes in mind that will make your data source great. Before you implement these changes, you want to see how your proposed changes look in Tableau. And most importantly, you need to test your changes to ensure they won’t negatively impact any existing workbooks that use the data source. Editing a published data source allows you to test changes and make improvements to your data source while maintaining it as a single source of data. **Note**: Only users with a site role of Creator can edit publish data sources in the browser. Alternatively, you can _extend_ a published data source by making your changes in a new data source. An extended published data source layers your overrides in a new data source without changing the original and maintains a connection to that original data source. For more information, see [Expand Published Data Sources](https://help.tableau.com/current/pro/desktop/en-us/datasource_extend_compose.htm). ## Edit and test changes Whether you’re creating a new published data source or editing an existing published data source, you can create relationships and modify the data model from the Data Source page without leaving your browser. Then use the Scratchpad to test your changes, create folders, organize hierarchies, and rename fields and aliases before publishing your data source. While editing your data source, you’ll have all the same features and functionality that you have when authoring in Tableau Cloud. For more information, see [Web Authoring and Tableau Desktop Feature Comparison](https://help.tableau.com/current/pro/desktop/en-us/server_desktop_web_edit_differences.htm). To edit a published data source: 1. From the Start or Explore page, navigate to the data source you want to edit. 2. Click Edit Data Source. ![Edit Data Source button](/tableau/next/en-us/server-linux/en-us/Img/edit_published_data_source.png) 3. Click the Data Source page to make joins or edit the schema. 4. Click the Scratchpad sheet. 5. From the Data pane, create folders, organize hierarchies, rename fields and their aliases, or update metadata that are saved with the published data source. 6. Drag and drop fields onto the scratchpad to make sure your changes are working as expected. 7. Click Publish. Just like you can with workbooks, you can also Publish As if you want to make a copy of the data source. **Note:** Personal Spaces don’t support published data sources. ## Roll back changes To revert to the last version of the published data source: 1. Navigate to the data source that you want to revert. 2. Click File. 3. Choose Revert to Published. ![File dropdown menu, Revert to Published option](/tableau/next/en-us/server-linux/en-us/Img/revert_to_published.png) This reverts to the latest published version of that data source. ## Understand supported connections Editing published data sources doesn’t support data sources that use embedded passwords in Tableau Cloud and Tableau Server. Also, the Data Source page isn’t available for published data source connection types that aren’t supported, including but not limited to .hyper file types. To see which connection types are supported, see [Creators: Connect to Data on the Web](https://help.tableau.com/v0.0/server-linux/en-us/creator_connect.htm). ## Learn about permissions To edit a published data source, you’ll need a Creator license that has Save or Save As permissions for data sources in the respective folder. For more information, see [Permissions](https://help.tableau.com/current/online/en-us/permissions.htm). ## Edit data sources published by a flow If you make edits to a data source that was published by a flow, the changes will be overwritten during the next scheduled flow. Instead, edit the data source in the flow. For more information, see [Publish a Flow to Tableau Server or Tableau Cloud](https://help.tableau.com/current/prep/en-us/prep_conductor_publish_flow.htm). [Skip to main content](#main-content) # Edit Connections on Tableau Server Administrators and data source owners can manage the information that describes how a published data source connects to the underlying data. This information includes the database server name or address, the server port, the database user name, and whether or not the password is embedded in the connection. **Note:** Ability to edit connections is determined primarily by your site role, rather than by your permissions on the data source. To edit connections, your site role must be Server Administrator, Site Administrator, or Creator. If your site role is Creator, you also must be the data source owner. 1. Sign in to the site that has the data sources you want to modify, and on the Content tab, select Explore > Data sources. 2. Select the name of the data source with the connection you want to update. Display filters to search for the data source or narrow the scope of the data source list. The values you type into the Server name and Database username fields are treated as regular expressions. 3. In the Connections view, select the Actions (…) menu for the data source, and then select Edit Connection. ![Data source connections list with a dropdown menu expanded to show the Edit Connection option.](/tableau/next/en-us/server-linux/en-us/Img/ds_connect3.png) To edit multiple data sources, select the data sources you want to edit, then click the Actions menu and Edit Connection. 4. Update the connection information. For Server name, if you want to use an IP address, make sure the database or its driver supports that type of connection. If it doesn’t, enter the database server name. See also [Authentication types for Google, Salesforce, and WDC data](#google-sfdc-auth) later in this topic. ![Edit Connection dialog with options to edit the selected data connection's server name, server port, username, and password.](/tableau/next/en-us/server-linux/en-us/Img/ds_connect4.png) **Note:** The Test Connection button is disabled in versions 2021.4 and later when Prompt user for password if needed is selected. 5. Click Save. 6. Refresh the browser page for your changes to take effect. ## Authentication types for Google, Salesforce, and WDC data Google BigQuery, Google Analytics, Salesforce.com, and many web data connector (WDC) connections use the OAuth authentication standard, which uses secure access tokens instead of “raw” user name and password credentials. With OAuth, database credentials do not need to be stored in Tableau, and all users connect through this access token, including Tableau Desktop users who want to create or edit workbooks that connect to the data source. The following sections describe Google and Salesforce connection options. Web data connector options vary, but all involve signing in through the provider’s web-based sign-in form to establish the access token. ### Google authentication options When you edit Google BigQuery or Google Analytics connections, select either of the following options in the Edit Connection dialog box: - Select Embed Google BigQuery (or Google Analytics) credentials in the connection to authenticate through a designated account, and then select an existing account from the list or select authenticate account now... to add a new one. When you add a new account, the Google sign-in page appears. After you provide your database credentials, Google prompts you to confirm Tableau access to the data. When you click Accept, Google returns an access token to use for connecting to the data. **Note**: If you create extracts of your Google data source, select this first option, so that you can schedule refresh tasks. - Select Prompt user for Google BigQuery/Analytics credentials to require users to connect through their own individual access tokens or sign in each time they connect. ### Salesforce.com authentication options **Note:** This applies only if Tableau Server is configured to use saved credentials for Salesforce with OAuth. If the server is not configured for this, use the standard process above for modifying connections. For more information about configuring Tableau Server to use saved credentials with OAuth, see [Change Salesforce.com OAuth to Saved Credentials](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_sfdc.htm). When you edit Salesforce.com connections, you can select any of the following options in the Edit Connection dialog box: - Select Embedded Salesforce username and password in the connection to use a traditional authentication method. - Select Embedded Salesforce credentials in the connection to use an OAuth connection and schedule refresh tasks, and then select an existing account from the list or click Add a Salesforce Account to add a new one. When you add a new account, the Salesforce.com sign-in page appears. After you provide your database credentials, Salesforce.com prompts you to confirm Tableau access to the data. When you allow Tableau access, Salesforce.com creates an access token through which it connects to the data. ![Settings to edit a selected data connection and enter authentication credentials.](/tableau/next/en-us/server-linux/en-us/Img/connections7a.png) - Select No Salesforce authentication to require users to sign in to Salesforce.com each time they connect. (This option does not allow scheduled extract refreshes.) ## Monitor progress When you save your changes in the Edit Connection dialog box, the dialog displays the progress. If you close the dialog box, the modifications continue to run in the background until completed. Tableau Server will make as many changes as possible. Any failures will be skipped, but they will not impede other changes. For example, if you try to change the server name and add a password to several connections, the server names will be changed, and the passwords on workbooks will be changed. However, because you cannot add a password to a data source, the passwords for the data sources will not be changed. For information about checking the progress of these tasks, see [Background Tasks for Extracts](https://help.tableau.com/v0.0/server-linux/en-us/adminview_backgrnd.htm). [Skip to main content](#main-content) # Effective permissions A permission rule establishes who is impacted (a group set, group, or user) and what [Capabilities](https://help.tableau.com/v0.0/server-linux/en-us/permissions_capabilities.htm#Capabili) they are **Allowed**, **Denied**, or **Unspecified**. While it seems straightforward to simply set a permission rule and have that be the whole story, whether a user has a capability may be unclear because of membership in multiple groups and the interplay of site roles and ownership with permission rules. Multiple factors are evaluated in a specific order, yielding _effective permissions_ on a piece of content. > [!TIP] > > To help keep things as straightforward as possible, we recommend (1) setting permission rules for groups instead of users, (2) managing permissions locked at the project level instead of setting permissions on individual content, and (3) deleting the All User group’s permission rule or setting all capabilities to None. A capability is allowed for a user if and only if the following three conditions are all met: - The capability is within the scope of their site role. - They have that capability: - based on a specific user scenario (such as being the content owner or a project leader, or they’re an administrator site role), OR - because they have been allowed the capability as a user, OR - because they are both in a group that has been allowed the capability and no rules deny them the capability as a user or member of another group. - There is no conflicting permissions settings at another content level that takes precedence. Any other situation denies the user the capability. Hovering over a capability brings up a tooltip that explains the effective permission. Here are some common examples of why effective permissions—what the user can or can’t do in actuality—might appear different than what a given permission rule states: - A user might have a capability they are denied in a permission rule because their site role includes it (administrators). - A user might have a capability they are denied in a permission rule because their user scenario allows it (because they own the content or are a project owner or leader). - A user might lack a capability they are allowed in a permission rule because their site role doesn’t allow it. - A user might lack a capability they are allowed in a permission rule because a conflicting group or user rule denied it. - A user might lack a capability they are allowed in a permission rule at one level of content (such as a workbook) because another level of content denied it (such as a view). ## Evaluate permission rules Permissions in Tableau are restrictive. Unless a capability is granted to a user, they are denied permission. The following logic evaluates if a capability is allowed or denied for an individual: ![Flow chart of the rules for how permissions are evaluated](/tableau/next/en-us/server-linux/en-us/Img/perms_evalflow_basic.png) 1. **Site role:** If a site role doesn’t permit a capability, the user is denied. If the user's site role does permit the capability, then specific user scenarios are evaluated. - For example, a Viewer site role can’t web edit. See [General capabilities allowed with each site role](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm#site-role-capabilities-summary) for more information on what each site role can do. 2. **Specific user scenarios:** - If the user is an admin they have all capabilities on all content. - If the user is a project owner or project leader, they have all capabilities on all content in their projects. - If the user is the content owner, they have all capabilities\* on their content. - If these scenarios do not apply to the user, then user rules are evaluated. \*Exception: Content owners won’t have the **Set Permissions** capability in projects where permissions are locked. Only administrators, project owners, and project leaders can set permission rules in locked projects. 3. **User rules:** If the user is denied a capability, it is denied. If they are allowed a capability, it is allowed. If a capability is unspecified, then group rules are evaluated. 4. **Group rules:** If the user is in _any_ group that is denied a capability, it is denied. If the user is in a group that is allowed a capability (and not in any groups that are denied that capability), it is allowed. - That is to say, if a user is a member in two groups, and one is allowed a capability and one is denied the same capability, the denial takes precedence for that user and they are denied. 5. **Group set rules:** If a user is a member of a group in a group set, any group in the group set that is denied a capability, is then denied. 6. If none of the above conditions apply, the user is denied that capability. In effect, this means that capabilities left as unspecified will result in denied. A final effective permission of **Allowed** therefore occurs in three circumstances: - Allowed by site role (Server Administrator, Site Administrator Creator, Site Administrator Explorer) - Allowed because the user is the content owner, project owner, or project leader - Allowed by a group, group set, or user rule (and not denied by a rule of higher precedence) **Denied** occurs in three circumstances: - Denied by site role - Denied by a rule (and not allowed by a rule of higher precedence) - Not granted by any rule ## Evaluate permissions set at multiple levels If Asset permissions are set to Customizable, it’s possible to configure permission rules in multiple places. There are specific rules that determine what permissions are applied on the content. - If there are nested projects, permissions set at the child level take precedence over permissions set at the parent level. - Changes to permissions at the project level are not enforced for existing content. - If there are permissions set on content (workbook, data source, or flow) during or after publication, these take precedence over rules set at the project level. - If a workbook doesn’t show navigational sheet tabs, any changes to the workbook-level permissions _won’t_ be inherited by the views and any changes to permissions must be done on the view. - Configuring the workbook to show navigational sheet tabs will override existing view-level permissions and sync them with the workbook-level permissions. See [Show or Hide Sheet Tabs](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#sheettabs). ![Flow chart of the rules for how permissions are evaluated with nested projects](/tableau/next/en-us/server-linux/en-us/Img/perms_evalflow_total.png) This image shows how capabilities are evaluated through multiple levels of content. ## Permissions on views In a workbook that is not in a locked project and does not show sheets as tabs for navigation, views (sheets, dashboards, stories) inherit the workbook permissions at publication, but any changes to permission rules must be made on individual views. View capabilities are the same as those for workbooks, except for **Overwrite**, **Download Workbook/Save a Copy**, and **Move** which are only available at the workbook level. We recommend showing navigational sheet tabs whenever possible so views continue to inherit their permissions from the workbook. For more information, see [Show or Hide Sheet Tabs](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#sheettabs). [Skip to main content](#main-content) # Enable and Configure Tableau Prep Conductor on Tableau Server _Supported in Tableau Server version 2019.1 and later._ Tableau Prep Conductor is licensed through Data Management, on a per Deployment basis, which is User-Based or Core-Based. A Deployment includes a licensed production Tableau Server installation and licensed non-production Tableau Server installations that support the production installation. For more information on Deployment, see the [Tableau Deployment Guide](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_welcome.htm). For more information on how Tableau Prep Conductor licensing works, see [License Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_license.htm). ### Server Topology When you install Tableau Server and enable Tableau Prep Conductor, using the Data Management product key, Tableau Prep Conductor is automatically enabled by default by the setup program. For multi-node installations, by default, one instance of Tableau Prep Conductor is enabled on any node that has backgrounder installed. In the example below, Tableau Prep Conductor is enabled on node 2 and 3 where the backgrounders are also enabled, but not on node 1,4, and 5. ![The Tableau Server Status page showing Tableau Prep Conductor enabled on node 2 and 3 where the backgrounders are also enabled, but not on node 1,4, and 5.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_multinode.png) Below is a visual representation of that work-flow: ![A flowchart that walks you through the process of installing and configuring a new Tableau Server, as well as upgrading an existing one.](/tableau/next/en-us/server-linux/en-us/Img/prep_conductor_config_server_workflow.png) ## Next step: New Tableau Server Installations: [Step 1 (New Install): Install Tableau Server with Tableau Prep Conductor](https://help.tableau.com/v0.0/server-linux/en-us/prep_conductor_new_install.htm) Existing Tableau Server Installations: [Step 1 (Existing Install): Enable Tableau Prep Conductor](https://help.tableau.com/v0.0/server-linux/en-us/prep_conductor_add_to_existing_install.htm) ### Who can do this Server administrators can install Tableau Server and enable Tableau Prep Conductor. Server-level settings can be configured by Tableau Server administrators, and site-level settings can be configured by Tableau Server and Site administrators. ## Other articles in this section [Skip to main content](#main-content) # Enable Custom Schedules for Subscriptions Custom schedules for subscriptions allow users to receive email messages on a schedule that they define, rather than using a fixed schedule defined by a server administrator. Custom schedules for subscriptions have been available to users of Tableau Cloud since March 2017, and these schedules can now be enabled on a per-site basis in Tableau Server version 2018.2. Enabling custom schedules for subscriptions is a permanent change on any sites where you make this change. Any sites where you don’t enable custom schedules remain on fixed schedules defined by a server administrator. ## Enable custom schedules Before you can enable custom schedules on one or more sites, you must first enable custom schedules on Tableau Server, and then enable custom schedules on one or more sites on that server. To learn more about enabling subscriptions on Tableau Server, see [Set Up a Site for Subscriptions](https://help.tableau.com/v0.0/server-linux/en-us/subscribe.htm). **Step 1: Enable custom schedules on Tableau Server** From a command prompt with Tableau administrator permissions, run the following commands: ``` tsm configuration set -k features.SelfServiceSchedules -v true tsm pending-changes apply ``` This operation will restart Tableau Server. **Step 2: Enable custom schedules on a site** 1. Log in to Tableau Server as a server administrator using a web browser: ``` https:///#/login ``` 2. Browse to the **Site Settings** page for a site, and then enable custom schedules: 1. Click **All Sites**, and then choose one of the sites from the drop-down list. 2. Click **Settings**. 3. On the **General** tab, under **Subscriptions**, select the following checkbox: **Permanently convert from fixed schedules created by administrators to custom schedules created by users. (You can't undo this)**. 4. Click **Save**. When custom schedules are enabled on a site, all fixed schedules with a subscription are converted to an equivalent custom schedule. [Skip to main content](#main-content) # Enable Extract Refresh Scheduling and Failure Notification Your publishers can schedule extract refreshes when two conditions are met: - Tableau Server is configured to send email messages when extract refreshes fail. This is configured by a Tableau Server Manager (TSM) administrator and is on by default. For details, see [Configure Server Event Notification](https://help.tableau.com/v0.0/server-linux/en-us/email.htm). - The site or sites in which you want to allow publishers to schedule extract refreshes is configured to send email when the refresh fails. This is configured by a server administrator in Tableau Server and is on by default. The instructions below explain how to do this if it is not enabled. While you’re enabling scheduling, you can decide whether also to enable sending email to owners of data sources or workbooks that are refreshed when those extract refreshes do not complete successfully. You can read more about these emails below. When you enable refresh failure notification, the owners of the content that has scheduled refreshes can opt out individually by changing their account settings. 1. Sign in to Tableau Server as a server administrator. 2. Go to the General tab of the Settings page for the site you want to configure for subscriptions: - If you have a single site, at the top the browser window, click Settings and General. - If you have multiple sites, select the site you want to configure and click Settings and General. 3. On the General page, do the following: - Scroll to the Manage Notifications settings and check Extract jobs. If a scheduled refresh for a particular data source fails, the email goes only to the owner of that data source, not to owners of workbooks that connect to that data source. - Under Embedded Credentials, select both options to let publishers embed credentials and schedule extract refreshes. (Automatic refresh schedules require embedded credentials so Tableau Server can directly access data.) **Note:** On a multi-site server, failure notifications are a site setting, and embedded credentials are a server setting. To configure embedded credentials on a multi-site server, select Manage All Sites and then Settings. ## Managing schedules from the server In your organization it might be more appropriate to manage embedded credentials and refresh schedules centrally from the server. If you do that, you might clear the check boxes in the Embedded Credentials section described in the steps above, so that Tableau Desktop publishers do not see schedule options during publishing. Managing schedules centrally enables you to distribute extract refresh and subscription tasks, so you can run them when most people are offline. It also enables you to oversee which credentials are embedded in connections. ## How refresh failure emails work The email notification for a failed extract refresh lists the extract name and location on the server, gives the time of last successful refresh, the number of consecutive times the refresh has failed, and suggests the reason for the failure and possible solution. After five consecutive failures, the refresh schedule is suspended until you or the data owner takes an action to address the cause of the failure, such as updating database credentials or a path to the original data file. ## Enable refresh failure emails for non-admins **Note:** This option is not available for published data sources created or refreshed from Bridge. By default, only content owners receive notifications if there is a problem refreshing an extract. However, administrators can optionally choose to receive notifications when an extract fails. To enable email notifications when an extract fails, open the context menu (**...**) in the extract dashboard, select Extract Failure Notification, and select **Yes** to receive notifications, or **No** to stop notifications. ![Menu containing extract failure notification](/tableau/next/en-us/server-linux/en-us/Img/extract_failure_notify_menu.png "context menu") **Note**: If the current user is an owner of the extract, the ability to opt in or out of failure notifications is not available using the context menu. ### How the last successful refresh date is determined The last successful refresh date and time are shown when that last refresh occurred within a number of days. By default it is 14 days, and this value is set in `wgserver.alerts.observed_days`. If the number of days since the last successful refresh exceeds the number specified in this setting, the message in the email shows “not in the last _N_ days.” [Skip to main content](#main-content) # Enable Kerberos Delegation Kerberos delegation enables Tableau Server to use the Kerberos credentials of the viewer of a workbook or view to execute a query on behalf of the viewer. This is useful in the following situations: - You need to know who is accessing the data (the viewer's name will appear in the access logs for the data source). - Your data source has row-level security, where different users have access to different rows. ## Supported data sources Tableau supports Kerberos delegation with the following data sources: - Cloudera: Hive/Impala - Denodo - Hortonworks - Oracle - PostgreSQL - Spark - SQL Server - Teradata - Vertica MSAS is not supported on Linux platforms. ## Requirements Kerberos delegation requires Active Directory. - The Tableau Server [identity store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm) must be configured to use Active Directory. - The computer where Tableau Server is installed must be joined to the Active Directory domain. - MIT Kerberos KDC is not supported. ## Web authoring and user Kerberos authentication When configuring Connect to Data for a given target, you may select Integrated or Windows authentication as the preferred authentication method. However, for web authoring scenarios, the default behavior will be to use the Kerberos service account (“Run As” account) instead. To enable user credentials in web authoring scenarios with Kerberos delegation, you must make an additional configuration using TSM. Run the following commands: tsm configuration set -k native\_api.WebAuthoringAuthModeKerberosDelegation -v true tsm pending-changes apply After making this configuration, Kerberos Delegation becomes the default operation when selecting integrated authentication with web authoring. However, this setting will not prevent content creators from accessing the service account. Creators can still publish content that connects with the Run As service account, using Tableau Desktop or other methods. For more information on Run As service account, see [Enable Kerberos Service Account Access](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_runas_linux.htm). ## Configuration process This section provides an example of the process to enable Kerberos delegation. The scenario also includes example names to help describe the relationships between the configuration elements. 1. Tableau Server will need a Kerberos service ticket to delegate on behalf of the user that is initiating the call to the database. You must create a domain account that will be used to delegate to the given database. This account is referred to as the Run As service account. In this topic, the example user configured as the delegation/Run As account is `tabsrv@example.com`. The account must be configured with Active Directory User and Computers on a Windows Server that is connected to the user domain: - Open the **Properties** page for the Run As service account, click the **Delegation** tab and select **Trust this user for delegation to specified services only** and **Use any authentication protocol**. 2. Create a keytab file for the Run As service account. For example, the following commands create a keytab `(tabsrv-runas.keytab`) using the ktutil tool: sudo ktutil ktutil: addent -password -p tabsrv@EXAMPLE.COM -k 2 -e Encryption schemes for this command include `RC4-HMAC`, `aes128-cts-hmac-sha1-96`, and `aes256-cts-hmac-sha1-96`. Consult your IT team for the correct encryption scheme for your environment and data source. ktutil: wkt tabsrv-runas.keytab Tableau Server will use the Run As service account and the associated keytab to authenticate and make a direct connection to the database. 3. Copy the keytab into the Tableau Server data directory and set proper ownership and permissions. If you are running a multi-node deployment, then you must run the following commands on each node in the cluster. mkdir /var/opt/keytab sudo cp -p tabsrv-runas.keytab /var/opt/keytab sudo chown $USER /var/opt/keytab/tabsrv-runas.keytab chgrp tableau /var/opt/keytab/tabsrv-runas.keytab chmod g+r /var/opt/keytab/tabsrv-runas.keytab 4. Run the following TSM commands to enable Kerberos delegation, set the delegation service account, and associate the keytab file with the service account: tsm configuration set -k wgserver.delegation.enabled -v true tsm configuration set -k native\_api.datasource\_impersonation\_runas\_principal -v tabsrv@EXAMPLE.COM tsm configuration set -k native\_api.datasource\_impersonation\_runas\_keytab\_path -v /var/opt/keytab/tabsrv-runas.keytab tsm configuration set -k native\_api.protocol\_transition\_a\_d\_short\_domain -v false tsm configuration set -k native\_api.protocol\_transition\_uppercase\_realm -v true In some cases, TSM may return an error mentioning `--force-keys`. If you get this error, run the command again with the `--force-keys` parameter appended to the argument. 5. Run the following TSM command apply the changes to Tableau Server: `tsm pending-changes apply` If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). 6. Enable delegation for data connections: - **SQL Server**—See [Enabling Kerberos Delegation for SQL Server](https://community.tableau.com/s/question/0D54T00000CWcplSAD/enabling-kerberos-delegation-for-sql-server) in the Tableau Community. - **PostgreSQL**—See [Enabling Kerberos Delegation for PostgreSQL](https://community.tableau.com/s/question/0D54T00000G54ssSAB/enabling-kerberos-delegation-for-postgresql) in the Tableau Community. - **Teradata**—See [Enabling Kerberos Delegation for Teradata](https://community.tableau.com/s/question/0D54T00000G54tCSAR/enabling-kerberos-delegation-for-teradata) in the Tableau Community. - **Denodo**—See [Enabling Kerberos Delegation for Denodo on Linux](https://community.tableau.com/s/question/0D54T00000CWdD7SAL/enabling-kerberos-delegation-for-denodo-on-linux) in the Tableau Community. - **Oracle**—See [Enable Kerberos Delegation for Oracle](https://community.tableau.com/s/news/a0A4T000002O42jUAC/enable-kerberos-delegation-for-oracle) in the Tableau Community. - **Cloudera**—See [Enable Kerberos Delegation for Hive/Impala](https://community.tableau.com/s/question/0D54T00000CWdINSA1/enable-delegation-for-hiveimpala) in the Tableau Community. - **Vertica**—See [Enabling Kerberos Delegation for Vertica](https://community.tableau.com/s/question/0D54T00000CWd5sSAD/enabling-kerberos-delegation-for-vertica) in the Tableau Community. ## See also [Troubleshoot Kerberos](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_trouble.htm) ## Other articles in this section [Skip to main content](#main-content) # Enable Kerberos Delegation for JDBC Connectors As of version 2020.2, Tableau Server supports Kerberos delegation for JDBC connectors. Kerberos delegation enables Tableau Server to use the Kerberos credentials of the viewer of a workbook or view to execute a query on behalf of the viewer. This is useful in the following situations: - You need to know who is accessing the data (the viewer's name will appear in the access logs for the data source). - Your data source has row-level security, where different users have access to different rows. ## Supported data sources Tableau supports JDBC Kerberos RunAs authentication with the following data sources: - Oracle - PostgreSQL Both native and JDBC-based connectors use the same configuration on Tableau Server on Linux. See [Enable Kerberos Delegation](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_delegation.htm). [Skip to main content](#main-content) # Enable Kerberos Run As Authentication for JDBC Connectors As of version 2020.2, Tableau Server supports Kerberos authentication for JDBC connectors. You can configure Tableau Server to use a Kerberos service account to access a database. In this scenario, Tableau Server connects to databases with a service account, also referred to as a "Run As service account". This scenario is referred to as "Run As authentication" To use Run As authentication on Tableau Server you must first create a workbook or datasource in Tableau Desktop that uses integrated authentication. When you publish to Tableau Server you will get the option to use Run As authentication. When creating a datasource with Web Authoring, Run As authentication is the default operation if you select integrated authentication. ## Supported data sources Tableau supports JDBC Kerberos delegation with the following data sources: - Oracle - PostgreSQL Both native and JDBC-based connectors use the same configuration on Tableau Server on Linux. To configure Run As authentication see [Enable Kerberos Service Account Access](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_runas_linux.htm). [Skip to main content](#main-content) # Enable Kerberos Service Account Access You can configure Tableau Server to use a Kerberos service account to access a database. In this scenario, Tableau Server connects to databases with a service account, also referred to as a "RunAs account". To use RunAs authentication on Tableau Server you must first create a workbook or datasource that uses integrated authentication. When users publish to Tableau Server they will get the option for RunAs authentication. If you create a datasource with Tableau Server web authoring that uses integrated authentication, the datasource will use RunAs authentication by default. **Note**: _Integrated authentication_ is also referred to as _Windows Authentication_ on some connectors. In both cases, Tableau Server uses Kerberos authentication. ## Data Access with the RunAs Service Account To use RunAs authentication, the RunAs account requires read and query permissions to external databases. As designed, Tableau Server users with the _Creator_ role or the _Explorer (Can Publish)_ role have full access to the RunAs account for queries to external databases. For example, a user with the Creator role can view all databases that have been granted access to the RunAs service account. They can also list tables and run Custom SQL. If the Creator-user specifies the database host name and selects Integrated Authentication when creating a new data source with web authoring, then databases that have been granted RunAs access will be displayed to the user. View access to database assets are not restricted to users who connect to Tableau Server with web authoring. Sophisticated users, who have the same roles noted above and who have knowledge of database server names, could create workbooks with Tableau Desktop that display databases that have been granted RunAs access. ### Recommendations Whether user access to databases in these scenarios is acceptable must be assessed by your organization. Generally, reducing the usage and scope of the RunAs service account will reduce the likelihood of inadvertent user access to database content. However, reducing the usage and scope of the RunAs service account may also impose more credential management to you and your users. Evaluate the following recommendations in context of your business needs and data access policies. - Firstly, be sure that you trust all users who have Creator roles or Explorer (Can Publish) roles. You will rely on these users to perform actions in Tableau with integrity. - If you cannot trust all of your users who have publishing rights on data sources that are accessed by the RunAs service account, then you should consider embedding credentials for those data sources. - If a data source is not set up for automated extract refreshes, that is, the data source is primarily accessed as a live connection, then you may be able to use Kerberos Delegation. For requirements, see [Enable Kerberos Delegation](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_delegation.htm). ## Requirements - MIT Kerberos is not supported. - The RunAs service account must have read access to the target database. ## Configuration process This section provides an example of the process to enable Kerberos service account access. 1. Create a domain user account to act as the RunAs service account. This account must have read access to the target database. In the example here, the RunAs service account is User principal named `tabsrv@example.com`. 2. Create a keytab file for the RunAs service account. For example, the following commands create a keytab `(tabsrv-runas.keytab`) using the ktutil tool: ktutil ktutil: addent -password -p tabsrv@EXAMPLE.COM -k 2 -e Encryption schemes for this command include `RC4-HMAC`, `aes128-cts-hmac-sha1-96`, and `aes256-cts-hmac-sha1-96`. Consult your IT team for the correct encryption scheme for your environment and data source. ktutil: wkt tabsrv-runas.keytab Tableau Server will use the RunAs service account and the associated keytab to authenticate and make a direct connection to the database. 3. Copy the keytab into the Tableau Server data directory and set proper ownership and permissions. The keytab should be readable by the unprivileged user. The default unprivileged user created by Tableau Setup is `tableau`. If you are running a multi-node deployment, then you must run the following commands on each node in the cluster: mkdir /var/opt/tableau/tableau\_server/keytab sudo cp -p tabsrv-runas.keytab /var/opt/tableau/tableau\_server/keytab sudo chown $USER /var/opt/tableau/tableau\_server/keytab/tabsrv-runas.keytab chgrp tableau /var/opt/tableau/tableau\_server/keytab/tabsrv-runas.keytab chmod g+r /var/opt/tableau/tableau\_server/keytab/tabsrv-runas.keytab 4. Run the following TSM commands to enable RunAs access, set the RunAs service account, and associate the keytab file with the service account. tsm configuration set -k features.RunAsAuthLinux -v true --force-keys tsm configuration set -k native\_api.datasource\_runas\_principal -v tabsrv@EXAMPLE.COM --force-keys tsm configuration set -k native\_api.datasource\_runas\_keytab\_path -v /var/opt/tableau/tableau\_server/keytab/tabsrv-runas.keytab --force-keys 5. Run the following TSM command apply the changes to Tableau Server deployment: `tsm pending-changes apply` If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). ## Other articles in this section [Skip to main content](#main-content) # Enable Tableau Catalog [Tableau Catalog](https://help.tableau.com/v0.0/server-linux/en-us/dm_catalog_overview.htm) discovers and indexes all of the content on your Tableau Cloud site or Tableau Server, including workbooks, data sources, sheets, metrics, and flows. (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm).) Indexing is used to gather information about the content, or metadata, about the schema and lineage of the content. Then from the metadata, Catalog identifies all of the databases, files, and tables used by the content on your Tableau Cloud site or Tableau Server. Catalog is available with the Data Management license. For more information, see [About Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_overview.htm). In addition to Catalog, metadata about your content can also be accessed from both the [Tableau Metadata API](https://help.tableau.com/current/api/metadata_api/en-us/index.html) and the Tableau REST API using [Metadata Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_metadata.htm). ## Before enabling Catalog As a Tableau Server admin, there are a few things that you need to consider before and while enabling Catalog to ensure optimal performance of Catalog in your Tableau Server environment. ### Required versions Before enabling Catalog, make sure you're running _one_ of the following versions of Tableau Server: - At least Tableau Server 2019.3.4 or later - At least Tableau Server 2019.4.2 or later - At least Tableau Server 2020.1.0 or later - At least Tableau Server 2020.2.15 or later - Tableau Server 2020.3 and later For more information about why these versions are required, see the [Tableau Knowledge Base](https://kb.tableau.com/articles/issue/lineage-not-populating-permissions-not-effective-and-vizzes-load-slowly-after-upgrade). ### What to expect when enabling Catalog When Catalog is enabled, the content that already exists on your Tableau Server is immediately indexed. #### Initial ingestion The indexing process is comprised of two primary components, one of which is called initial ingestion. Initial ingestion can be broken down into two additional components: - Content backfill - Lineage backfill The status of content backfill and lineage backfill are important to note later on when monitoring progress and validating that Catalog has been successfully turned on and is running in your Tableau Server environment. #### Initial ingestion speed The time it takes Catalog to index the content for the first time depends on a couple of factors: - **Amount of content on Tableau Server:** The amount of content is measured by the total number of workbooks, metrics, published data sources, and flows published to Tableau Server. For more information, see [Disk space to store metadata](#Disk). - **Number of non-interactive microservice containers:** Catalog uses the non-interactive microservice containers to index all the content on Tableau Server. For more information, see [Memory for non-interactive microservice containers](#Memory). Understanding the factors that impact initial ingestion can help you gauge how long it might take to enable and run Catalog in your environment. #### Disk space to store metadata During initial ingestion, metadata is generated and stored in the Tableau Server repository (“relationship” PostgreSQL database). The amount of disk space needed to store the metadata is roughly up to half of the disk space currently used by the repository ("workgroup" PostgreSQL database). For example, suppose the repository uses 50 GB of disk space prior to enabling Catalog, the repository can use up to 75 GB of disk space after enabling Catalog. #### Memory for non-interactive microservice containers Initial ingestion runs inside of the non-interactive microservice container. The non-interactive microservice container is one of two [Tableau Server microservice container](https://help.tableau.com/current/server/en-us/server_process_container.htm) processes. By default, one instance of the non-interactive microservice container process is added to every node that has a backgrounder process installed. By default, initial ingestion on a single instance of the non-interactive microservice container can use up to 4 GB of memory on the backgrounder node. If the amount of content on Tableau Server exceeds 10,000, a non-interactive microservice container process may require up to 16 GB of memory on the backgrounder node. Therefore, when enabling Catalog, ensure that every backgrounder node has the available capacity to support each non-interactive microservice container during the initial ingestion process. If you are planning to add more non-interactive microservice containers to decrease the time of initial ingestion, first determine how many total containers are needed (using [Step 2: Estimate how long initial ingestion will take](#step2), below) and then verify if your Tableau Server environment is configured with enough capacity to support _all_ non-interactive microservice containers. Depending on how your Tableau Server environment is already configured, you might not be able to add all the additional non-interactive microservice containers that you need to decrease initial ingestion time. ### Best practices for enabling Catalog Because the speed of initial ingestion and requirements are unique to each Tableau Server environment, Tableau recommends that when you enable Catalog you do one or more of the following: - Make sure there is enough disk space that the Tableau Server repository can use to support the additional metadata that initial ingestion will generate and store. As a general rule, the repository will need an additional 50% of disk space currently used by the repository. For more information about Tableau Server disk usage, see [Server Disk Space](https://help.tableau.com/v0.0/server-linux/en-us/adminview_space_all_nodes.htm). - Depending on the amount of content on Tableau Server, make sure each backgrounder node has at least 4-16 GB of available memory for each instance of a non-interactive microservice container during initial ingestion. - Perform the process over the weekend to allow initial ingestion to complete before your users start using Catalog capabilities. - Perform the process in a test environment with production content first. This is because the type of content that needs to be ingested can play a significant role on ingestion speed. ### Summary of steps to enable Catalog The following steps summarize the process to turn on and run Catalog on Tableau Server. The steps must be performed sequentially. 1. [Determine the amount of content on Tableau Server](#step1) 2. [Estimate how long initial ingestion will take](#step2) 3. [Decrease the time of initial ingestion](#step3) 4. [Activate the Data Management license](#step4) 5. [Turn off Catalog capabilities](#step5) 6. [Run the tsm maintenance metadata-services command](#step6) 7. [Monitor initial ingestion progress and validate its status](#step7) 8. [Configure SMTP](#step8) 9. [Turn on Catalog capabilities](#step9) **Note:** Because indexing metadata about Tableau content on Tableau Server is powered by the Metadata API, enabling the Metadata API is required to run and use Catalog. ## Enable Catalog #### Step 1: Determine the amount of content on Tableau Server To determine the amount of content on Tableau Server, do the following: 1. Sign in to Tableau Server using your admin credentials. 2. Go to the **Explore** page. 3. Click the Top-Level Project drop-down menu and add the numbers next to All Workbooks, All Metrics, All Data Sources, and All Flows together. This is the total amount of content on Tableau Server. #### Step 2: Estimate how long initial ingestion will take To estimate the time it will take Catalog to ingest content on Tableau Server for the first time (initial ingestion), compare _your_ Tableau Server setup to a _baseline_ Tableau Server setup. For a Tableau Server with the following setup, initial ingestion could take about 6 hours to complete. | Components | Baseline values | | --- | --- | | Content | 17,000 workbooks, metrics, published data sources, and flows | | Non-interactive microservice containers | 10 | | Ingestion | ~6 hours | If you have roughly _half_ the content in your Tableau Server environment, initial ingestion might take half the time to complete. For example: 8,500 (workbooks, metrics, published data sources, and flows) + 10 non-interactive microservice containers = ~3 hours (initial ingestion) If you have roughly _double_ the content in your Tableau Server environment, initial ingestion might take double the time to complete. For example: 34,000 (workbooks, metrics, published data sources, and flows) + 10 non-interactive microservice containers = ~12 hours (initial ingestion) #### Step 3: Decrease the time of initial ingestion As a general rule, the time it takes for Catalog to perform initial ingestion is correlated to the number of non-interactive microservice containers. To help decrease the time of initial ingestion, you can increase the number of non-interactive microservice containers. **Increase the number of non-interactive microservice containers** By default, one non-interactive microservice container is added to every node that has a backgrounder. To help decrease the time of initial ingestion, Tableau recommends that you increase the number of non-interactive microservice containers using the `tsm topology set-process` command. 1. Open a command prompt as an admin on the initial node (where TSM is installed) in the cluster. 2. Run the command: `tsm topology set-process --count --node --process ` For example, to increase the non-interactive microservice containers on the initial node to 4 containers, run the following command: `tsm topology set-process --count 4 –-node node1 --process noninteractive` For more information about running the command and its global options, see [tsm topology](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMSetProcess#TSMSetProcess). **Important:** Before increasing the number of non-interactive microservice containers, review the following: - The recommendation for increasing non-interactive microservice containers is for the total number of non-interactive microservice containers, not total non-interactive microservice containers per node. For example, suppose you have 4 nodes but you want to increase the number of non-interactive microservice containers to 8. The `--count` value you use in the tsm command is 2. - For each non-interactive microservice container added, 4 GB of additional memory will be used on the node and load will be added to the Tableau Server repository (PostreSQL database). - Tableau recommends that you incrementally increase non-interactive microservice containers by no more than 2 at a time while closely monitoring your Tableau Server environment to avoid issues with CPU utilization of the Tableau Server repository (PostgreSQL database). - Be aware that when too many non-interactive microservice containers are added, CPU utilization of the PostgreSQL database might spike and failover. Symptoms to watch for include SQLException errors in the vizportal logs. For more information, see [Repository Failover](https://help.tableau.com/current/server/en-us/distrib_ha_failover.htm) topic. #### Step 4: Activate the Data Management license (Requires Data Management) If not already done, you can activate Data Management. For more information, see [License Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_license.htm). #### Step 5 (optional): Turn off Catalog capabilities for each site (Requires Data Management) As part of Data Management activation, Catalog capabilities are turned on by default. Because of the indexing process and the estimated time it takes to complete, consider temporarily turning off Catalog capabilities for each site so that Tableau Server users can't access Catalog capabilities until Catalog is ready and able to provide complete and accurate results. 1. Sign in to Tableau Server using your admin credentials. 2. From the left navigation pane, click Settings. 3. On the General tab, under Tableau Catalog, clear the Turn on Tableau Catalog check box. 4. Repeat steps 2-3 for each site on your Tableau Server. #### Step 6: Run the tsm maintenance metadata-services command Run the `tsm maintenance metadata-services` command to enable the Tableau Metadata API. Running the command begins initial ingestion. If your Tableau Server is licensed with Data Management, running the command also turns on Catalog capabilities (if it wasn’t turned off earlier). 1. Open a command prompt as an admin on the initial node (where TSM is installed) in the cluster. 2. Run the command: `tsm maintenance metadata-services enable` For more information about running the tsm command, see [tsm maintenance](https://help.tableau.com/current/server/en-us/cli_maintenance_tsm.htm#cat_enable). **Notes:** When running this command, keep the following points in mind: - This command stops and starts some services used by Tableau Server, which causes certain functionality, such as the Recommendations capability, to be temporarily unavailable. - A new index of metadata is created at this time. Running this command any subsequent times will create and replace the previous index. #### Step 7: Monitor initial ingestion progress and validate its status Running the tsm command above starts the initial ingestion process. To ensure that the initial ingestion process is going smoothly, you can monitor its progress using the Backfill API. For more information, see [Get Initial Ingestion Status](https://help.tableau.com/v0.0/server-linux/en-us/dm_tools_backfill.htm). #### Step 8: Configure SMTP Setup If not already set up for Tableau Server, configure SMTP Setup. SMTP supports sending email to owners who need to be contacted about changes to data. For more information about configuring SMTP, see [Configure SMTP Setup](https://help.tableau.com/current/server/en-us/config_smtp.htm). #### Step 9 (optional): Turn on Catalog capabilities for each site (Requires Data Management) If you turned off Catalog capabilities before enabling Catalog in one of the procedures above, you must turn on Catalog to make its capabilities accessible to your users. 1. Sign in to Tableau Server using your admin credentials. 2. From the left navigation pane, click Settings. 3. On the General tab, under Tableau Catalog, select the Turn on Tableau Catalog check box. 4. Repeat steps 2-3 for each site on your Tableau Server. ## Troubleshoot Catalog You or your users might encounter one of the following issues when using Catalog. #### Timeout limit and node limit exceeded messages To ensure that Catalog tasks that have to return a large number of results don’t take up all Tableau Server system resources, Catalog implements both timeout and node limits. - **Timeout limit** When tasks in Catalog reach the timeout limit, you and your users see the following message: “_Showing partial results, Request time limit exceeded. Try again later._” or TIME\_LIMIT\_EXCEEDED To resolve this issue, as a Tableau Server admin, you can increase the timeout limit using the `tsm configuration set –k metadata.query.limits.time` command. For more information, see the [tsm configuration](https://help.tableau.com/current/server/en-us/cli_configuration_tsm.htm) and [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm#metadata_timeout) topics. **Important:** Increasing the timeout limit can utilize more CPU for longer, which can affect the performance of other processes on Tableau Server. - **Node limit** When tasks in Catalog reach the node limit, you and your users see the following message: NODE\_LIMIT\_EXCEEDED To resolve this issue, as a Tableau Server admin, you can increase the node limit using the `tsm configuration set –k metadata.query.limits.count` command. For more information, see the [tsm configuration](https://help.tableau.com/current/server/en-us/cli_configuration_tsm.htm) and [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm#metadata_nodelimit) topics. **Important:** Increasing the timeout limit can affect system memory. #### Missing content - If you suspect, after initial ingestion, content is missing from Catalog, you can use the Eventing API to help troubleshoot. Eventing handles indexing content on Tableau Server after initial ingestion. For more information, see [Get Eventing Status](https://help.tableau.com/v0.0/server-linux/en-us/dm_tools_eventing.htm). - When the connection between an embedded external asset and its downstream Tableau content is removed, it remains in Catalog (or the Tableau Metadata API) until it’s automatically deleted by a backgrounder process that runs everyday at 22:00:00 UTC (coordinated universal time). For example, suppose a workbook, initially published with an embedded text file A, is republished with an embedded text file B. File A remains visible (or query-able) as an external asset until the backgrounder processes is able to delete it. You can disable this backgrounder process from running if you do not want to remove these types of external assets or if you believe that it takes up system resources that you don’t want to dedicate to this process. Alternatively, you can adjust the number of external embedded assets that are deleted. For more information, see [features.DeleteOrphanedEmbeddedDatabaseAsset](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#metadata_orphanembedded) and [databaseservice.max\_database\_deletes\_per\_run](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#metadata_orphanembedded_maxnumber). You can monitor this process in one of two ways: - Filter on the **One-time job re-canonicalize existing database/table assets after a canonicalization logic change** task type in the [Background Tasks for Non Extracts](https://help.tableau.com/current/server/en-us/adminview_backgrnd_nonextract.htm) admin view. - Refer to the **Finished removal of orphaned embedded databases** or **database\_service\_canonicalization\_change** events in the [Tableau Server log files](https://help.tableau.com/current/server/en-us/logs_loc.htm). #### Performance after initial ingestion In some Tableau Server environments where specific content that is updated very frequently (for example, through high-frequency schedules or command line or API requests), the indexing process might get over saturated. In these cases, as the server admin, you might consider enabling event throttling to better preserve Catalog performance. For more information, see [metadata.ingestor.pipeline.throttleEventsEnable](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#metadata_eventthrottle_enable). **Note:** When event throttling is enabled, users might notice an intended delay in content changes in Catalog. #### Out of memory errors In some cases, Tableau Server out of memory errors can occur as a result of problems with ingesting complex content. If you suspect ingestion is the cause of the out of memory errors on your Tableau Server, contact and work with Tableau Support to [metadata.ingestor.blocklist](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#metadata_blocklist) from being ingested to help resolve the issue. ## Disable Catalog You can disable Catalog in one of two ways. #### Turn off Catalog capabilities for each site (Requires Data Management) You can turn off Catalog capabilities at any time. When Catalog capabilities are turned off, the features of Catalog, such as adding data quality warnings or the ability to explicitly manage permissions to database and table assets, are not accessible. However, Catalog continues to index published content and the metadata is accessible from the Tableau Metadata API and metadata methods in the Tableau REST API. 1. Sign in to Tableau Server using your admin credentials. 2. From the left navigation pane, click Settings. 3. On the General tab, under Tableau Catalog, clear the Turn on Tableau Catalog check box. #### Stop indexing metadata To stop indexing the published content on Tableau Server, you can disable the Tableau Metadata API. To disable the Metadata API, run the `tsm maintenance metadata-services disable` command. For more information, see [tsm maintenance](https://help.tableau.com/current/server/en-us/cli_maintenance_tsm.htm#cat_disable). ## Other articles in this section [Skip to main content](#main-content) # Enable the JMX Ports To help you work through a problem with Tableau Server, Tableau Support may ask you to enable the server's JMX ports. These ports can be useful for monitoring and troubleshooting, usually with a tool like JConsole. In versions 2022.1 and later, the JMX ports can be enabled securely and this is the recommended method. In versions earlier than 2022.1, you can only enable the ports unsecured. ## Enable secure JMX ports Beginning with version 2022.1 of Tableau Server, you can enable JMX ports securely. This procedure explains how to enable secure JMX. To enable JMX in earlier versions, see [Enable unsecured JMX ports](#EnableUnsecureJMX) below. To enable secure JMX ports on Tableau Server: 1. Log on as a user with `sudo` access to the computer where TSM is installed. 2. Run this command: tsm maintenance jmx enable The command has several options you can provide when running it. If you do not provide any options when you run the command, you will be prompted for options based on the answers you give. For example: C:\\Windows\\system32>tsm maintenance jmx enable We do not recommend you enable JMX unsecured on a production environment. Would you like to enable security features for JMX? (y/n): y JMX access is readonly by default. Would you like to add readwrite access? (y/n): n Would you like to enable SSL? (y/n): y Would you like to require client authentication (mTLS)? (y/n): n Enabling JMX with the specified settings. This will perform a server restart. Do you want to continue? (y/n): y Starting enable JMX asynchronous job. For more information on the command and its options, see [tsm maintenance jmx enable](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#jmx_enable). Enable unsecured JMX ports For versions of Tableau Server earlier than 2022.1.0, if you are enabling JMX ports they can only be enabled unsecured. **Important** Enabling unsecured JMX ports can introduce some security risk. We strongly recommend using secure JMX. If you do not have a version of Tableau Server that supports this, be aware of the risk and mitigate it by limiting access to the JMX ports to the fewest number of clients that's practical for your scenario. You typically limit access using the host's firewall rules, an external security device, or routing rules. To enable unsecured JMX ports on Tableau Server: 1. [Stop the server.](https://help.tableau.com/v0.0/server-linux/en-us/cli_stop_tsm.htm#stop) 2. Enter the following command: ``` tsm configuration set -k service.jmx_enabled -v true ``` 3. Apply pending changes: ``` tsm pending-changes apply ``` If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). 4. Restart the Coordination Service and TSM Administration Controller (as _tableau_ system account): `sudo su -l tableau -c "systemctl --user restart appzookeeper_0.service"` `sudo su -l tableau -c "systemctl --user restart tabadmincontroller_0.service"` It may take a few minutes for tabadmincontroller to restart. If you attempt to apply pending changes in the next step before the controller has fully restarted, TSM will not be able to connect to the controller. You can verify that the controller is running by using the `tsm status -v` command. Tableau Server Administration Controller should be listed as "is running". 5. [Start the server](https://help.tableau.com/v0.0/server-linux/en-us/cli_start_tsm.htm#start). ## How the JMX Ports Are Determined By default, the JMX ports assigned dynamically, from within a range of available ports. For details on how port assignment is done, and how to override dynamic mapping, see [Tableau Services Manager Ports](https://help.tableau.com/v0.0/server-linux/en-us/ports.htm). [Skip to main content](#main-content) # Encrypted Data Collection To make sure the data collection from Tableau Server to Tableau Resource Monitoring Tool is encrypted, communications between RMT Server and Agents, and connections to Tableau Server Repository have to be enabled to use encrypted messaging. ## For versions 2022.3 and later - If RabbitMQ is installed on the same machine as the RMT Server (local configuration), Tableau Resource Monitoring Tool has built-in encrypted communications between RMT Server and agents. There is no set up required for encryption between RabbitMQ and RMT Server. - If RabbitMQ is hosted external to RMT Server (external configuration), you must follow the same steps as described in the [For versions 2022.2 and earlier](#For) section in this topic You still need to enable and configure [encrypted communications to Tableau Server](#Tableau) repository database in both cases stated above. ## Tableau Repository SSL Configuration 1. Make sure Tableau Server is configured to use SSL connections for internal Postgres connections. For more information, see [Configure SSL for Internal Postgres Communication](https://help.tableau.com/v0.0/server-linux/en-us/ssl_config_postgres.htm). The Resource Monitoring Toolallows you to use either the certificate file or thumbprint for the SSL connections. If you plan to use the certificate file, copy the certificate file generated by Tableau Server for internal Postgres SSL connections, to the machine where you plan to install the RMT Server. For more information, see [Configure Postgres SSL to Allow Direct Connections from Clients](https://help.tableau.com/v0.0/server-linux/en-us/ssl_config_direct_cx.htm). 2. On the RMT Server web interface, from the Admin menus, select Environments. Click on the edit environment icon. In the Tableau Repository Configuration section: 1. In the SSL Mode drop down box, select Prefer SSL or Require SSL to configure SSL connections to Tableau Repository. Choosing Disable means SSL will never be used to make Tableau Server Repository connections. In the Prefer SSL mode, the Resource Monitoring Tool will use SSL in the first attempt, and if that fails the subsequently attempts a non-encrypted connection. In the Require SSL mode, if the SSL connection fails, the connections to Tableau Server Repository will fail entirely. In this case, Tableau Server REST API connections will be used to communicate with Tableau Server. 2. You can choose to either supply the thumbprint that was generated by Tableau Server, or copy the **server.crt** file to the Resource Monitoring Tool Master Server machine. If you choose to copy the certificate file, you don't have to supply the thumbprint. For more information, see [Configure Postgres SSL to Allow Direct Connections from Clients](https://help.tableau.com/v0.0/server-linux/en-us/ssl_config_direct_cx.htm). ## For versions 2022.2 and earlier Encrypted communication between the Agent(s) and RMT Server is possible by performing the following: - [Configuring RabbitMQ with SSL/TLS certificates.](#RabbitMQ) - [Configuring the RMT Server and agent(s) to enable encrypted messaging.](#Setup) - [Configuring encrypted connections to Tableau Repository](#Tableau). ## RabbitMQ Setup For details on RabbitMQ server setup please reference RabbitMQ’s documentation for [TLS Setup](https://www.rabbitmq.com/ssl.html). ## Tableau Resource Monitoring Tool Setup After RabbitMQ has been configured for TLS all client applications: the Tableau Resource Monitoring Tool RMT Server and all Agents will need to be configured to enable encrypted messaging. Do the following on the RMT Server web interface: 1. On the machine where RMT Server is installed, go to: _http:///setup/server_. 2. In the Message Queue section, check the Enable TLS check box, and provide the Certificate Host Name. 3. Update the port information if needed. When configuring the RMT Server and agent(s) for encrypted messaging: - Both the `enabled` flag and the `certificateHostName` must be configured for encryption to be enabled. - The `certificateHostName` variable must match the canonical name (CN=) on the server certificate or the connection will fail. - The `port` number will likely need to be changed based on the TLS port you configured on RabbitMQ. **Note:** If the Agents were already registered before SSL was configured, then you must re-register the agent. To do this, download the new bootstrap file and re-register the Agent using the new bootstrap file. For more information on re-registering the Agent, see [Re-registering an Agent](https://help.tableau.com/v0.0/server-linux/en-us/rmt-tableau-server-topology-changes.htm#reregister-agent). ## Who can do this To configure encrypted data collection you must be both a Tableau Server Administrator and a Resource Monitoring Tool administrator. [Skip to main content](#main-content) # Ensure Access to Subscriptions and Data-Driven Alerts To ensure that users see the Subscribe and Alert buttons in the Tableau Server toolbar and can receive related emails, do the following: - **Configure SMTP and event notifications on Tableau Server**: See [Set Up a Site for Subscriptions](https://help.tableau.com/v0.0/server-linux/en-us/subscribe.htm). - **Ensure that users have an email address in Tableau Server**: Users can update their email address on [their account settings page](http://onlinehelp.tableau.com/current/pro/desktop/en-us/useracct.htm). - **Embed database credentials or don't require them**: To email data in a view, Tableau Server needs to access the data without user involvement. This can be accomplished by using a workbook with embedded database credentials, a Tableau Server data source, or data that doesn't require credentials (such as a file that's included with the workbook at publish time). - **Ensure that users can access needed workbooks and views**: Access to workbooks and views on the server is controlled by the View permission. To receive images of content in email messages, users also need the Download Image/PDF permission. For more information, see [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm#permissioncapabilities). - **Avoid trusted authentication for embedded views**: If you use restricted tickets (the default) to render an embedded view, the Subscribe and Alert buttons don't appear. (Alerts only) Ensure that users can access published data sources with View and Connect capabilities. [Skip to main content](#main-content) # Entity Definitions and Templates You can use the entity definitions and templates with the `tsm settings import` command to configure various Tableau Server settings. ## Other articles in this section [Skip to main content](#main-content) # Environment Down Incidents _Environment Down_ incidents will be logged as critical when we detect that your Tableau Server is offline. Following are couple of use cases where Tableau Server is considered offline by Tableau Resource Monitoring Tool: - Resource Monitoring Tool is unable to get a response from Tableau Server. Resource Monitoring Tool will retry three times before the incident is logged. - If Resource Monitoring Tool detects that a process is down across all the nodes, an environment down incident will be logged. Resource Monitoring Tool polls Tableau Server’s `http://{TableauServerUrl}/admin/systeminfo.xml` page every 30 seconds (by default) to check the status. If the 30 second polling interval is not sufficient, increase the interval to 60 seconds. If the status is offline, or does not reply within the set value for three consecutive polling intervals then a critical incident is created. **Note:** The polling interval cannot be set using the rmtadmin set command. This setting can only be changed by editing the config.json file." An example `config.json` snippet is below: ``` { "background": { "run":true, "loglevel":"Information", "pollRates": { "processStatus": 30000 } } } ``` | Key | Data Type | Required? | Description | | --- | --- | --- | --- | | `processStatus` | Number | Optional | The amount of time in milliseconds to pause between Tableau Server status polling. | ## Who can do this Resource Monitoring Tool Administrator or a Resource Monitoring Tool user with **Server/Environment Management** role. [Skip to main content](#main-content) # Example: Install and Configure a Three-Node HA Cluster A multi-node high availability installation of Tableau Server can help to maximize the efficiency and availability of Tableau Server. When configuring a multi-node Tableau Server deployment, the steps you perform are designed to build in redundancy, helping to reduce your potential downtime. In addition to simply improving efficiency by moving or adding server processes to additional nodes, you can create a highly available (HA) installation of Tableau Server by satisfying these requirements: - Add additional nodes for a total of at least three nodes - Deploy a Coordination Service ensemble on at least three nodes - Add an instance of Client File Service (CFS) on at least one additional node (we recommend adding an instance on each node running the Coordination Service) - Add a second instance of the File Store on one of the additional nodes (Data Engine will be installed automatically, if it is not already on the node) - Add a second instance of the Repository (pgsql) on one of the additional nodes A Tableau Server installation that includes these additions will have built-in redundancy and can support failover in the event of a problem with the repository. This example shows how to do this, and more. ## A Single Server System After installing Tableau Server on an initial node, you have a system that is running everything it needs to function. It has at least one instance of all server processes and is the most basic configuration of Tableau Server. It has no redundancy. The server topology looks like this (some TSM-specific processes are not shown): ![A diagram illustrates a single node server configuration.](/tableau/next/en-us/server-linux/en-us/Img/baseline_config_onenode1_200x1028.png) ## A Three-Node System To build in redundancy, you need to add additional nodes to host instances of the repository and the data engine and file store processes. You can add instances of other processes, including multiple instances of a process on a node. In addition, to reduce the system's vulnerability, you can run multiple gateways and additional instances of some of the server processes. The fewest number of computers required to achieve this configuration is three. In the diagram below, the file store process has been added to both additional nodes. A second, passive instance of the repository has also been added to one of the other new nodes. Finally, the server processes (shown in blue) have been added to the additional nodes to provide redundancy. ![A diagram illustrates a three-node server configuration.](/tableau/next/en-us/server-linux/en-us/Img/baseline_config_ha_tsm1.png) ## Configuration steps This procedure describes how to configure a three-node HA Tableau Server cluster with two repository instances and two file store/data engine instances on the additional nodes as pictured above. ## Before you begin Before you install Tableau Server on any additional nodes, ensure that each additional node meets the distributed requirements. See [Distributed Requirements](https://help.tableau.com/v0.0/server-linux/en-us/distrib_requ.htm) for details. **Note:** This operation includes steps that you may need to perform using the TSM command line. ### Step 1: Install the initial node See [Install and Configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm). ### Step 2: Generate a bootstrap file for the additional nodes 1. Open TSM in a browser: `https://:8850` For more information, see [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/v0.0/server-linux/en-us/sign_in_tsm.htm). 2. Click the Configuration tab, and in the Add a Node box, click Download Bootstrap File. ![A list of processes and the number of instances in a Tableau Server deployment.](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-linux-generate-bootstrap.png) The bootstrap file is created and copied to your local computer. Embedded credentials are included in the bootstrap file by default. If you don't want credentials embedded in the bootstrap file, clear the Include temporary credentials in file option. If you want to completely disable the ability to include embedded credentials in node bootstrap files, you can set a configuration option for the server. See [features.PasswordlessBootstrapInit](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#pwdlessbootstrap) for more details. ### Step 3: Install and initialize node 2 1. Copy the original installer you used on the first computer along with the bootstrap file you generated and put them in a location accessible from the new computer you are adding Tableau Server to. This could be a mounted network share, or directly on the new computer. 2. If you are running a local firewall, then you need to configure firewall rules for all the nodes in the cluster. For more information, see [Configure Local Firewall](https://help.tableau.com/v0.0/server-linux/en-us/config_firewall_linux.htm). 3. On the new node, run the Tableau Server Setup program: Use the package manager to install the Tableau Server package. You must install the new version to the same location as the existing version. The install location must be the same on all nodes. Do not install to a location using a symbolic link or to a directory on a Network File System (NFS) volume. - On RHEL-like distributions, including CentOS, you have the option to install Tableau to a non-default location. - **Default location**—To install to the default location (`/opt/tableau/tableau_server`), run the following commands, where `` is formatted as major-minor-maintenance (ex: `2025-3-5`): `sudo yum update` `sudo yum install tableau-server-.x86_64.rpm` - **Non-default location**—To install to a non-default location, you must use `rpm -i`. You will also need to install all dependent packages. See the note below. Run the following command: sudo rpm -i --prefix /preferred/install/path tableau-server.rpm **Note:** When you use `yum` to install Tableau Server, all dependent packages are automatically downloaded and installed. This is the preferred method for installing Tableau. If you want to install to a non-default location, or your organization does not allow you to use `yum` and you must install using `rpm -i`, you must also install all dependent packages separately. For information about installing dependent packages, see [Installing Tableau Server on an Air-Gapped Computer Running Linux](https://help.tableau.com/v0.0/server-linux/en-us/install_air_gapped.htm#InstallAirgap). - On Ubuntu, run the following commands, where `` is formatted as major-minor-maintenance (ex: `2019-2-5`): sudo apt-get update sudo apt-get upgrade sudo apt-get -y install gdebi-core sudo gdebi -n tableau-server-\_amd64.deb 4. To initialize communications between your new node and the initial node, run the initialize-tsm script that is installed when you install Tableau Server. Navigate to the `scripts` directory: cd /opt/tableau/tableau\_server/packages/scripts./ 5. Run the initialize-tsm script: ``` sudo ./initialize-tsm -b /path/to/.json --accepteula ``` - Use the `-b` flag to provide the path to the bootstrap file that you copied to the computer. If you have encrypted the bootstrap file, then you must pipe the file as described in [Securing secrets for import and export operations](https://help.tableau.com/v0.0/server-linux/en-us/security_secret_storage.htm#Securing). - If the bootstrap file was generated without embedded credentials, use the `-u` flag to specify the user name of the administrative user on the initial node. This is the name of an administrative user on the computer, not the Tableau Server administrator. You will be prompted for the user password. For more information, see [tsm topology nodes get-bootstrap-file](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMGetBootstrap). ``` sudo ./initialize-tsm -b /path/to/.json -u --accepteula ``` **Important:** You must enter the credentials of the same user that you used during the installation process on the initial node. - The `--accepteula` flag accepts the Tableau Server End User License Agreement (EULA). The EULA is available in the following location: [End User License Agreement.](http://www.tableau.com/legal/eula) ### Step 4: Install and initialize node 3 Repeat Step 3 above. ### Step 5: Configure the new node with a minimum topology To complete the process of adding new nodes to your cluster, you need to configure them with a minimum topology. With a minimum topology, the only pending change will be the addition of Cluster Controller, which is required on each node. If you want other processes on the nodes you can add most of them at the same time. This example only configures the nodes with Cluster Controller. 1. Open TSM in a browser: `https://:8850` For more information, see [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/v0.0/server-linux/en-us/sign_in_tsm.htm). 2. Click the Configuration tab. A message should tell you that new nodes were added. ![Message indicating that a new node was added to a cluster in Tableau Server.](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-node-added.png) Click Continue to dismiss the message. 3. Click Pending Changes at the top of the page: ![Tableau Server Manager toolbar indicating that there are pending changes.](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-pending-changes-btn.png) If you are configuring a cluster with three or more nodes, a Coordination Service ensemble warning displays. You can continue. You will deploy a Coordination Service ensemble in a separate step. 4. Click Apply Changes and Restart and Confirm to confirm a restart of Tableau Server. When Tableau Server restarts, the nodes are included with the minimum topology necessary. ### Step 6: Deploy a Coordination Service ensemble If you install a total of three or more nodes, you should also deploy a Coordination Service ensemble. If you do not, you will get a warning message every time you make changes to the server configuration or topology. You can ignore this message, but as a best practice you should deploy a multi-node Coordination Service ensemble. When you install Tableau Server, a single instance of the Coordination Service is installed on the initial node. TSM and Tableau Server depend on the Coordination Service to function properly, so to provide redundancy and ensure availability on multi-node installations, configure additional instances of the Coordination Service by deploying a Coordination Service ensemble. Coordination Service ensembles are installed with one, three, or five instances of the Coordination Service. In a three-node installation of Tableau Server, the recommended number of Coordination Service instances is three, one on each node. Do not attempt to deploy a Coordination Service ensemble if there are other changes pending. Discard or apply any pending changes before deploying a new Coordination Service ensemble. **Note:** This operation includes steps that you may need to perform using the TSM command line. The following steps illustrate how to deploy a new Coordination Service ensemble on an existing three-node Tableau Server cluster and clean up the old ensemble. 1. On the initial node, open a terminal session. 2. Stop Tableau Server: `tsm stop` If prompted, sign in as a TSM administrator. Some TSM processes will continue to run, including the Administration Controller and Administration Agent. 3. Confirm there are no pending changes: `tsm pending-changes list` If there are pending changes, you need to either discard the changes or apply them. Applying pending changes will take some time: - Discard the changes tsm pending-changes discard or - Apply the changes: tsm pending-changes apply Wait until the command completes and you are returned to the system prompt. 4. Get the node IDs for each node in the cluster: `tsm topology list-nodes -v` 5. Use the `tsm topology deploy-coordination-service` command to add a new Coordination Service ensemble by adding the Coordination Service to specified nodes. You must specify the node(s) that the Coordination Service should be added to, using the actual node ID to identify each node. The command also makes the new ensemble the "production" ensemble (the ensemble in use) and removes the old ensemble, unless the deployment fails. If this happens, see step 6 below. **Note:** A "y/n" prompt displays confirming that a server restart will take place. To run the command without input, include the `--ignore-prompt` option. For example, deploy the Coordination Service to all three nodes of a three-node cluster, where the nodes are node1, node2, and node3: `tsm topology deploy-coordination-service -n node1,node2,node3` Wait until the command completes and you are returned to the system prompt. 6. (Optional) If the deployment fails, you need to run the `tsm topology cleanup-coordination-service` command to remove the unsuccessfully deployed ensemble. For details on running the command, see [tsm topology cleanup-coordination-service](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMCleanupCoordination). 7. Start Tableau Server: `tsm start` For more information and details on deploying a new Coordination Service ensemble, see [Deploy a Coordination Service Ensemble](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_zk.htm) . ### Step 7: Configure Client File Services (CFS) on additional nodes Add CFS to additional nodes. We recommend you add CFS to every node running the Coordination Service. **Note:** This operation includes steps that you may need to perform using the TSM command line. 1. On the initial node, open a terminal session. 2. Find the node ID for the node you are adding CFS to: `tsm topology list-nodes -v` 3. Add CFS on the node by specifying the node, the process, and a single instance. For example, this command adds an instance of CFS to node2: `tsm topology set-process -n node2 -pr clientfileservice -c 1` If you attempt to add an instance of CFS to a node that already is configured with CFS, an error message will let you know there is already an instance on the node. To add CFS to additional nodes, repeat this step for each node. 4. Apply the changes: `tsm pending-changes apply` ### Step 8: Configure processes for node 2 1. Open TSM in a browser: `https://:8850` For more information, see [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/v0.0/server-linux/en-us/sign_in_tsm.htm). 2. Click the Configuration tab. 3. Specify the processes and number of instances that should run on the first additional node. In this example: 1. Select Gateway. 2. Set the Application Server (vizportal) count to 2. 3. Set the VizQL Server count to 2. 4. Set the Cache Server count to 2. 5. Set the Backgrounder count to 2. Adding Backgrounder to a node will also add an instance of Data Engine if one is not already on the node. 6. Set the Data Server count to 2. 7. Select File Store. 8. Select Repository (pgsql). 9. Select Metrics Service. (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm).) 10. Select Messaging Service. 11. Select Data Source Properties. 12. Select Content Exploration Service. 13. Select Collections Service. 14. Select Search and Index Server. The specific processes and process counts you set will depend on your organizational environment and needs. Some processes are added automatically when you add another process. For more information, see [Configure Nodes](https://help.tableau.com/v0.0/server-linux/en-us/config_nodes.htm) and [Tableau Server Processes](https://help.tableau.com/v0.0/server-linux/en-us/processes.htm). **Note:** The TSM Web UI limits you to a maximum of 8 instances of processes that allow you to select the number of instances. To configure more instances than this, use the command line and the `TSM topology set-process` command. For more information, see [tsm topology set-process](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMSetProcess). ### Step 9: Configure processes for node 3 1. In TSM, on the Configuration tab, specify the processes and number of instances that should run on the second additional node. In this example: 1. Select Gateway. 2. Set the Application Server (vizportal) count to 2. 3. Set the VizQL Server count to 2. 4. Set the Cache Server count to 2. 5. Set the Backgrounder count to 2. Adding Backgrounder to a node will also add an instance of Data Engine if one is not already on the node. 6. Set the Data Server count to 2. 7. Select File Store. 8. Select Metrics Service. (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm).) 9. Select Data Source Properties. 10. Select Content Exploration Service. 11. Select Collections Service. 12. Select Search and Index Server. 2. Click Pending Changes at the top of the page: ![Tableau Server Manager toolbar indicating that there are pending changes.](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-pending-changes-btn.png) The Pending Changes list displays. 3. Click Apply Changes and Restart and Confirm to confirm a restart of Tableau Server. ### Step 1: Install the initial node See [Install and Configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm). ### Step 2: Generate a bootstrap file for the additional nodes To install Tableau Server on additional computers you use the same installer you did for the initial node, along with a "bootstrap" file you generate on the initial node. **Important**: The bootstrap file contains a copy of the master keystore file used for encrypting the configuration secrets. The file can also embedded credentials which are valid for a predetermined amount of time (see [tabadmincontroller.auth.expiration.minutes](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#tabadminctrlrauthexpire)) and serve as a session cookie. We strongly recommend that you take additional measures to secure the bootstrap file. The following command set provides an example method to encrypt the bootstrap file output. This method is similar to the encryption process described in more detail at [Securing secrets for import and export operations](https://help.tableau.com/v0.0/server-linux/en-us/security_secret_storage.htm#Securing). Note however, the method here must be passed as separate arguments with trailing `&& \` operators as follows: `mkfifo -m 600 /tmp/secure1 && \` `tsm topology nodes get-bootstrap-file --file /tmp/secure1 && \` `gpg --symmetric --batch --yes --passphrase-file ~/.secrets/pgppassphrase.txt --cipher-algo AES256 --output encrypted.enc < /tmp/secure1 && \` `rm /tmp/secure1` 1. After installing Tableau Server on the initial node, generate the node bootstrap file. 2. On the initial node, open a terminal session. 3. Type this command to generate the bootstrap file: `tsm topology nodes get-bootstrap-file --file .json` Embedded credentials are included in the bootstrap file by default. If you don't want the bootstrap file to include credentials, use the `-nec` or `--no-embedded-credentials` option: `tsm topology nodes get-bootstrap-file --file .json --no-embedded-credentials`. If you want to completely disable the ability to include embedded credentials in node bootstrap files, you can set a configuration option for the server. See [features.PasswordlessBootstrapInit](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#pwdlessbootstrap) for more details. ### Step 3: Install and initialize node 2 1. Copy the original installer you used on the first computer along with the bootstrap file you generated and put them in a location accessible from the new computer you are adding Tableau Server to. This could be a mounted network share, or directly on the new computer. 2. If you are running a local firewall, then you need to configure firewall rules for all the nodes in the cluster. For more information, see [Configure Local Firewall](https://help.tableau.com/v0.0/server-linux/en-us/config_firewall_linux.htm). 3. On the new node, run the Tableau Server Setup program: Use the package manager to install the Tableau Server package. You must install the new version to the same location as the existing version. The install location must be the same on all nodes. Do not install to a location using a symbolic link or to a directory on a Network File System (NFS) volume. - On RHEL-like distributions, including CentOS, you have the option to install Tableau to a non-default location. - **Default location**—To install to the default location (`/opt/tableau/tableau_server`), run the following commands, where `` is formatted as major-minor-maintenance (ex: `2025-3-5`): `sudo yum update` `sudo yum install tableau-server-.x86_64.rpm` - **Non-default location**—To install to a non-default location, you must use `rpm -i`. You will also need to install all dependent packages. See the note below. Run the following command: sudo rpm -i --prefix /preferred/install/path tableau-server.rpm **Note:** When you use `yum` to install Tableau Server, all dependent packages are automatically downloaded and installed. This is the preferred method for installing Tableau. If you want to install to a non-default location, or your organization does not allow you to use `yum` and you must install using `rpm -i`, you must also install all dependent packages separately. For information about installing dependent packages, see [Installing Tableau Server on an Air-Gapped Computer Running Linux](https://help.tableau.com/v0.0/server-linux/en-us/install_air_gapped.htm#InstallAirgap). - On Ubuntu, run the following commands, where `` is formatted as major-minor-maintenance (ex: `2019-2-5`): sudo apt-get update sudo apt-get upgrade sudo apt-get -y install gdebi-core sudo gdebi -n tableau-server-\_amd64.deb 4. To initialize communications between your new node and the initial node, run the initialize-tsm script that is installed when you install Tableau Server. On the new node: Navigate to the `scripts` directory: cd /opt/tableau/tableau\_server/packages/scripts./ 5. Run the initialize-tsm script: ``` sudo ./initialize-tsm -b /path/to/.json --accepteula ``` - Use the `-b` flag to provide the path to the bootstrap file that you copied to the computer. If you have encrypted the bootstrap file, then you must pipe the file as described in [Securing secrets for import and export operations](https://help.tableau.com/v0.0/server-linux/en-us/security_secret_storage.htm#Securing). - If the bootstrap file was generated without embedded credentials, use the `-u` flag to specify the user name of the administrative user on the initial node. This is the name of an administrative user on the computer, not the Tableau Server administrator. You will be prompted for the user password. For more information, see [tsm topology nodes get-bootstrap-file](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMGetBootstrap). ``` sudo ./initialize-tsm -b /path/to/.json -u --accepteula ``` **Important:** You must enter the credentials of the same user that you used during the installation process on the initial node. - The `--accepteula` flag accepts the Tableau Server End User License Agreement (EULA). The EULA is available in the following location: ``` /opt/tableau/tableau_server/packages/docs./EULA.rtf ``` ### Step 4: Install and initialize node 3 Install Tableau Server on node 3: 1. Copy the original installer you used on the first computer along with the bootstrap file you generated and put them in a location accessible from the new computer you are adding Tableau Server to. This could be a mounted network share, or directly on the new computer. 2. If you are running a local firewall, then you need to configure firewall rules for all the nodes in the cluster. For more information, see [Configure Local Firewall](https://help.tableau.com/v0.0/server-linux/en-us/config_firewall_linux.htm). 3. On the new node, run the Tableau Server Setup program: Use the package manager to install the Tableau Server package. You must install the new version to the same location as the existing version. The install location must be the same on all nodes. Do not install to a location using a symbolic link or to a directory on a Network File System (NFS) volume. - On RHEL-like distributions, including CentOS, you have the option to install Tableau to a non-default location. - **Default location**—To install to the default location (`/opt/tableau/tableau_server`), run the following commands, where `` is formatted as major-minor-maintenance (ex: `2025-3-5`): `sudo yum update` `sudo yum install tableau-server-.x86_64.rpm` - **Non-default location**—To install to a non-default location, you must use `rpm -i`. You will also need to install all dependent packages. See the note below. Run the following command: sudo rpm -i --prefix /preferred/install/path tableau-server.rpm **Note:** When you use `yum` to install Tableau Server, all dependent packages are automatically downloaded and installed. This is the preferred method for installing Tableau. If you want to install to a non-default location, or your organization does not allow you to use `yum` and you must install using `rpm -i`, you must also install all dependent packages separately. For information about installing dependent packages, see [Installing Tableau Server on an Air-Gapped Computer Running Linux](https://help.tableau.com/v0.0/server-linux/en-us/install_air_gapped.htm#InstallAirgap). - On Ubuntu, run the following commands, where `` is formatted as major-minor-maintenance (ex: `2019-2-5`): sudo apt-get update sudo apt-get upgrade sudo apt-get -y install gdebi-core sudo gdebi -n tableau-server-\_amd64.deb 4. To initialize communications between your new node and the initial node, run the initialize-tsm script that is installed when you install Tableau Server. On the new node: Navigate to the `scripts` directory: cd /opt/tableau/tableau\_server/packages/scripts./ 5. Run the initialize-tsm script: ``` sudo ./initialize-tsm -b /path/to/.json --accepteula ``` - Use the `-b` flag to provide the path to the bootstrap file that you copied to the computer. If you have encrypted the bootstrap file, then you must pipe the file as described in [Securing secrets for import and export operations](https://help.tableau.com/v0.0/server-linux/en-us/security_secret_storage.htm#Securing). - If the bootstrap file was generated without embedded credentials, use the `-u` flag to specify the user name of the administrative user on the initial node. This is the name of an administrative user on the computer, not the Tableau Server administrator. You will be prompted for the user password. For more information, see [tsm topology nodes get-bootstrap-file](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMGetBootstrap). ``` sudo ./initialize-tsm -b /path/to/.json -u --accepteula ``` **Important:** You must enter the credentials of the same user that you used during the installation process on the initial node. - The `--accepteula` flag accepts the Tableau Server End User License Agreement (EULA). The EULA is available in the following location: ``` /opt/tableau/tableau_server/packages/docs./EULA.rtf ``` ### Step 5: Add a process to the additional nodes 1. On the initial node, configure a cluster controller instance on each additional node: `tsm topology set-process -n -pr clustercontroller -c 1` `tsm topology set-process -n -pr clustercontroller -c 1` 2. Apply the node configuration changes: ``` tsm pending-changes apply --ignore-warnings ``` A warning about deploying a Coordination Service ensemble displays because you have deployed a three-node cluster. Use the `--ignore-warnings` option to apply the configuration changes in spite of the warning. You will deploy a new Coordination Service ensemble in the next step. ### Step 6: Deploy a Coordination Service ensemble If you install a total of three or more nodes, you should also deploy a Coordination Service ensemble. If you do not, you will get a warning message every time you make changes to the server configuration or topology. You can ignore this message, but as a best practice you should deploy a multi-node Coordination Service ensemble. When you install Tableau Server, a single instance of the Coordination Service is installed on the initial node. TSM and Tableau Server depend on the Coordination Service to function properly, so to provide redundancy and ensure availability on multi-node installations, configure additional instances of the Coordination Service by deploying a Coordination Service ensemble. Coordination Service ensembles are installed with one, three, or five instances of the Coordination Service. In a three-node installation of Tableau Server, the recommended number of Coordination Service instances is three, one on each node. Do not attempt to deploy a Coordination Service ensemble if there are other changes pending. Discard or apply any pending changes before deploying a new Coordination Service ensemble. **Note:** This operation includes steps that you may need to perform using the TSM command line. The following steps illustrate how to deploy a new Coordination Service ensemble on an existing three-node Tableau Server cluster and clean up the old ensemble. 1. On the initial node, open a terminal session. 2. Stop Tableau Server: `tsm stop` If prompted, sign in as a TSM administrator. Some TSM processes will continue to run, including the Administration Controller and Administration Agent. 3. Confirm there are no pending changes: `tsm pending-changes list` If there are pending changes, you need to either discard the changes or apply them. Applying pending changes will take some time: - Discard the changes tsm pending-changes discard or - Apply the changes: tsm pending-changes apply Wait until the command completes and you are returned to the system prompt. 4. Get the node IDs for each node in the cluster: `tsm topology list-nodes -v` 5. Use the `tsm topology deploy-coordination-service` command to add a new Coordination Service ensemble by adding the Coordination Service to specified nodes. You must specify the node(s) that the Coordination Service should be added to, using the actual node ID to identify each node. The command also makes the new ensemble the "production" ensemble (the ensemble in use) and removes the old ensemble, unless the deployment fails. If this happens, see step 6 below. **Note:** A "y/n" prompt displays confirming that a server restart will take place. To run the command without input, include the `--ignore-prompt` option. For example, deploy the Coordination Service to all three nodes of a three-node cluster, where the nodes are node1, node2, and node3: `tsm topology deploy-coordination-service -n node1,node2,node3` Wait until the command completes and you are returned to the system prompt. 6. (Optional) If the deployment fails, you need to run the `tsm topology cleanup-coordination-service` command to remove the unsuccessfully deployed ensemble. For details on running the command, see [tsm topology cleanup-coordination-service](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMCleanupCoordination). 7. Start Tableau Server: `tsm start` For more information and details on deploying a new Coordination Service ensemble, see [Deploy a Coordination Service Ensemble](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_zk.htm) . ### Step 7: Configure Client File Services (CFS) on additional nodes Add CFS to additional nodes. We recommend you add CFS to every node running the Coordination Service. **Note:** This operation includes steps that you may need to perform using the TSM command line. 1. On the initial node, open a terminal session. 2. Find the node ID for the node you are adding CFS to: `tsm topology list-nodes -v` 3. Add CFS on the node by specifying the node, the process, and a single instance. For example, this command adds an instance of CFS to node2: `tsm topology set-process -n node2 -pr clientfileservice -c 1` If you attempt to add an instance of CFS to a node that already is configured with CFS, an error message will let you know there is already an instance on the node. To add CFS to additional nodes, repeat this step for each node. 4. Apply the changes: `tsm pending-changes apply` ### Step 8: Configure processes for node 2 1. On the initial node, set the topology for node 2. The topology specifies which processes should run on the node, and how many instances of each process should run. For details about configuring nodes, see [Configure Nodes](https://help.tableau.com/v0.0/server-linux/en-us/config_nodes.htm). Data engine will be added automatically when you add other processes. For details on when data engine is added, see [Tableau Server Processes](https://help.tableau.com/v0.0/server-linux/en-us/processes.htm). 1. Get the node-id for the new node: `tsm topology list-nodes -v` 2. Specify individual processes that will run on the new node: `tsm topology set-process -n -pr gateway -c 1` `tsm topology set-process -n -pr vizqlserver -c 2` `tsm topology set-process -n -pr vizportal -c 2` `tsm topology set-process -n -pr backgrounder -c 2` `tsm topology set-process -n -pr cacheserver -c 2` `tsm topology set-process -n -pr indexandsearchserver -c 1` `tsm topology set-process -n -pr dataserver -c 2` `tsm topology set-process -n -pr filestore -c 1` `tsm topology set-process -n -pr pgsql -c 1` `tsm topology set-process -n -pr metrics -c 1` `tsm topology set-process -n -pr activemqserver -c 1` `tsm topology set-process -n -pr tdsservice -c 1` `tsm topology set-process -n -pr contentexploration -c 1` `tsm topology set-process -n -pr collections -c 1` 2. Apply the node configuration changes. You will be prompted with a message that Tableau Server will restart. ``` tsm pending-changes apply ``` ### Step 9: Configure processes for node 3 On the initial node, set the topology for node 3. The topology specifies which processes should run on the node, and how many instances of each process should run. Data engine will be added automatically when you add other processes. For details on when data engine is added, see [Tableau Server Processes](https://help.tableau.com/v0.0/server-linux/en-us/processes.htm). 1. Get the node-id for the new node: `tsm topology list-nodes -v` 2. Specify individual processes that will run on the new node: `tsm topology set-process -n -pr gateway -c 1` `tsm topology set-process -n -pr vizqlserver -c 2` `tsm topology set-process -n -pr vizportal -c 2` `tsm topology set-process -n -pr backgrounder -c 2` `tsm topology set-process -n -pr cacheserver -c 2` `tsm topology set-process -n -pr indexandsearchserver -c 1` `tsm topology set-process -n -pr dataserver -c 2` `tsm topology set-process -n -pr filestore -c 1` `tsm topology set-process -n -pr metrics -c 1` `tsm topology set-process -n -pr tdsservice -c 1` `tsm topology set-process -n -pr contentexploration -c 1` `tsm topology set-process -n -pr collections -c 1` 3. Apply the node configuration. You will be prompted with a message that Tableau Server will restart. ``` tsm pending-changes apply ``` 4. Start the server: `tsm start` ### Step 10: Configure firewall rules (optional) If you are running a local firewall, then you need to configure firewall rules for all the nodes in the cluster. For more information, see [Local firewall configuration](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm#firewall) and [Configure Local Firewall](https://help.tableau.com/v0.0/server-linux/en-us/config_firewall_linux.htm). ## Add a Load Balancer At this point, all three nodes have gateways, which are used to route requests to available server processes. All gateways are active, but to further reduce the potential for downtime in the cluster, you can configure a load balancer. For more information, see [Add a Load Balancer](https://help.tableau.com/v0.0/server-linux/en-us/distrib_lb.htm). [Skip to main content](#main-content) # Example: Scripting Migration Plans **Note:** This topic includes a sample script you can use as the basis for scripting a multi-plan migration that satisfies your needs and environment. This script is intended to be used as a sample only, and not to be run as-is. For detailed instructions on using the console runner, see [Using the Tableau Content Migration Tool Console Runner](https://help.tableau.com/v0.0/server-linux/en-us/cmt-deployment_console_runner.htm). Tableau Content Migration Tool command line utility for running migrations can be used to automate the running of a migration plan from an external scheduler (such as Windows Task Scheduler) or from a custom script. The console runner only runs one migration plan (stored in a .edt file) at a time. If you have a group of migration plans you want to run as a group, then you can use a custom script in combination with the Content Migration Tool console runner. The example below is written in PowerShell and uses the console runner to execute a list of migration plans as a group. The following example code demonstrates: - Running multiple migration plans as a group using the console runner. - Optionally halting deployment of the group of plans immediately when any single migration in the group fails. - Using the console runner's exit code to determine whether the migration failed or logged warnings. \# List of migration plans to execute as a group. $planFiles = @( 'customer 1.tcmx', 'customer 2.tcmx' ) # True of false whether to continue with the next plan if a migration fails. $continueOnFailure = $false # Path to the CMT console runner executable $runnerExe = 'C:\\Program Files (x86)\\Tableau\\Tableau Content Migration Tool\\tabcmt-runner.exe' # Store the exit code from the previously run migration plan. $lastResult = -1 # Loop through and run each migration plan one at a time. $planFiles | % { $file = $\_ if ($lastResult -ge 2 -and -not($continueOnFailure)) { Write-Warning "Skipping plan because previous migration failed. \`nSkipped plan: $file" return } Write-Verbose "Running migration plan: $file" & $runnerExe $file $lastResult = $LASTEXITCODE if ($lastResult -ge 2) { Write-Error "Migration failed. See output or log file for error details.\`nPlan: $file" -ErrorAction 'Continue' } elseif ($lastResult -eq 1) { Write-Warning "Migration completed with warnings. See output or log file for warning details.\`nPlan: $file" } } ## Who can do this To script migration plans, you must have all the following: - Administrator permissions on the Content Migration Tool machine. - Tableau site user account with an Explorer role or higher. - View and Download Workbook/Save a Copy permissions on the source site. - Publishing rights for the destination site. [Skip to main content](#main-content) # Example: SSL Certificate - Generate a Key and CSR Important: This example is intended to provide general guidance to IT professionals who are experienced with SSL requirements and configuration. The procedure described in this article is just one of many available methods you can use to generate the required files. The process described here should be treated as an example and not as a recommendation. * * * When you configure Tableau Server to use Secure Sockets Layer (SSL) encryption, this helps ensure that access to the server is secure and that data sent between Tableau Server and Tableau Desktop is protected. Looking for Tableau Server on Windows? See [Example: SSL Certificate - Generate a Key and CSR](https://help.tableau.com/current/server/en-us/ssl_cert_create.htm "Opens topic in a new browser tab"). Tableau Server uses Apache, which includes [OpenSSL](http://www.openssl.org/). You can use the OpenSSL toolkit to generate a key file and Certificate Signing Request (CSR) which can then be used to obtain a signed SSL certificate. Tableau Server versions 2022.1.17, 2022.3.9, 2023.1.5, through 2025.1.x run OpenSSL 3.1. **Important:** Beginning with version 2025.2 (Tableau Desktop), 2025.3 (Tableau Server), and June 2025 (Tableau Cloud), Tableau uses OpenSSL 3.4.x and Level-2 security. Level-2 security requires keys of 2048 bits or longer. Any existing Level-1 security keys will no longer work and you will need to generate and deploy a new key pair. If you have been generating at least 2048-bit length keys as recommended, no action is necessary. For more information see [Generate a key](#generate-key). ## Steps to generate a key and CSR To configure Tableau Server to use SSL, you must have an SSL certificate. To obtain the SSL certificate, complete the steps: 1. [Generate a key file](#generate-key). 2. [Create a Certificate Signing Request (CSR)](#generate-csr). 3. [Send the CSR to a certificate authority (CA) to obtain an SSL certificate](#send-csr). 4. [Use the key and certificate to configure Tableau Server to use SSL](#config-server). You can find additional information on the [SSL FAQ page](http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#realcert) on the Apache Software Foundation website. ### Configure a certificate for multiple domain names Tableau Server allows SSL for multiple domains. To set up this environment, you need to modify the OpenSSL configuration file, openssl.conf, and configure a Subject Alternative Name (SAN) certificate on Tableau Server. See [For SAN certificates: modify the OpenSSL configuration file](#san-certs) below. ### Generate a key Generate a key file that you will use to generate a certificate signing request. 1. Run the following command to create the key file: `openssl genrsa -out .key 4096` **Notes:** - This command uses a 4096-bit length for the key. You should choose a bit length that is at least 2048 bits because communication encrypted with a shorter bit length is less secure. If a value is not provided, 512 bits is used. - To create PKCS#1 RSA keys with Tableau Server versions 2021.3.26, 2021.4.21, 2022.1.17, 2022.3.9, 2023.1.5, and later, you must use the additional option `-traditional` when running `openssl genrsa`" command based on the OpenSSL 3.1. For more information about the option, see [https://www.openssl.org/docs/man3.1/man1/openssl-rsa.html](https://www.openssl.org/docs/man3.1/man1/openssl-rsa.html). ### Create a certificate signing request to send to a certificate authority Use the key file you created in the procedure above to generate the certificate signing request (CSR). You send the CSR to a certificate authority (CA) to obtain a signed certificate. **Important:** If you want to configure a SAN certificate to use SSL for multiple domains, first complete the steps in [For SAN certificates: modify the OpenSSL configuration file](#san-certs) below, and then return to here to generate a CSR. 1. Run the following command to create a certificate signing request (CSR) file: openssl req -new -key yourcertname.key -out yourcertname.csr -config /opt/tableau/tableau\_server/packages/apache./conf/openssl.cnf 2. When prompted, enter the required information. **Note:** For **Common Name**, type the Tableau Server name. The Tableau Server name is the URL that will be used to reach the Tableau Server. For example, if you reach Tableau Server by typing `tableau.example.com` in the address bar of your browser, then `tableau.example.com` is the common name. If the common name does not resolve to the server name, errors will occur when a browser or Tableau Desktop tries to connect to Tableau Server. ### Send the CSR to a certificate authority to obtain an SSL certificate Send the CSR to a commercial certificate authority (CA) to request the digital certificate. For information, see the Wikipedia article [Certificate authority](http://en.wikipedia.org/wiki/Certificate_authority) and any related articles that help you decide which CA to use. ### Use the key and certificate to configure Tableau Server When you have both the key and the certificate from the CA, you can configure Tableau Server to use SSL. For the steps, see [Configure External SSL](https://help.tableau.com/v0.0/server-linux/en-us/ssl_config.htm). ## For SAN certificates: modify the OpenSSL configuration file In a standard installation of OpenSSL, some features are not enabled by default. To use SSL with multiple domain names, before you generate the CSR, complete these steps to modify the **openssl.cnf** file. 1. Navigate to the Apache **conf** folder for Tableau Server. For example: `/opt/tableau/tableau_server/packages/apache./conf` 2. Open **openssl.cnf** in a text editor, and find the following line: `req_extensions = v3_req` This line might be commented out with a hash sign (#) at the beginning of the line. ![The code demonstrates how to set extensions to be added to a certificate request.](/tableau/next/en-us/server-linux/en-us/Img/creating-ssl-cert-and-key1.png) If the line is commented out, uncomment it by removing the **#** and **space** characters from the beginning of the line. 3. Move to the **\[ v3\_req \]** section of the file. The first few lines contain the following text: `# Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment` After the **keyUsage** line, insert the following line: `subjectAltName = @alt_names` If you’re creating a self-signed SAN certificate, do the following to give the certificate permission to sign the certificate: 1. Add the `cRLSign` and `keyCertSign` to the **keyUsage** line so it looks like the following: `keyUsage = nonRepudiation, digitalSignature, keyEncipherment, cRLSign, keyCertSign` 2. After the **keyUsage** line, add the following line: `subjectAltName = @alt_names` 4. In the **\[alt\_names\]** section, provide the domain names you want to use with SSL. `DNS.1 = [domain1] DNS.2 = [domain2] DNS.3 = [etc]` The following image shows the results highlighted, with placeholder text that you would replace with your domain names. ![](/tableau/next/en-us/server-linux/en-us/Img/creating-ssl-cert-and-key2.png) 5. Save and close the file. 6. Complete the steps in [Create a certificate signing request to send to a certificate authority](#generate-csr) section, above. [Skip to main content](#main-content) # Explanation Types in Explain Data Each time you select a new mark in a viz or dashboard and run Explain Data, Tableau runs a new statistical analysis considering that mark and the underlying data in the workbook. Possible explanations are displayed in expandable sections for the Data Guide pane. For information about how Explain Data analyzes and evaluates explanations, see [How Explain Data Works](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_explained.htm). ## Explore underlying values This section lists explanations for each measure that can be explained (referred to as _target measures_). Each explanation listed here describes a relationship with the values of the target measure that are tested on the analyzed mark. Use your real-world, practical understanding of the data to determine if the relationships found by Explain Data are meaningful and worth exploring. ![Explain Data details about an analyzed mark, with text highlighted that describes a higher than expected trip distance sum value of 8,800.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_targetmeasure.png) In this example, Trip Distance is the target measure ### Underlying Characteristics These explanations describe how underlying records of the marks in the view may be contributing to the aggregated value of the measure being explained. Mark attributes can include [Extreme Values](#MA-Extreme), [Null Values](#MA-Null), [Number of Records](#MA-NR), or the [Average Value](#MA-AVG) of the mark. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations."). #### Extreme Values This explanation type indicates if one or more records have values that are significantly higher or lower than most records. If the explanation is supported by a model, it indicates the extreme value is affecting the target measure of the analyzed mark. When a mark has extreme values, it doesn't automatically mean it has outliers or that you should exclude those records from the view. That choice is up to you depending on your analysis. The explanation is simply pointing out an extreme value in the mark. For example, it could reveal a mistyped value in a record where a banana cost 10 dollars instead of 10 cents. Or, it could reveal that a particular sales person had a great quarter. **Note**: This explanation must be enabled by the author to be visible in viewing mode for a published workbook. For more information, see [Control Access to Explain Data](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_control_access.htm).

This explanation shows:

The number of underlying records in the analyzed mark.
The extreme value or values contributing to the value of the target measure.
The distribution of values in the mark.
The record details that correspond to each distribution value.

Exploration options:

Hover over a circle in the chart to see its corresponding value.
Select the left or right arrow below the details list to scroll through record details.
If available, select View Full Data, and then select the Full Data tab to see all records in a table.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

If the number of records is low, examine these values compared to the extreme value.
If the extreme value is significantly higher or lower than the other record values, exclude it and consider how it changes the value of the analyzed mark.
When considering the data with and without the extreme value, use this as an opportunity to apply your practical knowledge about the data.

In this example, a single extreme value of 463 hours rented is contributing to the higher than expected sum of Total Time Rented of 613 hours.

A likely reason for this high value could be that someone forgot to dock the bike when they returned it. In this case, the author might want to exclude this value for future analysis.

Visualize the Difference

This section shows:

How the analyzed mark value changes when the extreme value is excluded.

Exploration options:

Select the Open icon to see a larger version of the visualization.
Explore the difference with and without the extreme value (or values).
Authors can open the view as a new sheet and apply a filter to exclude the extreme value.

Next steps for analysis:

If the extreme value is significantly higher or lower than the other record values, exclude it and see how it changes the value of the analyzed mark.
When considering the data with and without the extreme value, use this as an opportunity to apply your practical knowledge about the data.

Visualize the Difference header displays with a snapshot of a map, and explanatory text indicating that when the extreme value is excluded, the value changes from 619.3 to 155.5.

In this example, when the extreme value of 483 is excluded, the analyzed mark is no longer high compared to other marks in the view.

In this example, when the extreme value of 483 is excluded, the analyzed mark is no longer high compared to other marks in the view. Other marks now stand out. The author might want to explore the other marks to consider why these other locations have higher hours for bike rentals.

#### Null Values The Null Values explanation type calls out situations where there is a higher than expected amount of missing data in a mark. It indicates the fraction of target measure values that are null and how the null values might be contributing to the aggregate value of that measure.

This explanation shows:

The percent of values that are null in the target measure for the analyzed mark (blue circle).

Exploration options:

Hover over each circle in the scatter plot to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Optionally exclude null values in the mark for further analysis.

A scatter plot with Explain Data text explaining that the percentage of null values may be contributing to the average value.

In this example, the percent of null values in the target measure is shown as a blue circle.

#### Number of Records This explanation type describes when the count of the underlying records is correlated to the sum. The analysis found a relationship between the number of records that are being aggregated in a mark and the mark's actual value. While this might seem obvious, this explanation type helps you explore whether the mark's value is being affected by the magnitude of the values in its records or simply because of the number of records in the analyzed mark.

This explanation shows:

The number of records in the target measure for the analyzed mark (dark blue bar).
The number of records in the target measure for other marks in the source visualization (light blue bar).

Exploration options:

Hover over each bar to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Compare whether the individual values of records are low or high, or the number of records in the analyzed mark is low or high.
Authors, if you are surprised by a high number of records, you might need to normalize the data.

A scatter plot showing the relationship between the count and sum of trip distances, with Explain Data text explaining that the sum of trip distance may be high because of the high number of records in August.

In this example, the number of records for Trip Distance is listed for each value of Ride Month, which is a dimension in the original visualization. August has the highest total trip distance value.

You might explore whether August has the highest value for trip distance because more rides occurred in August, or if it has the highest trip distance because some rides were longer.

#### Average Value of Mark This explanation type describes when the average of a measure is correlated to the sum. Compare whether the average value is low or high, or the number of records is low or high.

This explanation shows:

The average of the target measure for each value of a dimension used in the source visualization.

Exploration options:

Hover over each bar to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Compare whether the average value is low or high, or the number of records is low or high. For example, are profits high because you sold a lot of items or because you sold expensive items?
Try to figure out why the analyzed mark has a significantly higher or lower average value.

Average Trip Distance dimension selected with an explanation that the average trip distance is increasing the expected sum of trip distance for the explained mark.

In this example, the average trip distance for August is not significantly higher or lower than most months. This suggests that trip distance is higher for August because there were more rides in August, rather than from people taking longer rides.

### Contributing Single Value Use this explanation to understand the composition of the record values that make up the analyzed mark. This explanation type identifies when a single value in an unvisualized dimension may be contributing to the aggregate value of the analyzed mark. An unvisualized dimension is a dimension that exists in the data source, but isn't currently being used in the view. This explanation indicates when every underlying record of a dimension has the same value, or when a dimension value stands out because either many or few of the records have the same single value for the analyzed mark. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations.").

This explanation shows:

The percent of the number of records for a single value of a dimension for the analyzed mark (blue bar) versus all marks (gray bar) in the source visualization.
The percent of the number of records for all other values of a dimension for the analyzed mark (blue bar) versus all marks (gray bar) in the source visualization.
The average of the target measure for the single value of a dimension in the analyzed mark (blue bar) versus all marks (gray bar).
The average of the target measure for all other values of a dimension for the analyzed mark (blue bar) versus all marks (gray bar) in the source visualization.

Exploration options:

Hover over each bar to see its details.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Use this explanation to understand the composition of the record values that make up the analyzed mark.
Authors might want to create a new visualization to explore any unvisualized dimension surfaced in this explanation.

Explain Data details for a selected mark with bar charts showing records that impact the value.

In this example, the statistical analysis has exposed that many of the rides come from the station neighborhood of Back Bay. Note that Station Neighborhood is an unvisualized dimension that has some relationship to Trip Distance in the underlying data for the source visualization.

### Top Contributors Use this explanation to see the values that make up the largest fraction of the analyzed mark. For a COUNT aggregation, the top contributors show dimension values with the most records. For SUM, this explanation shows dimension values with the largest partial sum. ### Contributing Dimensions Use this explanation to understand the composition of the record values that make up the analyzed mark. This explanation type shows that the distribution of an unvisualized dimension may be contributing to the aggregate value of the analyzed mark. This type of explanation is used for target measure sums, counts, and averages. An unvisualized dimension is a dimension that exists in the data source, but isn't currently being used in the view. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations.").

This explanation shows:

The percent of the number of records for all values of a dimension for the analyzed mark (blue bar) versus all values of a dimension for all marks (gray bar) in the source visualization.
The average of the target measure for all values of a dimension for the analyzed mark (blue bar) all values of a dimension for all marks (gray bar).

Exploration options:

Hover over each bar to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Use this explanation to understand the composition of the record values that make up the analyzed mark.
Authors might want to create a new visualization to explore any unvisualized dimensions surfaced in this explanation.

Explain Data details for a selected mark and its distribution.

In this example, the statistical analysis has exposed that more rides were taken from South Station and MIT and fewer rides were taken from Charles Circle and Kendall, compared to rides taken for marks overall.

Note that Station Name is an unvisualized dimension that has some relationship to Trip Distance in the underlying data for the source visualization.

### Contributing Measures This explanation type shows that the average of an unvisualized measure may be contributing to the aggregate value of the analyzed mark. An unvisualized measure is a measure that exists in the data source, but isn't currently being used in the view. This explanation can reveal a linear or quadratic relationship between the unvisualized measure and the target measure. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations.").

This explanation shows:

The relationship between the sum of the target measure and the average of an unvisualized measure for the analyzed mark (blue circle) and all marks (gray circles) in the view.
If the sum of the target measure is high or low because the average value of the unvisualized measure is high or low.

Exploration options:

Hover over each circle to see its details.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Authors might want to create a new visualization to explore any unvisualized measures surfaced in this explanation.

Explain Data details for a selected measure.

In this example, one possible reason why trip distance is high is because the average total time rented is also high.

## Other things to explore This section provides possible reasons why the analyzed mark is unique or unusual. These explanations: - Do not explain why the value of this mark is what it is. - Are not related in any way to the value of the measures in the source visualization. - Do not take any target measures into account. ### Other Dimensions of Interest Use this explanation to understand the composition of the record values that make up the analyzed mark. The distribution of an unvisualized dimension in the analyzed mark is unusual compared to the distribution of values for all other marks in the view. An unvisualized dimension is a dimension that exists in the data source, but isn't currently being used in the view. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations.").

This explanation shows:

The percent of the number of records for all values of a dimension for the analyzed mark (blue bar) versus all values of a dimension for all marks (gray bar) in the source visualization.

Exploration options:

Hover over each bar to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Use this explanation to understand the composition of the record values that make up the analyzed mark.
Authors might want to create a new visualization to explore any unvisualized dimensions surfaced in this explanation.

Explain Data details for other dimensions of interest.

In this example, a high percentage of records are associated with overcast weather. Because the data is about bike rentals in Boston, and the analyzed mark is Trip Distance for August, we can assume that the weather is typically warm and humid. People might have rented bikes more often on overcast days to avoid the heat. It's also possible there were more overcast days in August.

[Skip to main content](#main-content) # Explore Dashboards with Data Guide Have you ever discovered a new Tableau dashboard and wondered what data means or how to use it? Or, have you ever published a new dashboard and wished that you could include instructions about how to use your dashboard? Data Guide provides helpful information about a dashboard and insights about the data behind it. Data Guide allows dashboard creators to provide more explanatory context for end users–like descriptions and links to resources–directly in the dashboard. And Data Guide automatically surfaces insights powered by [Explain Data](https://help.tableau.com/current/pro/desktop/en-us/explain_data.htm) to help users find outliers and learn about explanations for a mark. Explain the Viz (powered by Explain Data) identifies outlier measures and potential key drivers behind them. These contextually relevant details can help dashboard users navigate and use new dashboards more easily, allowing users to find insights faster, trust that they're looking at the right data, provide context for data, and establish confidence in their understanding of the viz. Alternatively, if you have a Tableau Cloud site with Tableau+, you can use Tableau Agent's Dashboard Narratives feature to explore your dashboard using AI. For more information, see [Create Dashboard Narratives with Tableau Agent (Beta)](https://help.tableau.com/current/pro/desktop/en-us/dashboard-narratives.htm). ## Customize Data Guide as an author 1. From your dashboard, choose the Edit button. 2. Choose Data Guide in the toolbar. 3. In the Data Guide pane, type a description to help your end users understand the purpose of your dashboard. 4. Select Add link, and enter a descriptive label for your link text and the URL. 5. Choose OK. 6. Select a viz (a sheet in the dashboard). Data Guide updates automatically so you can add a description and resources that are relevant to each viz in your dashboard. 7. Type a description, and add links relevant to the viz. 8. Choose OK. > [!TIP] > > To use Data Guide to write custom alt text to improve the accessibility of your vizzes, see [Show more text and make it helpful](https://help.tableau.com/v0.0/pro/desktop/en-us/accessibility_create_view.htm#show-more-text-and-make-it-helpful). ## Explore Data Guide as a dashboard user 1. From the dashboard, choose Data Guide in the toolbar. 2. Read the description of the dashboard and explore resources provided by the dashboard author. 3. Expand Data in This Dashboard and Detected Outliers to learn more about the underlying data used in the dashboard. 4. Select a viz (an object in the dashboard). 5. Read the description of the viz and explore resources provided by the dashboard author. 6. Expand Data Summary and Detected Outliers to learn more about data in that viz. 7. Select a mark or multiple marks, such as a bar on a chart or a region on a map, to see information about Data in This Mark and Applied Filters. Select a single mark to see possible Explanations for its value. ![Short animation showing how the Data Guide displays different information when you click on a dashboard, viz, or mark](/tableau/next/en-us/server-linux/en-us/Img/data_guide_ovw.gif) ## Explore Data Guide at different levels By default, Data Guide is closed when you open a workbook. And you can open Data Guide in the toolbar. At the top of the Data Guide pane, you see the name of the dashboard or viz that you selected. As a dashboard author, you can write descriptions for both the dashboard and for individual vizzes that make up your dashboard. ### Understand dashboard-level details At the dashboard level, Data Guide: - Displays the dashboard's name, author, and last published date. - Can include a description written by the dashboard author and links to related resources, such as videos or wiki pages. - Lists the data sources used by the dashboard and details about the data, such as which dimensions and measures are used. - Reveals detected outliers in the dashboard that are identified by Explain Data. For more information, see [Get Started with Explain Data](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm). ![The Data Guide pane at the dashboard level](/tableau/next/en-us/server-linux/en-us/Img/data_guide_dashboard_level.png) ### Understand viz-level details When a user selects a specific viz (dashboard object), Data Guide: - Displays the viz's name. - Can include a description written by the dashboard author and links to related resources, such as videos or wiki pages. - Lists the data sources used by the dashboard, including the dimensions and measures used. - Lists applied filters and data used in the viz, so you can identify how the data is being influenced by filters that users interact with. Only filters that a user can change are shown. - Has a summary of the data used in the viz, including the number of data points and sorting details. - Reveals detected outliers in the viz that are identified by Explain Data. For more information, see [Get Started with Explain Data](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm). ![The Data Guide pane at the viz level](/tableau/next/en-us/server-linux/en-us/Img/data_guide_viz_level.png) ### Understand mark-level details When a user selects a mark (or marks) such as region on a map, Data Guide: - Displays the name of the mark. - Lists applied filters and data used in the viz, so you know what's included and what's excluded. - Reveals detected outliers in the viz that are identified by Explain Data. For more information, see [Get Started with Explain Data](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_basics.htm). ![The Data Guide pane at the mark level](/tableau/next/en-us/server-linux/en-us/Img/data_guide_mark_level.png) ## Control Data Guide visibility By default, Data Guide is closed when you open a workbook. When you open or close Data Guide, it remains in this state for all workbooks on the site. In 2023.1 or later, a server administrator can hide Data Guide for all users. This removes the Data Guide button from the Tableau toolbar on all workbooks on the site. To hide Data Guide: 1. From the left pane, choose Settings. 2. From the General tab, scroll to Availability of Data Guide. 3. Choose Hide. 4. Choose Save. [Skip to main content](#main-content) # Explore Monitoring Data Using Tableau Data Source Files The Tableau Resource Monitoring Tool includes built-in charts that you can use to monitor and analyze Tableau Server health and performance. The data Tableau Resource Monitoring Tool leverages can be downloaded as Tableau data source (.tds) files for exploration within Tableau Desktop. You can download the .tds files from the **Admin** menu using the Resource Monitoring Tool web interface. This methods works for both local and external repository configurations. ![Admin dropdown menu on Tableau Server.](/tableau/next/en-us/server-linux/en-us/Img/rmt-tds-menu.png) The following is a list of Tableau data source (.tds) files you can download: - **Background Tasks**: Includes information about scheduled backgrounder tasks like extract refreshes, subscriptions, and flows. - **Data Queries**: Information about all queries executed by Tableau Server. - **Gateway Requests**: HTTP requests handled by Tableau Server including VizQL Server session details. - **Incidents**: Incidents recorded by the Resource Monitoring Tool . - **Server Performance**: Tableau Server hardware and process information that is gathered by the Resource Monitoring Tool. - **Tableau Entities**: Information about the Tableau Server sites, projects, workbooks, and views gathered by the Resource Monitoring Tool. ## Requirements - Encryption used is SCRAM-SHA-256 which is supported by Tableau Desktop 2020.4 and later. ## Enable access to the Resource Monitoring Tool PostgreSQL database The Tableau data source (.tds) file contains a connection to the Resource Monitoring Tool PostgreSQL database. Before you can connect to a downloaded .tds file, you need to enable access for the `readonly` user to the Resource Monitoring Tool PostgreSQL database. Once the `readonly` user has access, you can then use the `readonly` username and password to connect to the Resource Monitoring Tool PostgresSQL database from the .tds file in Tableau Desktop. ### Resource Monitoring Tool versions 2022.3 and later: #### Resource Monitoring Tool with local repository: 1. On the RMT Server machine, enable access to the Resource Monitoring Tool PosgreSQL database for the `readonly` user: `rmtadmin data-access ReadOnly` 2. Restart the Resource Monitoring Tool PostgreSQL database for the configuration change to take effect: `rmtadmin restart --db` 3. Retrieve the password for the `readonly` user: `rmtadmin get db.readOnlyPassword` #### Resource Monitoring Tool with external repository: You must configure the RDS instance to allow access from Tableau Desktop. Retrieve the username and password for the Resource Monitoring Tool PostgreSQL database and use it to download .tds files. For more information see the [documentation on AWS site](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ConnectToPostgreSQLInstance.html). ### Resource Monitoring Tool versions 2022.2 and earlier: 1. Open the `postgresql.conf` file. By default, the file is located at: `/var/opt/tableau/tabrmt/data/postgresql` 2. Update `Listen_addresses = 'localhost'` to `Listen_addresses = '*'`. **Note:** You must remove the '`#`' from this line. 3. Open the `pg_hba.conf` file. This file is also located in the same directory as the `postresql.conf` file. By default the file is located at: `/var/opt/tableau/tabrmt/data/postgresql` 4. Add the following to the end of the `pg_hba.conf` file and then save the file: `host all all 0.0.0.0/0 scram-sha-256` `host all all ::/0 scram-sha-256` 5. Restart the Resource Monitoring Tool PostgreSQL database for the configuration changes to take effect: `rmtadmin restart --db` 6. Retrieve the password for the `readonly` user: `rmtadmin get db.readOnlyPassword` ## Connect to the RMT .tds files from Tableau Desktop After access to the Resource Monitoring Tool PostgreSQL database has been enabled for the `readonly` user, you can then connect to the downloaded .tds files from Tableau Desktop. 1. In Tableau Desktop, go to **File > Open** and select the .tds file downloaded from the Resource Monitoring Tool web interface. **Note**: You might need to install the PostgreSQL database drivers. You can download drivers from [www.tableau.com/support/drivers](http://www.tableau.com/support/drivers). If Tableau Desktop does not automatically connect to the Resource Monitoring Tool Postgres database after opening the .tds file, you might need to manually enter the `readonly` username and password into the edit connection window in Tableau Desktop. ## Who can do this Resource Monitoring Tool Administrator or a Resource Monitoring Tool user with **Download TDS Files** server role. [Skip to main content](#main-content) # Export or Import a Site **Note:** For detailed information about migrating sites from Tableau Server to Tableau Cloud, see our [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm). You can provision a new Tableau Server site by importing (migrating) information from another site. You do this by exporting the existing site’s (the _source_ site) information to a file. Then you complete steps to verify and import that information to the _target_ site. ## Site Migration Options You can migrate a site in any of these ways: - To another site on the same Tableau Server instance. - To a site on a separate Tableau Server instance. - From Tableau Server on Windows to Tableau Server on Linux or vice-versa. **Note:** When migrating sites between instances of Tableau Server, the target site must be on a version of Tableau Server that is the equal to or later than the version of Tableau Server for the source site. Both the source and target sites must be from supported versions of Tableau Server. ## Site Migration Limitations ### What information is preserved in a site export - The export file you create preserves workbooks, projects, data sources, and users. This includes permissions set on content, user favorites lists, and site quotas. - Users’ custom views are preserved; however, depending on the type of site migration, custom view URLs might change in a way that breaks users’ bookmarks to their views. - When you export a site on Tableau Server to import to another Tableau Server site, subscription and extract refreshes schedules are preserved. ### What information isn't preserved in a site export - Usage data, which appears in the site’s administrative views, is not preserved. For example, view and data source counts, user actions, and performance data. - Backgrounder jobs that are in-progress while a site is being exported, will not be exported and will not show up on the new site once the import is complete. - OAuth access tokens embedded in data connections are reset. For those data sources, you will need to edit the connections and re-authenticate to the underlying data. - Prep flow schedules and tasks are not included. These will need to be manually migrated. - Content saved to users' Personal Space is not included. - Collections aren't included in site exports until Tableau Server 2025.3. - When migrating sites between different identity store types (Local to Active Directory/LDAP or Active Directory/LDAP to Local), user filters using Groups will break due to domain declaration differences. After the migration, you must manually recreate these user filters in any impacted workbooks and data sources on the destination site (specifically those using the `ISMEMBEROF()` function). ## Prepare the Source and Target Sites Before you export a site, complete the following checklist to prepare both environments. Some of these instructions depend on whether both sites are on the same server instance or on separate ones. ### Delete stale content Make sure the source site contains only what you want to import to the new site. As a best practice, remove anything from your source site that you do not want to include in your new site, whether these things will be included in an export/import, or will need to be manually migrated. Delete unused workbooks, data sources, or projects. If you have Prep flows or flow schedules you no longer use, delete these as well. ### Remove obsolete users Confirm that all server users are licensed, and remove accounts that are no longer in use. You can’t remove users during the import process, so if the two sites are on the same server instance, all users you export from the source site are imported to the target site. ### Create or identify the target site You must import a site file to a site that already exists on the target Tableau Server instance. Because the import process removes anything from the target site that is not included in the import file, we recommend that you import to an empty site. For more information, see [Add or Edit Sites](https://help.tableau.com/v0.0/server-linux/en-us/sites_add.htm). ### Locate site IDs The tsm command you use to export or import a site requires a parameter that takes the site ID. You can get the site ID from the URL when you are signed in to the site from a web browser. If only one site exists on the server, that site is named Default. When you are signed in to the Default site, the browser URL looks something like this: `https://server-name/#/projects` In the URL, the absence of the `/site` parameter indicates that it’s the Default site. The site ID for the Default site is "Default" without the quotation marks. On a multi-site Tableau Server deployment, the browser URL includes `#/site/` followed by the site ID. The following URL would appear if you navigate to the Views page on a site whose site ID is `finance`: `https://localhost/#/site/finance/views` ![A web browser window displaying a Tableau Server address.](/tableau/next/en-us/server-linux/en-us/Img/ms_URL.png) ### Check the identity store You can export from and import to sites that do not use the same user identity store type, but you will need to modify the mapping files used for the import. This step is built into the import process and described in [Step 3: Verify that site settings are mapped correctly](#verify-site-mappings). ### Create users on the target server if necessary The site import process assigns users to the target site. If the source site is on a Tableau Server instance other than the target site, you must create users on the target server before you can perform the import. If the two sites are on the same Tableau Server instance, the target site has access to the existing users, and you can skip this step. ### Configure the target server to deliver subscriptions Subscriptions are imported, but you must configure the server to deliver them. For more information, see [Set Up a Site for Subscriptions](https://help.tableau.com/v0.0/server-linux/en-us/subscribe.htm). ### Check schedules The Schedules page lists the existing schedules for extract refreshes and subscriptions. ![Subsciption and Extract Refresh schedule.](/tableau/next/en-us/server-linux/en-us/Img/sites_schedule.png) For migrations **from one Tableau Server site to another**, refreshes and subscriptions assigned to default schedules on the source site are mapped to the same schedules on the target site. If the source site has schedules that do not exist on the target site, and the target site is on another Tableau Server instance, you must create the schedules on the target site that you want the source schedules to map to. You can edit the mapping files to make sure this is done as you expect. ## Tips for importing to a target with fewer users or schedules When a target site has fewer users or schedules than the source site, many-to-one importing is not supported. How you can address this depends on whether the source and target sites are on the same Tableau Server instance. You can take any of the following approaches that apply to your site migration use case: - Remove extra users or schedules from the source site before you export. This is the preferred option if the two sites are on the same server instance. - Add missing users or schedules to the target site before beginning the import. This is required if the target site is on another server instance. - Add the missing users or schedules to the target site in the middle of the import process and manually update the mapping files. This is an option only if the sites are on the same instance. - Manually map the users or schedules to different users and schedules in the target site during the import process. This is required if a user name differs between servers—for example, the exported user named _adavis@company.com_ is defined on the target site as _davisa_. ## Migrating a Site You must use the `tsm sites` commands to complete the site migration process. The steps below walk you through exporting information from the source site, mapping site settings, and importing the mapped files to the target site. ### Step 1: Export a site On the source Tableau Server machine, type the following command: `tsm sites export --site-id --file ` Tableau Server must be running when you use the `export` command. During the export process, Tableau Server locks the site you are exporting. For example, to export a site with site ID **weather-data** to the file **export-file.zip**, type the following: `tsm sites export --site-id weather-data --file export-file` By default, Tableau Server saves `.zip` to `/var/opt/tableau/tableau_server/data/tabsvc/files/siteexports`. For more information, see [tsm File Paths](https://help.tableau.com/v0.0/server-linux/en-us/cli_default_filepaths_tsm.htm#import-file-location). ### Step 2: Generate the import mapping files To generate import files for the target site, you need the .zip file you created when you completed the steps in [Step 1: Export a site](#export-site-steps). **Note:** The exported file does not give "Others" read permission by default. Depending on who is importing the file, you may need to adjust the permissions on the file to allow a non-owner to read it. 1. On the target Tableau Server machine, copy the exported .zip file to the directory Tableau Server expects to find the files for importing. For example: `/var/opt/tableau/tableau_server/data/tabsvc/files/siteimports` 2. Verify that the target site already exists on Tableau Server, as the import process will not create a new site. For more information, see [Prepare the Source and Target Sites](#before-you-export). 3. Run the following command on the target Tableau Server machine (Tableau Server must be running): `tsm sites import --site-id --file ` This command generates a set of .csv files that show how source site settings will map to the target site. In the steps described in the next section of this article, you confirm these mappings and adjust them where needed. By default, these .csv files are generated to a `mappings` directory created under `siteimports`. For example: `/var/opt/tableau/tableau_server/data/tabsvc/files/siteimports/working/import__/mappings` For more information, see [tsm File Paths](https://help.tableau.com/v0.0/server-linux/en-us/cli_default_filepaths_tsm.htm#import-file-location). ### Step 3: Verify that site settings are mapped correctly The .csv files you generated in the previous section describe how the source site’s resources will be assigned to the target site when the import is complete. Items in the files that Tableau Server was unable to map, and that you need to edit, are indicated by a series of question marks (`???`). Before you can complete the import process, you must replace the question marks with valid assignments on the target site. **Important:** Some requirements apply to mapping users, schedules, and published content resources, particularly when the source and target sites are on separate Tableau Server instances. For more information, see [Prepare the Source and Target Sites](#before-you-export) earlier in this article. #### To verify mapping files 1. Navigate to the directory that contains the .csv map files generated by the `tsm sites import` command. By default: `/var/opt/tableau/tableau_server/data/tabsvc/files/siteimports/working/import__/mappings` 2. Use your preferred text editor to open one of the .csv files in the `mappings` directory, and do the following. 1. Confirm that the mappings are correct. 2. If an entry shows a series of question marks (`???`), replace them with a valid value. For descriptions of the settings in each of these files, use the tables in [Mapping File Content Reference](#map-file-reference) later in this article. 3. Save the changes and preserve the CSV file formatting. Repeat this process for the remaining .csv files. ### Step 4: Import the correctly mapped files to the target site After you verify the site mappings in the .csv files, you can import the settings to the new site to complete the migration process. 1. Run the following command on the target Tableau Server machine: `tsm sites import-verified --import-job-dir --site-id ` For example: `tsm sites import-verified --import-job-dir /var/opt/tableau/tableau_server/data/tabsvc/files/siteimports/working/import_ff00_20180102022014457 --site-id new-site` 2. When the success message appears, sign in to the new site and confirm that everything was imported as you expected. **Note**: The `tsm sites import` and `tsm sites export` commands can leave a site in a locked state if an error occurs. To unlock a site, use the `tsm sites unlock` command. ## Mapping File Content Reference The following tables list the columns in each of the mapping files created when you run the `tsm site import` command. ### CSV file name: mappingsDomainMapperForGroups

Column title

Can it be edited?

Description

source_name

A user group name on the source site.

source_domain_name

The identity store type on the source site: either local (for local identity store) or a domain name (for Active Directory or LDAP external identity store).

target_domain_name

Yes*

The identity store type on the target site: either local for local identity store, or a domain name (such as example.com or example.lan) for Active Directory or LDAP external identity store.

*For the All Users group, keep the target_domain_name value set to local, even if your target server is configured for Active Directory identity store. The All Users group is a special default user group that must exist on every Tableau Server.

### CSV file name: mappingsScheduleMapper

Column title	Can it be edited?	Description
source_name	No	The names of custom and default extract or subscription schedules on the source site.
source_scheduled_action_type	No	The type of schedule, either Refresh Extract, for extract refreshes, or Subscriptions, for subscription deliveries on the source site.
target_name	Yes	The names of custom schedules on the target site. You can edit this value. For example, if the schedule is named Friday Update on the source site you can rename it Friday Refresh on the target site.
target_scheduled_action_type	No*	The type of schedule, either Refresh Extract, for extract refreshes, or Subscriptions, for subscription deliveries on the target site. In the rare case that you see question marks (`???`) in this column, replace them with either Refresh Extract* or Subscriptions, to match the entry you see under source_scheduled_action_type.

### CSV file name: mappingsSiteMapper

Column title	Can it be edited?	Description
source_url_namespace	No	The site ID of the source site.
target_url_namespace	No	The site ID of the target site.

### CSV file name: mappingsSystemUserNameMapper

Column title	Can it be edited?	Description
source_name	No	The user name attribute of a user on the source site.
source_domain_name	No	The identity store type on the source site: either local (for local identity store) or a domain name (for Active Directory or LDAP identity store), or external.
target_name	Yes	The user name attribute for users who will be assigned to the target site upon import. Confirm that all the user names in the list exist on the target server, and replace question marks (`???`) with user names that exist on the target server. You cannot create user names by adding rows to the CSV file. Similarly, you cannot remove user names by deleting rows. You can edit a user name in the target_name column to be different from its source user name, as long as the user already exists on the target server with that name. For example, a user can have a source_name value of agarcia@company.com and a target_name value of ashleygarcia@company.com. You can map a user on the source site to only one user name on the target site.
target_domain_name	Yes	The identity store type on the target site: either local (for local identity store) or a domain name (for Active Directory or LDAP external identity store).

### CSV file name: MappingsScheduleRecurrenceMapperWithAutoCreation This file does not require updates. [Skip to main content](#main-content) # Extension Security - Best Practices for Deployment These best practices are for IT officers and administrators, Tableau server and site administrators, and anyone who's interested in adopting the use of dashboard and viz extensions with Tableau. Extensions provide vast opportunities to extend and customize the use of Tableau to fit the analytic needs of each customer. This extensibility should always include the appropriate considerations toward the security of their data and business. The best practices are intended for deployments that have a mix of users who are on Tableau Desktop and Tableau Server or Tableau Cloud. ## Security for extensions in Tableau Extensions are web applications that extend the functionality of the dashboard or add new visualizations to Tableau. These solutions can be handled directly by Tableau or served completely as third-party custom services. These services can be hosted either within your own network, or provided by an external provider outside your network. Extensions interact with other components in the workbook and create an integrated experience for the end user using Tableau analytics content. To provide this integrated experience, Extensions access the visible summary data used in the workbook. Under specific configuration, they can also access the underlying data in the workbook if needed. This access and interaction level is enabled by the Tableau Extension API, which is designed and supported as a part of the Tableau platform. Tableau supports two standards for extensions: - [Tableau Trusted Extensions](#Tableau) - [Network-enabled extensions](#Network-) ### Tableau Trusted Extensions To support the broad use of extensions across its community, Tableau manages services to help serve extensions for use at scale. These extensions can be built and maintained by Tableau directly as platform features, or by Salesforce or Tableau partner developers that work closely with Tableau’s product teams to jointly deploy solutions for broad community use through Tableau Exchange. Tableau Trusted Extensions are always hosted on Tableau infrastructure, managed and governed by the Tableau product and development team. Tableau tests and reviews each extension before it’s deployed or updated. Tableau has strict requirements to only permit communication between user clients and the access-controlled Tableau extension hosts. With this design, Tableau can provide standards on common extensions needs that can be useful for its community. To meet this standard, Tableau employs different solutions: - [Sandboxed extensions](#Sandboxe) - [Tableau-built extensions](#Tableau-) - [Tableau Trusted partner-built extensions (Opt In)](#Trusted) ![A diagram listing the types of Tableau Trusted extensions.](/tableau/next/en-us/server-linux/en-us/Img/tableau_trusted_extensions.png) #### Sandboxed extensions Tableau hosts Sandboxed extensions, which run in a protected environment specifically configured to eliminate the risk of data exfiltration. The Tableau Sandboxed extensions host is blocked from any other resource or service on the web. A Sandboxed extension can query data in the workbook using the Extensions API, but it can't send that data anywhere outside the sandbox. The results of the query are on the client computer (in the browser) and can't be sent anywhere. Restricted access ensures that only Tableau employees manage all updates to Sandboxed extensions and are the only ones to access this extension host. Sandboxed extensions are enabled for use by default and enabled for Tableau Public use. #### Tableau-built extensions Tableau-built extensions are hosted by Tableau. Specifically, these extensions are built and maintained by the Tableau development team as platform features. Like other features built by Tableau, Tableau-built extensions undergo Salesforce SDLC standards. These extensions are designed to pass JavaScript to the client computer. This allows the extension to be rendered and processed by the client. These features are supported directly by the Tableau team and deployed through the same Tableau Trusted host infrastructure. Tableau-built extensions are enabled for use by default and enabled for Tableau Public use. #### Tableau Trusted partner-built extensions (Opt In) Tableau Trusted partner-built extensions are developed by third-party partner developers, but reviewed and hosted by Tableau. By managing deployment for partner developers (many of whom are also longstanding community leaders), these new solutions can be delivered jointly between Tableau and the third-party Tableau Exchange Partner. Tableau tests each third-party solution (and each update) before they are deployed for production use. This includes functional and network communication testing, as well as automated code scans for vulnerabilities to address. Like other Tableau Trusted extensions, these extensions only allow communication between the user client and the Tableau host. Direct access to the host is controlled and limited only to Tableau employees. While Tableau can't directly make changes or apply fixes to these third-party solutions, the service uptime and availability is governed by Tableau. Tableau Trusted partner-built extensions require administrators to enable them for use, but are generally recommended and have been enabled for Tableau Public use. ### Network-enabled extensions Network-enabled extensions are extensions not managed by Tableau. They can be hosted on web servers that are located inside or outside your local network and have full access to the web. This allows network-enabled extensions to address more specific integration needs or custom deployment goals outside of Tableau’s standards. Network-enabled extensions can connect with other applications and services to offer new integrated capabilities to Tableau. This includes non-Tableau natural language generation or support for write-back scenarios. Network-enabled extensions have full access to the web, which means that they can offer rich features and experiences by being able to connect to outside resources. However, as they might communicate with additional services and aren't managed by Tableau, we encourage you to evaluate Network-enabled extensions before deploying or adopting at scale. #### Locally deployed Network-enabled extensions Extensions can support deployment flexibility, such as running extensions locally within a local network. This is particularly useful for deployments that have air-gapped network requirements, or for organizations that prefer to manage their own extensions. For example, internal developers can build custom extensions that meet specific deployment needs. Network-enabled extensions support the goal of self-deployment. Because these local extensions run on ‌non-Tableau hosts and undergo their own custom release definitions, we encourage you to work with your developers to plan appropriately on how this internal extension resource and relevant process is managed for users in your deployment. By design, network-enabled extension architecture allows full access to the web; so it's incumbent on customers to develop their own review process to ensure that extensions specifically only communicate with allowed web resources and have appropriate cybersecurity safeguards to protect against risk. Local Network-enabled extensions are required to be added to the deployment extension safe list by Tableau administrators before they are allowed for use. These local solutions aren't used in Tableau Public. #### Third-party provider-managed Network-enabled extensions Network-enabled extension architecture also allows extensions to be served by a trusted third-party provider, such as directly by a Tableau partner that you’ve established a formal vendor relationship with. In these situations, a network-enabled extension, not managed by Tableau, lets providers offer direct production support or custom services. When handled in a trusted manner, this can streamline and expand on the customization for Tableau supported by a reputable provider. We recommend customers work with third-party providers directly for a more thorough understanding of how a provider’s development practices, extension code design, and security meets their internal guidelines. These Network-enabled extensions are required to be added to the deployment extension safe list by Tableau administrators before they are allowed for use. On rare occasions, these solutions are enabled to be used in Tableau Public as unique exceptions for community goals. ### Risk considerations with Network-enabled extensions Because extensions are web applications there's the potential that a Network-enabled extension could be vulnerable to certain types of malicious attacks, which in turn could present a risk to your computer or data. The [Open Web Application Security Project](https://www.owasp.org/) (OWASP) annually identifies the most critical web application security risks. These risks include the following: - SQL injection - Cross-site scripting (XSS) - Sensitive data exposure These risks could compromise the extension if the developers of the extension don't properly validate and handle user inputs, or if they generate dynamic queries to access sensitive databases. As you evaluate the extensions that you want to allow in Tableau, be sure to consider how they manage authentication, data access, or user input, and how they mitigate security risks. ### Mitigating security threats with Network-enabled extensions Understanding what an extension does is a first step to identifying the risks for your enterprise. Often, a dashboard or viz extension doesn’t access the underlying data in the workbook and all the JavaScript code runs in the context of the browser running on the user’s computer. In these cases, no data leaves the computer, even though the extension might be hosted on a third-party site outside of your domain. Some extensions allow you to connect Tableau with other applications you have already deployed in your domain. Tableau provides security measures and security requirements for extensions. These requirements are enabled for Tableau Desktop, Tableau Server, and Tableau Cloud. - All extensions must use the HTTP Secure (HTTPS) protocol. - By default, anyone using a dashboard with a Network-enabled extension will be prompted and asked to allow the extension permission to run. The extension must request permission if it accesses the underlying data. - To run on Tableau Server or Tableau Cloud, the URL of the Network-enabled extension must be added to a safe list. The server administrator manages this list for Tableau Server; the site administrator manages this list for Tableau Cloud. - On Tableau Server and Tableau Cloud, the server or site administrator (respectively) can control whether the prompt appears for each Network-enabled extension. For more information, see [Manage Dashboard and Viz Extensions in Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/dashboard_extensions_server.htm). ## Manage extensions using Tableau Extensions provide a way to add unique features to dashboards and new visualizations to worksheets. You can use extensions to directly integrate the dashboard with applications outside of Tableau. While extensions open up a world of possibilities, there are instances where you need or want to maintain control of how extensions are deployed in your company or enterprise. In this respect, extensions are no different from any other software that you intend to use. Before you deploy software applications in your company you should thoroughly test and verify that the software works as expected and is secure. The same is true for extensions. First, determine what level of access your users should have, and identify the extensions you want to use (or conversely, the extensions you don’t want to use). Then use the controls and features within Tableau to restrict and curate the dashboard and viz extensions users have access to. - Do you need to restrict who can add or use extensions in Tableau Desktop? See [Recommendations for Tableau Desktop](#Recommen) - Do you need to restrict or control the extensions your users have access to? See [Recommendations for Tableau Server and Tableau Cloud](#Recommen2). ## Recommendations for Tableau Desktop You have a range of options for deploying Tableau Desktop in your company. You can allow unrestricted access to extensions, or you can put limits and restrictions on who has access to extensions and under what circumstances. By default, Tableau Desktop users have unrestricted access to Tableau Trusted extensions and Network-enabled extensions. Tableau provides five options that can be used in any permutation during installation to change the default settings. - Turn off all extensions (`DISABLEEXTENSIONS`) - Turn off Network-enabled extensions (`DISABLENETWORKEXTENSIONS`). - Turn off Sandboxed extensions (`DISABLESANDBOXEXTENSIONS`). - Turn off Tableau built extensions (`DISABLETABTRUSTEDEXTENSIONS`). - Turn off Tableau Trusted Partner-built extensions (`DISABLE3PTRUSTEDEXTENSIONS`). **Note:** You can change these settings after Tableau Desktop installation by editing the Registry (Windows) or running a script (Mac) on each desktop. See [Turn off dashboard extensions](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_setting_changes.htm#dashboard_extensions). ### Example deployment scenarios Using the installation settings, you can deploy Tableau Desktop in several ways. - **Allow all extensions** - In this deployment scenario, you choose to trust Tableau authors to select the Tableau Trusted extensions and Network-enabled extensions they want to use. If you want to empower your Tableau Desktop users with the greatest flexibility, use the default installation settings. Using the default settings, Tableau Desktop users have unrestricted access to Tableau Trusted and Network-enabled extensions. The default settings are: `DISABLEEXTENSIONS=0` and `DISABLENETWORKEXTENSIONS=0`. See [Install Tableau Desktop from the Command Line](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_automate.htm). **Only allow Tableau Trusted extensions** - In this scenario, you entrust Tableau extension services to appropriately review, deploy and curate extensions that are for broad community use, but you aren't sure about Network-enabled extensions and want to prevent their use at this time. To turn off support for Network-enabled extensions, set the `DISABLENETWORKEXTENSIONS` property (`DISABLENETWORKEXTENSIONS=1`). Keep the default setting for enabling extensions (`DISABLEEXTENSIONS=0`). See [Install Tableau Desktop from the Command Line](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_automate.htm). - **Only allow Sandboxed extensions** - In this scenario, you might have used Sandboxed extensions before and feel they are safe to use, but you aren't ready to update your policy to enable broader use for Tableau-built and Tableau trusted partner-built extensions; nor do you want to change policy to allow Network-enabled extensions. You only want to permit Sandboxed extensions to be used as they have been, and want to prevent the use of all other forms of Tableau Trusted and network-enabled extensions. To turn off support for Network-enabled extensions, Tableau-built extensions and Tableau Trusted partner-built extensions: set the `DISABLENETWORKEXTENSIONS` property (`DISABLENETWORKEXTENSIONS=1`), `DISABLETABTRUSTEDEXTENSIONS` property (`DISABLETABTRUSTEDEXTENSIONS=1`), `DISABLE3PTRUSTEDEXTENSIONS` property (`DISABLE3PTRUSTEDEXTENSIONS=1`). Keep the default setting for enabling extensions (`DISABLEEXTENSIONS=0`). See [Install Tableau Desktop from the Command Line](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_automate.htm). - **No extensions allowed** - In this scenario, you don't want to allow users to use extensions of any type. In this case, turn support for all extensions off by using the `DISABLEEXTENSIONS` property (`DISABLEEXTENSIONS=1`). See [Install Tableau Desktop from the Command Line](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_automate.htm) . **Use a combination of settings** You might have some users who need and should have unrestricted access to all extensions, and others for whom access to Sandboxed extensions is sufficient, and then finally a set of users who need no access to extensions at all. Because the extension options are set per desktop, you can configure your deployment for specific users and their use cases. **Web authoring** \- If Tableau Server or Tableau Cloud are available for your users, they can use web authoring to access extensions. In web authoring, the server or site settings for extensions apply. In this scenario, the server and site administrators can determine which extensions to allow users access to. This is managed based on server and site extension settings, which include Tableau Trusted extension options and the extension safe list for explicit Network-enabled extensions. ![A diagram that illustrates the distinction between unrestricted and restricted access to Tableau extensions.](/tableau/next/en-us/server-linux/en-us/Img/ext_desktop_deploy3.png) ## Recommendations for Tableau Server and Tableau Cloud If your users have access to Tableau Server or Tableau Cloud, you can use the built-in security controls to put limits and restrictions on the extensions that can be used and under what circumstances. If you've turned off extensions on Tableau Desktop, you can still allow users to add extensions in web authoring, but you can limit the number of extensions that can be used to just ones you approve to run. ![A diagram illustrates how Tableau Server and Tableau Cloud settings manage extension access.](/tableau/next/en-us/server-linux/en-us/Img/ext_server_deploy3.png) ### Allow Tableau Trusted extensions and the Network-enabled extensions on the safe list Starting with Tableau 2025.3, Tableau allows some Tableau Trusted extensions to run by default. This means that Sandboxed extensions and Tableau-built extensions are elevated for use, whereas Tableau Trusted Partner-built extensions can be enabled by the administrators. While we encourage use of all Tableau Trusted extensions, as we do with our environments like Tableau Public, we ultimately feel it is critical for administrators to define the policy relevant for their deployments. Network-enabled extensions aren't allowed unless they've been added to the safe list. Administrators can edit the settings and add Network-enabled extensions to the safe list for the site (Settings \> Extensions \> Enable specific Extensions). **Note** To make the safe list the default behavior for extensions in Tableau 2018.2 and Tableau 2018.3, you must change the settings for the site. On the Extensions settings page, under Default behavior for Extensions, clear the Enable unknown extensions... option. In Tableau Server 2019.1, Tableau 2019.2, and Tableau 2019.3, by default, no extensions are allowed to run unless they've been added to the safe list. #### Checklist for the safe list: - Does the extension come from a source that you know and trust? - Check the URL of the extension. Does the URL look suspicious or contain dubious domain names? - Does the extension require access to full (underlying data) or summary data? See [Understand data access](https://help.tableau.com/v0.0/server-linux/en-us/dashboard_extensions_server.htm#Understa). - Test the extensions before allowing broad use. See Test extensions for security. See [Test Network-enabled extensions for security](https://help.tableau.com/v0.0/server-linux/en-us/dashboard_extensions_server.htm#Test). #### Add extensions to the safe list: - See [Add extensions to the safe list and configure the extension](https://help.tableau.com/v0.0/server-linux/en-us/dashboard_extensions_server.htm#Add). ### Block specific extensions from running on Tableau Server On Tableau Server, you can block specific extensions by adding their URL to the block list. This is useful if you have multiple sites that are configured differently for extensions. For example, if you have a test site where you want to be able to test internal or third-party extensions, you might have enabled the default behavior for extensions, where unlisted extensions are allowed to run provided they do not access the underlying data in the workbook. Adding an extension to the block list prevents it from inadvertently being used on the test site. - Add the URL of the extensions that you don't want to allow to the blocked list. This option is only available on Tableau Server. See [Block specific extensions](https://help.tableau.com/v0.0/server-linux/en-us/dashboard_extensions_server.htm#Block). ### Turn off extensions for a site By default, extensions are enabled on Tableau Server and Tableau Cloud. On Tableau Server, the server administrator can turn off extensions for a site. On Tableau Cloud, the site administrator can turn off extensions for the site. On Tableau Server, the server administrator can turn off extensions completely, which overrides the site settings. You should not have to change this setting on the server or for the site, as you can control the Network-enabled extensions that you want to allow on the safe list. You can also control the settings for Tableau Trusted extensions, where Sandboxed extensions and Tableau-built extensions are allowed by default. - To disable extensions on a site (Tableau Server, Tableau Cloud), change the site settings that enables users to run extensions on the site. See [Control extensions use](https://help.tableau.com/v0.0/server-linux/en-us/dashboard_extensions_server.htm#Control). ### Show or hide user prompts to run Network-enabled extensions When you add a Network-enabled extension to the safe list, you can configure whether users see prompts by default when they are adding the extension to a dashboard, or when they are interacting with a view that has the extension. The prompt tells users details about the Network-enabled extension and whether the extension has access to full data. The prompt gives users the ability to allow or deny the extension from running. You can hide this prompt from users, allowing the extension to run immediately. When enabled for a site, Sandboxed extensions are allowed by default and do not prompt users. ### Turn off all or some Tableau Trusted extensions Starting in Tableau 2025.3, Tableau allows some Tableau Trusted extensions to run on Tableau Server and Tableau Cloud by default. Sandboxed extensions and Tableau-built extensions are elevated for use, whereas Tableau Trusted Partner-built extensions can be enabled by the administrators. Sandboxed extensions run in a protected environment and are hosted by Tableau. Tableau-built extensions are developed and maintained by Tableau and hosted by Tableau. Tableau Trusted Partner-built extensions are developed and maintained by third-party partner developers, but have their solutions and updates reviewed and hosted by Tableau for availability and scale. Administrators can control whether to let users run all, some, or none of the Tableau Trusted extensions on a site. Trusted extensions don't need to be added to the safe list. When Tableau Trusted extensions are allowed, users are able to freely add Tableau Trusted extensions to workbooks and are able to open and use workbooks that contain Tableau Trusted extensions. If you need to block a Tableau Trusted extension, please reach out to Tableau to inquire about the specific extension URL to add to the Server block list. Server administrators can add any extension to their deployment global block list. If you need to turn off Tableau Trusted extensions completely, you can change the default setting for the site. If you change the default setting for Tableau Trusted extensions, only the extensions that are on the safe list are allowed to run. [Skip to main content](#main-content) # External Identity Store Configuration Reference Tableau Server supports connecting to an external directory using LDAP. In this scenario, Tableau Server imports users from the external LDAP directory into the Tableau Server repository as system users. This topic provides a description of all LDAP-related configuration options Tableau Server supports. If you are connecting to Active Directory, we strongly recommend that you automatically configure the LDAP connection with Tableau Server as part of Setup, rather than configuring the connection manually. See [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm). The options listed in this reference can be used for any LDAP-compliant directory. If you do not have experience configuring LDAP, then work with your directory administrator, or with an LDAP expert. This is a reference topic. For more information about how Tableau Server stores and manages users, start with [Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm). ## Configuration methods Configuration parameters that enable Tableau Server to connect to your LDAP directory are stored in .yml files. These files are managed and synchronized by various services in Tableau Server. Updating the .yml files must be done using a Tableau Services Manager (TSM) interface. Do not attempt to update .yml files directly with a text editor. TSM must manage all updates for proper operation. The .yml configuration files are composed of key-value pairs. For example, the key, `wgserver.domain.username`, takes a username as a value. This key defines the username that will be used to authenticate to the LDAP directory during the bind operation. There are four different TSM methods that can set yml key values. The four methods are described here, using the `wgserver.domain.username` key as an example to illustrate the different methods: - configKey key-value pairs—You can update a .yml configuration file key by updating the `wgserver.domain.username` key running [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm), or by including the key in a JSON configuration file under a configKey entity. See [Configuration File Example](https://help.tableau.com/v0.0/server-linux/en-us/config_file_example.htm). The configKey key-value pairs in a JSON configuration file are the same as those used for `tsm configuration set` but they are set differently. This topic refers to both of these methods as _configKey_. Unlike when using configEntities and native tsm commands that are described below, configKey input is not validated. When you set an option with a configKey, the value that you enter is copied as a literal string to the underlying .yml configuration files. For example, for a key where `true` or `false` are the valid inputs, when you configure the key using a configKey key-value pair, you can enter an arbitrary string value and it will be saved for the key. In such cases, invalid values will undoubtedly lead to LDAP configuration errors. We recommend using configKeys only when no option exists to set the configuration with the other three options listed below (configEntities, a native tsm command, or the TSM Web UI). When using configKeys be sure to double-check your values and be sure to mind case-sensitivity. - configEntities JSON—You can update a .yml configuration file by passing the `username` option in a _configEntities_ JSON. When you configure a value using configEntities options in a JSON file, the values are validated before they are saved. Values are case-sensitive. For details on how to configure a value using configEntities, see the [identityStore Entity](https://help.tableau.com/v0.0/server-linux/en-us/entity_identity_store.htm) example. The JSON file is imported with the [tsm settings import](https://help.tableau.com/v0.0/server-linux/en-us/cli_settings_tsm.htm#TSMSet) command. The options available for configEntities are a subset of all the .yml key-value pairs. Validation means that the import command will only succeed if all the values in the JSON file are valid data types. For example, if you enter `no` for a value that only accepts `true` or `false`, then you will receive an error and the configuration is not imported. You can only import JSON configuration files only as part of the initial configuration. If you need to make LDAP changes after you have imported the JSON configuration file and initialized Tableau Server, do not attempt to re-import the JSON file. Instead, make individual key changes with native tsm commands if available, or using configKeys and `tsm configuration set`. - Native tsm commands—You can update a .yml configuration file by passing the `ldapuser` option with the _native tsm command_ `[tsm user-identity-store](https://help.tableau.com/v0.0/server-linux/en-us/cli_user-identity_tsm.htm)`. As with configEntities, values that you enter with the native tsm command are validated before they are saved. Not all key-value pairs in a .yml file can be set using native tsm commands. - TSM GUI—You can set configuration values during Setup, using the TSM GUI. If you are connecting to Active Directory, and configure the Tableau identity store during Setup, with the GUI, then you are prompted for an account with AD read access. The `wgserver.domain.username` key is set when you enter credentials. This scenario only works if you are connecting to Active Directory. Tableau Server does not support arbitrary LDAP configuration as part of the GUI Setup process. Consider using the [Tableau Identity Store Configuration Tool](https://tagyoureit.github.io/tableau-identitystore-config-tool/) to generate your LDAP json configuration file. The Tableau Identity Store Configuration Tool will also generate a list of key/value pairs that you can set by running [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm). The tool itself is not supported by Tableau. However, using a JSON file created by the tool instead of creating a file manually does not change the supported status of your server. ## Configuring Active Directory If you are configuring Tableau Server to use Active Directory, we recommend using the TSM Web UI during installation. The TSM Web UI is optimized to configure Tableau Server for Active Directory with the minimum necessary input. See [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm). ## Configuration reference table

configEntities option (Options are case sensitive)	Native tsm command	configKey (Used with tsm configuration set command or in the configKeys section of a JSON file)	Scenario	Notes
type	N/A	wgserver.authenticate	AD, LDAP, Local	Where you want to store user identity information. Values: `local` or `activedirectory`. If you want to connect to any LDAP server, enter `activedirectory`.
sslPort	N/A	wgserver.domain.ssl_port	AD, LDAP	Use this option to specify the secure port of the LDAP server. We recommend secure LDAP for simple bind. LDAPS is usually port 636.
N/A	N/A	wgserver.domain.ldap.starttls.enabled	AD, LDAP	Values: `true` or `false`. Beginning with version 2021.2, this key is set to `true` by default when Tableau Server is configured to connect to Active Directory. As a result, simple bind to LDAP directory is encrypted when a valid SSL/TLS certificate is present in the Tableau key store. For more information, see Configure Encrypted Channel to LDAP External Identity Store. This key is set to `false` by default when Tableau Server is configured to connect to a an arbitrary (but not Active Directory) LDAP server. This key was introduced (but not set) in version 2021.1.
port	N/A	wgserver.domain.port	AD, LDAP	Use this option to specify the non-secure port of the LDAP server. Plaintext is usually 389.
domain	domain	wgserver.domain.default	AD	In Active Directory environments, specify the domain where Tableau Server is installed, for example, "example.lan". For non-AD LDAP: the string you enter for this value is displayed in the "Domain" column of user management tools. You can enter an arbitrary string, but the key cannot be blank. This key is redundant with wgserver.domain.fqdn. The values for both keys must be the same. Native tsm command: Uses tsm user-identity-store set-connection [options] command.
username	ldapusername	wgserver.domain.username	AD, LDAP	The user name that you want to use to connect to the directory service. The account that you specify must have permission to query the directory service. For Active Directory, enter the username, for example, `jsmith`. For LDAP servers, enter the distinguished name (DN) of the user that you want to use to connect. For example, `"cn=jsmith,dc=example,dc=lan"`. Native tsm command: Uses tsm user-identity-store set-connection [options] command.
password	ldappassword	wgserver.domain.password	AD, LDAP	The password of the user account that you will use to connect to the LDAP server. Native tsm command: Uses tsm user-identity-store set-connection [options] command.
directoryServiceType	N/A	wgserver.domain.directoryservice.type	AD, LDAP	The type of LDAP directory service that you want to connect to. Values:`activedirectory` or `openldap`.
kerberosPrincipal	kerbprincipal	wgserver.domain.ldap.principal	AD, LDAP	The service principal name for Tableau Server on the host machine. The keytab must have permission for this principal. Do not use the existing system keytab at `/etc/krb5.keytab`. Rather, we recommend that you register a new service principal name. To see principals in a given keytab, run the `klist -k` command. See Understanding Keytab Requirements. Native tsm command: Uses tsm user-identity-store set-connection [options] command.
hostname	hostname	wgserver.domain.ldap.hostname	AD, LDAP	The hostname of the LDAP server. You can enter a hostname or an IP address for this value. The host that you specify here will be used for user/group queries on the primary domain. In the case where user/group queries are in other domains, Tableau Server will query DNS to identify the appropriate domain controller. Native tsm command: Uses tsm user-identity-store set-connection [options] command.
membersRetrievalPageSize	N/A	wgserver.domain.ldap.members.retrieval.page.size	AD, LDAP	This option determines the maximum number of results returned by an LDAP query. For example, consider a scenario where Tableau Server is importing an LDAP group that contains 50,000 users. Attempting to import such a large number of users in a single operation is not a best practice. When this option is set to 1500, Tableau Server imports the first 1500 users in the first response. After those users are processed, Tableau Server requests the next 1500 users from the LDAP server, and so forth. We recommend that you modify this option only to accommodate the requirements of your LDAP server.
N/A	N/A	wgserver.domain.ldap.connectionpool.enabled	AD, LDAP	When this options is set to `true`, Tableau Server will attempt to reuse the same connection when sending queries to the LDAP server. This behavior decreases the overhead of having to re-authenticate with the LDAP server on each new request. Connection pooling only works with simple bind and TSL/SSL bind connections. Connection pooling is not supported for GSSAPI bind connections.
N/A	N/A	wgserver.domain.accept_list	AD	Allows connection from Tableau Server to secondary Active Directory domains. A secondary domain is one that Tableau Server connects to for user synchronization, but is a domain where Tableau Server is not installed. To ensure that Tableau Server can connect to other Active Directory domains, you must specify the trusted domains by setting the `wgserver.domain.accept_list` option with TSM. For more information, see wgserver.domain.accept_list.
N/A	N/A	wgserver.domain.whitelist	AD	Important: Deprecated as of version 2020.4.0. Use wgserver.domain.accept_list instead. Allows connection from Tableau Server to secondary Active Directory domains. A secondary domain is one that Tableau Server connects to for user synchronization, but is a domain where Tableau Server is not installed. To ensure that Tableau Server can connect to other Active Directory domains, you must specify the trusted domains by setting the `wgserver.domain.whitelist` option with TSM. For more information, see wgserver.domain.whitelist .
kerberosConfig	kerbconfig	No direct mapping	AD, LDAP	The path to the Kerberos configuration file on the local computer. If you are installing into Active Directory, we don't recommend using the existing Kerberos configuration file or keytab file that may already be on the domain-joined computer. See Identity Store Native tsm command: Uses tsm user-identity-store set-connection [options] command.
kerberosKeytab	kerbkeytab	No direct mapping	AD, LDAP	The path to the Kerberos keytab file on the local computer. It is recommended that you create a keytab file with keys specifically for Tableau Server service and that you do not share the keytab file with other applications on the computer. For example, on Linux, you might place the keytab file in the `/var/opt/tableau/keytab` directory. Native tsm command: Uses tsm user-identity-store set-connection [options] command.
nickname	N/A	wgserver.domain.nickname	AD, LDAP	The nickname of the domain. This is also referred to as the NetBIOS name in Windows/Active Directory environments. The `nickname` option is required for all LDAP entities. The value cannot be null. If your organization does not require a nickname/NetBIOS, then pass a blank key, for example: `""`.
root	N/A	wgserver.domain.ldap.root	LDAP	If you do not use a dc component in the LDAP root or you want to specify a more complex root you need to set the LDAP root. Use the "o=my,u=root" format. For example, for the domain, `example.lan`, the root would be `"o=example,u=lan"`.
serverSideSorting	N/A	wgserver.domain.ldap.server_side_sorting	LDAP	Whether the LDAP server is configured for server-side sorting of query results. If your LDAP server supports server-side sorting, set this option to `true`. If you are unsure whether your LDAP server supports this, enter `false`, as misconfiguration may cause errors.
rangeRetrieval	N/A	wgserver.domain.ldap.range_retrieval	LDAP	Whether the LDAP server is configured to return a range of query results for a request. This means that groups with many users will be requested in small sets instead of all at once. LDAP servers that support range retrieval will perform better for large queries. If your LDAP server supports range retrieval, set this option to `true`. If you are unsure whether your LDAP server supports range retrieval, enter `false`, as misconfiguration may cause errors.
bind	N/A	wgserver.domain.ldap.bind	LDAP	The way that you want to secure communication to the directory service. Enter `simple` for LDAP unless you are connecting to an LDAP server with Kerberos. For Kerberos, enter `gssapi`.
N/A	N/A	wgserver.domain.ldap.domain_custom_ports	LDAP	Note: This key is only supported for Tableau Server on Linux. Allows you to map child domains and their LDAP ports. Domain and port are separated by a colon (:) and each domain:port pair is separated by a comma (,) using this format: `FQDN1:port,FQDN2:port` Example: `tsm configuration set -k wgserver.domain.ldap.domain_custom_ports -v childdomain1.lan:3269,childdomain2.lan:3269,childdomain3.lan:389`
distinguishedNameAttribute	N/A	wgserver.domain.ldap.dnAttribute	LDAP	The attribute that stores the distinguished names of users. This attribute is optional, but it greatly improves the performance of LDAP queries. Important: Do not set this option as part of the initial configuration. Only set this after you have validated overall LDAP functionality. You must have a dnAttribute set in your organization before setting this key.
groupBaseDn	N/A	wgserver.domain.ldap.group.baseDn	LDAP	Use this option to specify an alternative root for groups. For example, if all of your group are stored in the base organization called "groups," then enter `"o=groups"`.
N/A	classnames	wgserver.domain.ldap.group.classnames	LDAP	By Default, Tableau Server will look for "group", "groupOfNames", or "groupOfURLs". If your LDAP group objects do not fit the default class name, override the default by setting this value. You can provide multiple classnames separated by commas. If your group names include commas, you must escape them with a backslash (\). For example, if you have a group name, `groupOfNames, top`, then enter `"groupOfNames\, top"`. Tableau LDAP implementation interprets LDAP objects as either user or group. Therefore, be sure that you are entering the most specific class name. Overlapping class names between users and groups may cause conflicts. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command.
groupBaseFilter	basefilter	wgserver.domain.ldap.group.baseFilter	LDAP	The filter that you want to use for groups of users of Tableau Server. You might specify an object class attribute and an organization unit attribute. For example: `"(&(objectClass=groupofNames)(ou=Group))"` If `"(&(objectClass=inetOrgPerson)(ou=People))"` doesn't work in your LDAP implementation, then specify the base filter that works for your Tableau user base. This is a required key. It cannot be blank. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command.
groupName	groupname	wgserver.domain.ldap.group.name	LDAP	The attribute that corresponds to group names on your LDAP server. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command.
groupEmail	groupemail	wgserver.domain.ldap.group.email	LDAP	The attribute that corresponds to group email addresses on your LDAP server. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command.
groupDescription	description	wgserver.domain.ldap.group.description	LDAP	The attribute that corresponds to group descriptions on your LDAP server. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command.
member	member	wgserver.domain.ldap.group.member	LDAP	Specify the LDAP attribute that contains a list of distinguished names of users that are part of that group. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command.
N/A	N/A	wgserver.domain.ldap.group.memberURL	LDAP	Specify the name of the LDAP attribute that stores the LDAP query for dynamic groups.
userBaseDn	N/A	wgserver.domain.ldap.user.baseDn	LDAP	Use this option to specify an alternative root for users. For example, if all of your users are stored in the base organization called "users," then enter `"o=users"`.
N/A	classnames	wgserver.domain.ldap.user.classnames	LDAP	By default Tableau Server looks for LDAP user object classes containing the string “user” and “inetOrgPerson”. If your LDAP user objects do not use these default class names, override the default by setting this value. You can provide multiple classnames separated by commas. For example: `"userclass1, userclass2"`. If your names include commas, you must escape them with a backslash (\). For example, if you have a name, `Names, top`, then enter `"Names\, top"`. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
userBaseFilter	basefilter	wgserver.domain.ldap.user.baseFilter	LDAP	The filter that you want to use for users of Tableau Server. You might specify an object class attribute and an organization unit attribute. For example: `"(&(objectClass=inetOrgPerson)(ou=People))"` Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
userUsername	ldapusername	wgserver.domain.ldap.user.username	LDAP	The attribute that corresponds to user names on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
userDisplayName	displayname	wgserver.domain.ldap.user.displayname	LDAP	The attribute that corresponds to user display names on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
userEmail	email	wgserver.domain.ldap.user.email	LDAP	The attribute that corresponds to user email addresses on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
userCertificate	certificate	wgserver.domain.ldap.user.usercertificate	LDAP	The attribute that corresponds to user certificates on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
N/A	thumbnail	wgserver.domain.ldap.user.thumbnail	LDAP	The attribute that corresponds to user thumbnail images on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
userJpegPhoto	jpegphoto	wgserver.domain.ldap.user.jpegphoto	LDAP	The attribute that corresponds to user profile images on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
memberOf	memberof	wgserver.domain.ldap.user.memberof	LDAP	Group that the user is a member of. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command.
groupClassNames	N/A	wgserver.domain.ldap.group.classnames	LDAP	By Default, Tableau Server will look for "group", "groupOfNames", or "groupOfURLs". If your LDAP group objects do not fit the default class name, override the default by setting this value. For configEntity: This option takes a list of strings, which requires passing each class in quotes, separated by a comma (no space) and within brackets. For example: `["basegroup","othergroup"]`. For configKey: Enter each class, separated by a comma (no space) and within double quotes. For example: `"basegroup,othergroup”`.
userClassNames	N/A	wgserver.domain.ldap.user.classnames	LDAP	By default Tableau Server looks for LDAP user object classes containing the string “user” and “inetOrgPerson”. If your LDAP user objects do not use these default class names, override the default by setting this value. For configEntity: This option takes a list of strings, which requires passing each class in quotes, separated by a comma (no space) and within brackets. For example: `["userclass1",userclass2”]`. For configKey: Enter each class, separated by a comma (no space) and within double quotes. For example: `"userclass1,userclass2”`.

### Calculated configKeys The following Kerberos-related configKeys are calculated and set according to multiple environmental inputs. As such, they must be set by the native tsm command or configEntities. Do not attempt to set these configKeys manually.

Calculated configKey To use the native TSM command: To use configEntity json:

wgserver.domain.ldap.kerberos.conf,

cfs.ldap.kerberos.conf

Set the Kerberos configuration file location with the kerbconfig option of tsm user-identity-store set-connection [options] command.

Set the Kerberos configuration file location with the kerberosConfig configEntity option.

wgserver.domain.ldap.kerberos.keytab,

cfs.ldap.kerberos.keytab

Set the Kerberos keytab file location with the kerbkeytab option of tsm user-identity-store set-connection [options] command.

Set the Kerberos ketytab file location with the kerberosKeytab configEntity option.

### Unsupported configKeys Some unsupported configKeys are present in underlying .yml configuration files. The following keys are not intended for standard deployments. Do not configure these keys: - wgserver.domain.ldap.kerberos.login - wgserver.domain.ldap.guid - wgserver.domain.fqdn: this key is redundant with wgserver.domain.default. The values for both keys must be the same. Only update wgserver.domain.fqdn if the value does not match wgserver.domain.default. [Skip to main content](#main-content) # External Message Queue Service (RabbitMQ) for Tableau Resource Monitoring Tool The Tableau Resource Monitoring Tool uses RabbitMQ as its message queue service to collect data from Agents and bring them to the RMT Server. This information in the queue is processed and eventually stored in the RMT repository (PostgreSQL database). Before the 2022.3 release, the RabbitMQ message queue service was automatically installed with the RMT Server and this was the only configuration available. Starting in RMT version 2022.3, you can reconfigure RMT Server to use an externally hosted RabbitMQ service. When RMT Server is configured to use an externally hosted message queue service, we refer to it as the external message queue service. With this new option added in version 2022.3, RMT Server can be configured in the following ways: - **Continue to use the locally installed message queue service:** This means that RabbitMQ that is automatically installed with RMT Server on the same machine will be used as the message service for RMT Server, and no further changes are made to this configuration. - **Configure RMT Server to use an external message queue service:** This means that RAbbitMQ that RMT uses is hosted external to RMT Server. Currently only AWS AMQ is supported as the hosting platform for RabbitMQ. Since all messages from the Agents go through RabbitMQ, by hosting this externally frees up resources from the machine where RMT Server is installed. To setup and manage the external message queue service, you should have a good understanding of the AWS AMQ platform. We recommend reviewing the [documentation on AWS site](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/welcome.html). You will also need to know how to configure and manage the external message queue service for RMT. This topic will provide you with that information in the sections below. ## New installation of Resource Monitoring Tool The instructions provided in this section apply to a new installation of Resource Monitoring Tool. If you have an existing installation, and want to move your local RabbitMQ to an externally hosted configuration, see the [Existing installations of Tableau Resource Monitoring Tool](#Existing) section of this topic. Use the following steps to install Tableau Resource monitoring tool and reconfigure RMT Server to use an external message queue service: 1. **Create Amazon AMQ for Rabbit MQ** to host the external message queue service with the following recommendations: - For engine type, use RabbitMQ engine. For the version of Rabbit MQ, see the Product compatibility section. - Use the same default version as the one used when RabbitMQ is installed locally. For more information, see the product compatibility table. - Use a single-Instance broker. - Instance specification: mq.m5.large, 2 vCPU/8 GiB RAM. - Create a RabbitMQ username/password. To learn more, see [Working with Amazon MQ for Rabbit MQ](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/working-with-rabbitmq.html) on AWS documentation site. 2. **Test the connection from RMT Server** to the message broker by copying the RabbitMQ web console URL from the AWS MQ page, and paste it into a web browser on RMT Server. Log in via the username and password you created when you set up the broker. 3. Follow the instructions in this topic to **install RMT Server**, but **skip the steps for creating an environment. You will do that later after configuring RMT Server to use the external repository**. 4. Run rmtadmin setup as follows to configure the external Rabbit MQ message queue service: `rmtadmin master-setup --mq-config=external --mq-server=aws_amq_servername --mq-vhost='/' --mq-port=5671 --mq-username=aws_amq_username --mq-password='aws_amq_password' --mq-tls-certificate-host=aws_amq_servername` 5. Now create an environment and download the bootstrap file. - Run the following command to create and environment: `rmtadmin create-env --name= --api-username= --api-password=` - Download the bootstrap file to register Agents: `rmtadmin bootstrap-file --env= --filename` The steps are described in full detail in the [Install the RMT Server Using Command Line](https://help.tableau.com/v0.0/server-linux/en-us/rmt-admin-master-install-cli.htm) topic. 6. Re-register Agents on Tableau Server Nodes using the instructions in [Install the Agent Using Command Line](https://help.tableau.com/v0.0/server-linux/en-us/rmt-admin-agent-install-cli.htm) topic. ## Existing installations of Tableau Resource Monitoring Tool In this release, to configure external messaging service, you will essentially have to start with a new installation of Tableau Resource Monitoring Tool using the steps described in the [above section](#New). ## Upgrade best practices Here are the general steps you need to follow if you want to upgrade to a version 2022.3 or later and migrate to using an external message queue service at the same time. **Migration with environment recreation:** 1. Upgrade RMT Server and all Agents to 2022.3 or later 2. Create an Amazon AMQ broker service. 3. Configure RMT Server to use the external message queue service 4. Recreate environments and re-register all the Agents 5. Recreate any custom configurations. **Note:** You will lose some event and hardware processing data and you will also need to reconfigure the incident thresholds ### Upgrade steps with enabling TLS for RabbitMQ Since the agents in versions earlier than 2022.3 have been communicating using unencrypted connection to the RabbitMQ message queue service, when upgrading to version 2022.3 or later, those agents need to be updated to use the new secure connection details. The steps to do this are as follows: 1. After completing the upgrade steps described in the above section, stop all agents by running the following command: `rmtadmin stop --agent` 2. Download the bootstrap file for the environment by running the following command: `rmtadmin bootstrap-file --env --filename ` 3. Run the following command on each of the machines where the Agent is installed: `rmtadmin rotate-mq-certificate --username= --password-file=` 4. Restart each Agent machine after successfully running the `rmtadmin rotate-mq-certificate` command. ## Product Compatibility This table lists RMT version 2022.3 and later only, since the external message queue is only available from version 2022.3 and later.

RMT Version	RabbitMQ version shipped with RMT	Supoort RabbitMQ version for external message queue service
22.3	3.10.5	3.10.5

RMT Version	PostgreSQL Version shipped with RMT	Supported PostgreSQL Version for external repository
2022.3 - 2024.2	13.7	13.7
2025.0 - 2025.3.2	15.6	15.6
2025.3.3 - 2026.x	15.14	15.14

## Who can do this To install Resource Monitoring Tool, you must have all the following: - User account with full sudo access. - Tableau Server Administrator site role. - Resource Monitoring Tool Administrator account. [Skip to main content](#main-content) # Extract Encryption at Rest Extract encryption at rest is a data security feature that allows you to encrypt .hyper extracts while they are stored on Tableau Server. Tableau Server administrators can enforce encryption of all extracts on their site or allow users to specify to encrypt all extracts associated with particular published workbooks or data sources. ## Limitations Before they can be encrypted, older .tde file extracts must be upgraded to .hyper file extracts. This happens automatically as a part of the encryption job. For more information about the impacts of extract upgrade, see [Extract Upgrade to .hyper Format](https://help.tableau.com/v0.0/server-linux/en-us/extracting_upgrade.htm). Temporary files and cache files are not encrypted at rest with this feature. Workbooks (.twb) and data source files (.tds) are not encrypted with this feature. These files will contain metadata such a database table column names and formatting instructions. In certain cases, they may contain some row-level data if it is included in filters. Other data files, such as Excel or JSON files, are not encrypted with this feature unless they are converted to extracts before being published. When extracts are downloaded from the server they are decrypted. ## Performance Overview ### Increase in Backgrounder Load You may see a slight to moderate increase in backgrounder load when you turn on encryption at rest. Encryption and decryption are computationally intensive operations. Encryption at rest alters existing backgrounder jobs and introduces new jobs to run on backgrounder. The overall increase in backgrounder load depends on the number and size of affected extracts and how often the scenarios below apply. - **Initial publishing**: When publishing workbooks or data sources using extracts that should be encrypted, the encryption happens on the server’s backgrounders. - **Extract refreshes from Tableau Server**: Full and incremental refreshes of encrypted extracts on Tableau Server will consume slightly more CPU. - **Extract refreshes from Tableau Bridge and third-party applications (e.g., Informatica, Alteryx)**: These flows will require new encryption jobs, scheduled on the backgrounders for any refreshed extract, resulting in a slight to moderate increase in backgrounder load. - **Encrypting and decrypting extracts in already published workbooks and data sources**: If the site setting for encryption at rest is set to **Enable**, users might choose to encrypt or decrypt extracts in already published workbooks and data sources on Tableau server. Depending on the number and size of extracts, this will add slight to moderate load on the backgrounders. - **Changing a site’s encryption mode**: When switching a site’s setting for encryption at rest to **Disable** or **Enforce**, the backgrounder will, respectively, decrypt or encrypt all existing extracts on the site. Depending on the number and size of extracts, this may significantly increase the load on backgrounders until all extracts are unencrypted or encrypted. - **Rotating encryption keys**: Rotating encryption keys results in the backgrounders re-encrypting all existing extracts published on that site, using fresh encryption keys. Depending on the number and size of extracts, this may significantly increase the load on backgrounders until all extracts are re-encrypted. If running at or over capacity, consider: - Adding additional backgrounder processes and resources. - Letting users encrypt individual workbooks and data sources instead of enforcing encryption for the whole site or disable encryption at rest for sites where it isn't necessary. Note that scheduled and ad hoc extract refreshes will take precedence over encryption and decryption jobs. ### Increase in Viz Load Time and Worker Load Query performance, for example, when loading or interacting with a viz or dashboard, will require the data being decrypted once, when loaded from disk to memory. This will result in a slight increase in viz load time and CPU consumption on worker nodes for the first user loading a workbook. This will not affect other users accessing those workbooks at the same time because the data will already be decrypted in memory. ### Impact on Backup and Restore Encrypted extracts in backups remain encrypted. The size of backup files (.tbks) may increase up to 50-100% due to the ineffectiveness of compression on encrypted extracts. The size increase depends, among other factors, on the number of extracts that are encrypted. The time to restore a backup that contains encrypted extracts might increase slightly due to the time to exchange encryption keys. If your Tableau Server installation has mostly or only encrypted extracts, consider disabling compression during backups to significantly improve the time backups take. To learn more about TSM backup, see [tsm maintenance backup](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#tsm). ## Enforce Encryption at Rest on a Site Tableau Server administrators can enforce encryption of all extracts on their site. 1. In a web browser, sign in to Tableau Server as a server administrator. 2. Go to the site you want to configure. 3. Click **Settings**. 4. Scroll down to the Extract Encryption at Rest section. Click **Enforce** to encrypt all extracts that are published and stored on the site. Encrypting all existing extracts stored on the site may take a while. 5. Click **Save** ## Enable Encryption at Rest on a Site Tableau Server administrators can allow users to specify to encrypt all extracts associated with particular published workbooks or data sources. 1. In a web browser, sign in to Tableau Server as a server administrator. 2. Go to the site you want to configure. 3. Click **Settings**. 4. Scroll down to the Extract Encryption at Rest section. 5. Click **Enable** to allow users to optionally encrypt extracts on the site. Changing to Enable will cancel pending decryption jobs and pending encryption jobs. No encryption jobs are created. 6. Click **Save** ## Disable Encryption at Rest on a Site 1. In a web browser, sign in to Tableau Server as a server administrator. 2. Go to the site you want to configure. 3. Click **Settings**. 4. Scroll down to the Extract Encryption at Rest section. 5. Click **Disable** to not allow encrypted extracts on the site. Changing to Disable will decrypt all existing encrypted extracts. Decrypting all extracts stored on the site may take a while. 6. Click **Save** ## View Extract Encryption Mode for All Sites 1. On a multi-site server, click Manage all sites on the site menu. **Note:** The Manage all sites option only displays when you are signed in as a server administrator. 2. Click Sites. 3. The encryption mode of each site is displayed in the **Extract encryption at rest** column. ## Encrypt or Decrypt Extracts for a Published Workbook or Data Source **Note**: The option to encrypt or decrypt the extracts associated with particular published workbook or data source is only available when the site setting for encryption at rest is set to **Enable**. When a site is set to Disable, all content is not encrypted. When a site is set to Enforce, all content is encrypted. **Note:** You must be the owner or administrator. 1. Go to the published workbook or published data source page. 2. Click the dropdown menu that says **Encrypted Extract** or **Unencrypted Extract**. 3. Select **Unencrypted**. You will see a message that says, “Decrypting extract.” \-or- Select **Encrypted**. An encryption job is started. Alternatively, you can encrypt or decrypt extracts on the card view action menu, list view action menu, and action menu in the header section. ## Encrypt or Decrypt Multiple Items 1. Go to the Data Sources page. 2. Select the check box beside one or more data sources. 3. In the upper-left of the Data Sources page, click **Actions**. 4. Click **Encrypt** or **Decrypt**. ## View Encryption Status for a Single Item 1. Sign in to the site. 2. Go to a single data source page. \-or- Go to a single workbook page for a workbook containing embedded data sources. 3. The encryption status is displayed on the page. ## Filter Data Sources by Encryption Status 1. In the site, click **Explore**. 2. At the top-right, click the Explore: Top-level Projects dropdown menu and select **All Data Sources**. 3. Click the filter icon. 4. Scroll down to the “Live or extract” section and select a filtering option: All, Live, Extracts, Unencrypted Extracts, Encrypted Extracts, Currently Encrypting, or Currently Decrypting. 5. Select the checkbox beside “Include .tde and .hyper files” if you want to include “Live to .tde file” and “Live to .hyper file” connections in your filter results. ## Filter Workbooks by Encryption Status 1. In the site, click **Explore**. 2. At the top-right, click the Explore: Top-level Projects dropdown menu and select **All Workbooks**. 3. Click the filter icon. 4. Scroll down to the “Live or extract” section and select a filtering option: All, Live, Extracts, Published, Unencrypted Extracts, Encrypted Extracts, Currently Encrypting, or Currently Decrypting. 5. Select the checkbox beside “Include .tde and .hyper files” if you want to include “Live to .tde file” and “Live to .hyper file” connections in your filter results. Any workbooks that have at least one connection that matches the filter selection will be displayed. ## View Status of Encrypt or Decrypt Extracts Background Tasks 1. In the site, click **Site Status**. 2. Click **Background Tasks for Non Extracts** to see completed and pending background task details. Note: **Background Tasks for Non Extracts** includes all tasks not related to extract refreshes, so it includes encryption jobs. 3. In the Task menu, select **Encrypt Extracts** or **Decrypt Extracts** and click **Apply**. 4. In the Time Range menu, select a range. You see "Encrypt Extracts" or "Decrypt Extracts" background tasks for all of your extract-based published data sources and workbooks. ## The tabcmd Utility The tabcmd command-line utility has commands and options to control extract encryption. For more information, see the [tabcmd](https://help.tableau.com/v0.0/server-linux/en-us/tabcmd.htm) documentation. ### Specify the extract encryption mode when you create a site `tabcmd createsite --extract-encryption-mode [enforced | enabled | disabled]` ### Specify the extract encryption mode when you edit a site `tabcmd editsite --extract-encryption-mode [enforced | enabled | disabled]` ### Get the extract encryption mode when you list sites `tabcmd listsites --get-extract-encryption-mode` ### Encrypt extracts when you publish a workbook, data source, or extract to the server `tabcmd publish "filename.hyper" –-encrypt-extracts` ### Decrypt all extracts on a site **Note:** Depending on the number and size of extracts, this operation may consume significant server resources. Consider running this command outside of normal business hours. `tabcmd decryptextracts ` ### Encrypt all extracts on a site **Note:** Depending on the number and size of extracts, this operation may consume significant server resources. Consider running this command outside of normal business hours. `tabcmd encryptextracts ` ### Reencrypt all extracts on a site with new encryption keys You must specify a site. **Note:** Depending on the number and size of extracts, this operation may consume significant server resources. Consider running this command outside of normal business hours. `tabcmd reencryptextracts ` For more information, see [reencryptextracts](https://help.tableau.com/v0.0/server-linux/en-us/tabcmd_cmd.htm#reencryptextracts_tabcmd). ## Tableau Server Rest API With the Tableau Server REST API you can manage Tableau Server resources programmatically. You can use this access to create your own custom applications or to script interactions with Tableau Server resources. To learn more, see [Extract Encryption Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_extract_and_encryption.htm). [Skip to main content](#main-content) # Extract Failure Incidents _Extract Failure_ incidents will be logged as a warning when there is an extract failure in Tableau. ## Who can do this Resource Monitoring Tool Administrator or a Resource Monitoring Tool user with **Server/Environment Management** role. [Skip to main content](#main-content) # Extract Query Load Balancing In Tableau Server version 2020.2 and later, load balancing for extract-based queries has improved and may result in faster load times for extract-based dashboards. Large deployments that are extract heavy and have a high volume of dashboard loads will probably see the most improvement, particularly if they have Hyper running on standalone nodes. Smaller deployments where Hyper is running on nodes that are shared with other server processes may also see performance improvements. Hyper logs a server health metric about the amount of resources Hyper is consuming and also takes into account load from other Tableau processes that may be running on the same server node. Based on this information, extract queries will be sent to a node that has available resources to process the query. In addition to evaluating system resources, the load balancer improves the chance that the node you are routed to has the extract already cached. This reduces the number of duplicate extracts across nodes and improves memory and I/O usage. To use this feature, the Cache Server process must be active. For more information, see [Tableau Server Cache Server](https://help.tableau.com/v0.0/server-linux/en-us/server_process_cache-server.htm). If Cache Server process is not enabled, load balancing will automatically revert to the previous functionality. This feature is turned on by default. To disable it, use the following tsm commands: `tsm configuration set -k hyper_standalone.consistent_hashing.enabled -v false` `tsm configuration set -k hyper_standalone.health.enabled -v false` Apply the changes using the following tsm command: `tsm pending-changes apply` For more information, see [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm). [Skip to main content](#main-content) # Extract Refresh Schedules Tableau Desktop authors and data stewards can create and publish _extracts_. Extracts are copies or subsets of the original data. Because extracts are imported into the data engine, workbooks that connect to extracts generally perform faster than those that connect to live data. Extracts can also increase functionality. ## Before refreshing extracts When an extract refresh is performed on extracts created in Tableau 10.4 and earlier (that is, a .tde extract), the extract is upgraded to .hyper extract automatically. While there are many benefits of upgrading to a .hyper extract, you will be unable to open the extract with previous versions of Tableau Desktop. Tableau 2024.2 is the last version where any .tde-based content can be opened. For more information, see [Extract Upgrade to .hyper Format](https://help.tableau.com/v0.0/server-linux/en-us/extracting_upgrade.htm). ## Setting up refresh schedules As a server administrator, you can enable scheduling for extract refresh tasks, and then create, change, and reassign schedules. General scheduling options you change on the server are available as part of the publishing process when a Tableau Desktop user publishes an extract. Schedules that you create have the following options: Priority The priority determines the order in which refresh tasks are run, where 0 is the highest priority and 100 is the lowest priority. The priority is set to 50 by default. Execution mode The execution mode indicates to the Tableau Server backgrounder processes whether to run refreshes in parallel or serially. Schedules that run in parallel use all available backgrounder processes and serial schedules run on only one backgrounder process. However, a schedule can contain one or more refresh tasks, and each task will only use one backgrounder process, whether in parallel or serial mode. This means that a schedule in parallel execution mode will use all **available** backgrounder processes to run the tasks under it in parallel, but each task will only use one backgrounder process. A serial schedule uses only one backgrounder process to run one task at a time. By default, the execution mode is set to parallel, so that refresh tasks finish as quickly as possible. You might want to set the execution mode to serial (and set a lower priority) if you have a very large schedule that prevents other schedules from running. Frequency You can set the frequency to hourly, daily, weekly, or monthly. For information, see [Create or Modify a Schedule](https://help.tableau.com/v0.0/server-linux/en-us/schedule_manage_create.htm). ## Refreshing extracts manually In the Tableau Server web environment, both server and site administrators can run extract refreshes on-demand on the Schedules page: - Select the schedule and click Actions > Run Now. You can also refresh extracts from the command line using the tabcmd `refreshextracts` command. For more information, see [tabcmd Commands](https://help.tableau.com/v0.0/server-linux/en-us/tabcmd_cmd.htm). ## Refreshing extracts from Tableau Desktop Tableau Desktop users can refresh extracts they publish and own. They can do this the following ways: - At publish time: When an author publishes a workbook or data source that uses an extract, that author can add it to server refresh schedule. The refresh can be a full or an incremental refresh. Incremental refreshes reference a column in the extract that has a data type of date, date/time, or integer; such as a timestamp. Tableau uses this column to identify new rows that need to be added to the extract. For more information, see [Refreshing Extracts](https://help.tableau.com/current/pro/desktop/en-us/help.htm#extracting_refresh.htm) and [Schedule Extract Refreshes as You Publish a Workbook](https://help.tableau.com/current/pro/desktop/en-us/help.htm#publish_workbooks_schedules.htm) in the Tableau Help. - **User interface:** In Tableau Desktop, you can use the Refresh from Source, Add Data From File, and Add Data From Data Source commands to upload an addition to or refresh an extract on Tableau Server. A user might want to do this if Tableau Server doesn’t have sufficient credentials to access the underlying data. For more information, see [Updating Extracts on Tableau Server](https://help.tableau.com/current/pro/desktop/en-us/help.htm#extracting_push.htm) in the Tableau Help. - **Data Extract command line utility:** The Data Extract command line utility installs with Tableau Desktop. You can use it to append to or refresh a published extract. For more information, see [Tableau Data Extract Command Line Utility](https://help.tableau.com/current/pro/desktop/en-us/help.htm#extracting_TDE.htm) in the Tableau Help. ## Other articles in this section [Skip to main content](#main-content) # Files and Permissions in TSM This topic covers the permissions requirements needed for Tableau Services Manager (TSM) to access and use files. This information is intended for server administrators. This topic does _not_ address permissions used for managing users and content within Tableau Server (permissions for content and users). For information related to these permissions, see [Permissions](https://help.tableau.com/v0.0/server-linux/en-us/permissions.htm). During installation of TSM and Tableau Server, an unprivileged user (_tableau_) is created and added to a server authorized group (_tableau_). This user account enables the work done by TSM and Tableau Server processes. You can change the user and group during installation. For more information, see [Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm). Permissions requirements for TSM apply to both files, and to the directories in which the files are placed. When TSM creates and manages files, the files get put into specific default locations with the necessary permissions and you don't need to worry about setting permissions. When you create, copy, or move files yourself, or when you put files into non-default locations, you need to be aware of permission requirements so that TSM can properly access the files. Common cases (For information about using non-default locations, see [tsm File Paths](https://help.tableau.com/v0.0/server-linux/en-us/cli_default_filepaths_tsm.htm).) General rules for permissions and TSM are: - Files—If the _tableau_ group has access to a file (if it is the group owner and has read access to the file), the users in the group have access to the file. An alternate approach is to give "other" read access. - Directories—If the _tableau_ group has read and execute access to the directory that contains a file, and any parent directories of that directory, the users in the group have access to the file. Situations that may require you to adjust permissions include server backup files and site import archives that you copy from a different computer or to a non-default location, customization files such as logos or images, and security certificates such as SSL certificates. For example, if you migrate from Tableau Server on Windows to Tableau Server on Linux, you use a backup created in Windows to restore data to your Linux server. Because this backup file isn't created by TSM, it may not have the correct permissions for the restore process to access it. You need to make sure the backup file and the directory structure you copy it into have the proper permissions. Similarly, if you are copying files like certificates to additional nodes in a cluster, you need to make sure the files and the directories you copy them into have the permissions the _tableau_ user needs in order to access them. ## Setting permissions for individual files If you are using a file you copy to one of the default locations created by TSM, you need to make sure the ownership and permissions on the file allow TSM access by giving the _tableau_ user read access. You can do this in one of two ways: - You can give the _tableau_ user read access by giving the _tableau_ group (in a default installation) read and execute access to a file using the `chgrp` and `chmod` commands. For example: `chgrp tableau .tsbak` `chmod g+rx .tsbak` - Alternately, you can give world read and execute access to the file: `chmod o+rx .tsbak` ## Setting permissions for directories In addition to setting the proper permissions on the files themselves, TSM also needs permissions for the directory that contains the file, as well as any parent directories. If you are using a non-default location for files that TSM will access, you will need to make sure permissions for the parent directory or directories that contain the file allow read and execute access. You can address this issue in a couple of ways: - Change group ownership of the directory to the _tableau_ group, and add group read and execute permission to the directory. Doing this makes files in the directory more available to the _tableau_ user. `chgrp tableau ` `chmod g+rx ` - Alternatively, you can add world read and execute permission to the directory. This makes files in the directory more available to all users on the system. This approach may require additional steps to ensure security of other files in the directory. For example, you may want to make sure other files in the directory are not world readable so other users cannot read them. `chmod o+rx ` **Hint:** You can use `namei -mo` command to list an entire permissions tree. This can make it easier to see what directories need to have permissions adjusted to allow access by the _tableau_ group. You can find more information on the internet. [Skip to main content](#main-content) # FIPS Compliance in Tableau Resource Monitoring Tool This topic introduces the FIPS-compliant version of Tableau Resource Monitoring Tool (RMT). FIPS (Federal Information Processing Standard) compliance was added to RMT in version 2025.3. FIPS 140-2 is a U.S. government computer security standard used to approve cryptographic modules. This compliance ensures that all cryptographic operations within RMT meet rigorous security requirements, providing a more secure environment for your data. ## Supported operating systems RMT is FIPS 140-2 compliant on the following operating systems: - Linux: RMT is FIPS compliant on RHEL 8 distros. If your RHEL 8 os is FIPS-enabled, install RMT with FIPS enabled. If your RHEL 8 OS is not FIPS-enabled, install RMT without enabling FIPS. All other supported distros must be running in non-FIPS mode for RMT to install successfully, and RMT must be installed without FIPS enabled. ## What FIPS compliance means for you The functionality of RMT is largely unchanged from the user's point of view. FIPS compliance is primarily an under-the-hood enhancement that strengthens the security posture of the RMT. - Enhanced Security: All data in transit and at rest, when protected by cryptographic modules, will use FIPS-validated algorithms. - Installation: For new installations the process is the same as with previous versions. Learn more about installing RMT in the topic [Install the Tableau Resource Monitoring Tool](https://help.tableau.com/v0.0/server-linux/en-us/rmt-admin-installation.htm). - Upgrades: - If you are installing and do not want to run RMT in FIPS mode, your upgrade process remains the same. See [Upgrading Resource Monitoring Tool](https://help.tableau.com/v0.0/server-linux/en-us/rmt-admin-upgrade.htm) for more information. - If you want to install RMT in FIPS mode, you must do a fresh install. For details, see [Upgrading to a FIPS compliant version of RMT](#Upgrading2FIPS) below. ## Installing and upgrading RMT 2025.3.0 or later FIPS compliant RMT (version 2025.3.0 and later) uses a different algorithm for log files than previous versions. You cannot switch modes without uninstalling completely and reinstalling a fresh instance of RMT. The steps you follow to install or upgrade to RMT version 2025.3.0 or later depend on several factors including: - What operating system you are using - Whether that operating system is FIPS-enabled - Whether you want to run RMT in FIPS mode ### Installing RMT 2025.3.0 or later Installing a new instance of RMT 2025.3+ is no different than installing previous versions, except if you are installing on RHEL 8. If you are installing RMT on RHEL 8, you need to decide whether to install in FIPS mode. **Note:** All components of RMT (server and agents) must be installed with the same FIPS setting, either all FIPS enabled, or none FIPS enabled. You cannot mix FIPS states in RMT components. #### Installing on Windows There are no special steps you need to take to install RMT on Windows. RMT will run on a FIPS enabled Windows system without error, but is not FIPS compliant. RMT is only FIPS compliant on RHEL 8. #### Installing on Linux - RHEL 8 systems - If the RHEL 8 operating system is FIPS enabled, you must use the `--enable-fips` switch when you install. The install will fail if you don't use the switch. - If the RHEL 8 operating system is not FIPS enabled, you cannot use the `--enable-fips` switch. The install will fail if you use the switch. - all other Linux distros - You can install RMT as long as you are not installing in FIPS mode. Installing RMT in FIPS mode will fail. ### Upgrading to a FIPS compliant version of RMT When upgrading from a pre-2025.3.0 version of RMT to version 2025.3.0 or later, your process depends on whether or not you want to run RMT in FIPS mode. - No FIPS: if you want to upgrade to 2025.3.0 or later but do not need FIPS, you can follow the steps for a regular upgrade of RMT. - FIPS mode: if you want to run RMT in FIPS mode on RHEL 8, you must do a full uninstall of your existing version, and then install the new version with FIPS enabled. Your configuration and logs are not preserved. When upgrading from 2025.3.x version of RMT to any later version, your process depends on whether or not you want to change the FIPS status. - No FIPS: if you do not need FIPS and the version you are upgrading from is not FIPS enabled, you can follow the steps for a regular upgrade of RMT. - FIPS mode: if you want to run RMT in FIPS mode on RHEL 8 and you are upgrading an installation that is already running in FIPS mode, you can do a regular upgrade. - Changing FIPS mode (going from a FIPS enabled installation to a non-FIPS installation, or from a non-FIPS installation to a FIPS enabled installation): you must do a full uninstall of your existing version, and then install the new version with FIPS enabled. Your configuration and logs are not preserved. [Skip to main content](#main-content) # FIPS Compliance in Tableau Server on Linux This topic introduces the FIPS-compliant version of Tableau Server. FIPS (Federal Information Processing Standard) compliance was added to Tableau Server on Linux in version 2025.3. Tableau Server on Windows is not FIPS compliant. FIPS 140-2 is a U.S. government computer security standard used to approve cryptographic modules. This compliance ensures that all cryptographic operations within Tableau Server meet rigorous security requirements, providing a more secure environment for your data. ## What FIPS compliance means for you For most users, the day-to-day experience of using Tableau Server will remain largely unchanged. The FIPS compliance is primarily an under-the-hood enhancement that strengthens the security posture of the server. - Enhanced Security: All data in transit and at rest, when protected by cryptographic modules, will use FIPS-validated algorithms. - Regulatory Adherence: FIPS compliance in Tableau Server for Linux helps organizations meet specific government and industry regulations that mandate FIPS 140-2 compliance. - User Impact: There is no direct user impact. You do not need to change how you publish workbooks, view dashboards, or interact with data. The security enhancements are transparent to the end-user workflow. ## Installing Tableau Server in FIPS mode Installing Tableau Server in FIPS mode means including the `--enable-fips` flag with the `initialize-tsm script`. The documentation to install and initialize Tableau Server is the same as a non-FIPS server except for the `--enable-fips` flag. A Tableau Server instance either is or is not in FIPS mode. Once `initialize-tsm` has been run for the first time for any instance, FIPS mode is set and cannot be changed unless you reinstall Tableau Server. For more information about installing Tableau Server, see [Install and Initialize TSM](https://help.tableau.com/v0.0/server-linux/en-us/setup.htm). To convert an instance of Tableau Server from non-FIPS to FIPS mode, see [Restoring Data to a FIPS mode Tableau Server](#Restoring) **Note:** FIPS mode has not been tested and is not supported with Tableau Server in a Container. ## Using Tableau Server’s command line tools with FIPS When Tableau Server is installed in FIPS mode, part of the installation process adds a special environment variable, `TABLEAU_SERVER_ENABLEFIPS=true`, to the system startup scripts so that users of the system will automatically have this environment variable set for them then they log in. This ensures that when the user runs either the `tsm` or `tabcmd` CLI tools, those tools will also run in FIPS mode. While running `tsm` and `tabcmd` in FIPS mode is important for FIPS compliance, it is also necessary for correct functionality. **Note:** You cannot use older versions of `tsm` with a server in FIPS mode. ## How to determine if FIPS mode is enabled on Tableau Server FIPS mode impacts some interactions with Tableau Server, including when you can restore a server backup to another instance, and how some database connections require for authentication. There are several methods to determine if your server is running in FIPS mode: - In TSM - Run the `tsm version` command on the command line and look for "(FIPS)" at the end of the version: % tsm version Tableau Services Manager command line version 2025.3.0. (FIPS) Tableau Server version 2025.3.0. (FIPS) - Open the About TSM dialog from the TSM UI: ![](/tableau/next/en-us/server-linux/en-us/Img/FIPS-About-TSM.png) - using tabcmd: % tabcmd version Tableau Server Command Line Utility -- 2025.3.0 (FIPS) - opening the About Tableau dialog in Tableau Server: ![](/tableau/next/en-us/server-linux/en-us/Img/FIPS-About-Tableau.png) ## Using a FIPS-enabled Linux operating system Tableau Server in FIPS mode has been tested on [RHEL 8 with FIPS enabled](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/security_hardening/switching-rhel-to-fips-mode_security-hardening). Tableau Server should run in FIPS mode on any supported Linux operating systems, but has only been tested on RHEL 8. You do not have to have a FIPS enabled OS to run Tableau Server in FIPS mode, but for complete FIPS compliance, you likely will want to run on a FIPS-enabled OS. You are responsible for understanding and knowing how to configure your operating system to run in FIPS mode. ## Restoring Data to a FIPS mode Tableau Server In order to restore data to a FIPS mode Tableau Server, the backup must be compliant with FIPS. However, if you are running a pre-FIPS compatible Tableau Server version, then that server cannot generate a FIPS-compliant backup and you will need to upgrade that instance before creating a backup that is FIPS-compliant. As a best practice, we strongly encourage all customers to use the Blue/Green approach for upgrading as this provides a way to fall back to your original server if you run into difficulties. For details on Blue/Green upgrades, see [Using a Blue/Green approach for upgrading Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/server-upgrade-blue-green.htm). ### Upgrading a non-FIPS installation to FIPS mode To move from a non-FIPS version of Tableau Server to a FIPS mode version: 1. Back up your non-FIPS mode Tableau Server. This backup is a best practice for safety and can be used to restore your original Server install if something goes wrong. 2. Upgrade your non-FIPS mode Tableau Server to the version of Tableau Server that supports FIPS (2025.3.0 or later). 3. Take a backup of the upgraded server. This backup will be used to restore your data to a FIPS-enabled server instance created in the next step. **Note:** The upgraded server will not be in FIPS mode, but it generates a FIPS-compliant backup because it is a version that is FIPS-aware. 4. Create a new Tableau Server instance running in FIPS mode. 5. Restore the backup data to the new FIPS- enabled instance. **Note:** Once you upgrade Tableau Server to a version that supports FIPS, the backup generated by that version will be FIPS-compliant even if the Tableau Server instance isn't running in FIPS mode. ### Upgrading a FIPS mode installation to non-FIPS mode To convert from a FIPS mode installation to a non-FIPS installation, you can follow similar steps. If you do this, the ultimate non-FIPS installation must still be a FIPS-aware version (2025.3.x or later) with FIPS mode disabled. ## FIPS enforcement mechanisms The job of enforcing FIPS standards is handled by two external libraries, [openssl](https://openssl-library.org/post/2025-03-11-fips-140-3/) and [bouncycastle](https://www.bouncycastle.org/about/bouncy-castle-fips-faq/). The libraries are NIST certified to guarantee FIPS compliance as long as the applications using them rely on them exclusively for cryptographic functions. Tableau Server is designed so that all cryptographic functions go through one of these two libraries. Specifically, the Bouncycastle libraries will not read the standard Java Keystore `cacerts` file as it is not FIPS compliant. In its place, Tableau Server uses the Bouncycastle-specific and FIPS-compliant BCFKS keystore. The use of this keystore is mostly transparent to users except if they are adding their own certificates to the OS truststore in order to communicate securely via (m)TLS to their JDBC data sources as described in the [Tableau Desktop and Web Authoring documentation](https://help.tableau.com/current/pro/desktop/en-us/jdbc_ssl_config.htm "Link to Desktop Authoring docs"). In addition to following those steps, and after running `update-ca-certificates`, the user should then run the additional script in the Tableau Server install directory named `update-cacerts`, which will convert the contents of the OS truststore `cacerts` file to the FIPS-compliant `cacerts.bcfks` which will be created in the same directory as the OS truststore file. An example of FIPS enforcement is demonstrated connecting via JDBC to a PostgreSQL database. The two most common errors are that the server or the database user is not configured to use `scram-sha-256` [password encryption](https://www.postgresql.org/docs/current/auth-password.html) and instead is using `md5` password encryption, or when the database user's password is fewer than the Bouncycastle library mandated 112 bits (14 bytes) in length. When connecting to PostgreSQL while Tableau Server is in FIPS mode, a user may encounter one or both errors, depending on their user configuration and credentials. Errors like these are common when running software in FIPS mode and are the difference between running Tableau Server in non-FIPS mode and FIPS mode. ## FIPS boundary Running Tableau Server in FIPS mode on a FIPS-enabled OS means that the software running on the FIPS-enabled OS and the Tableau Server software running directly on that OS are FIPS-enabled and will enforce FIPS standards. However, other software will connect to that Tableau Server, including software written by Tableau and no claims are made about the FIPS compliance of that software. The same is true if the OS is not FIPS-enabled. This includes but is not limited to web browsers and Tableau Desktop. Additionally, the FIPS standard only relates to enforcing the cryptographic algorithms in use. FIPS does not necessarily reflect the overall security posture of the software system. For example, in the above example using PostgreSQL, one option for password encryption is named "password" which means no encryption. That is, passwords are sent in the clear. This is the most insecure password transmission protocol of them all, but is technically FIPS compliant because there are no cryptographic algorithms in play. If a user configures their postgres database to accept passwords in the clear, a Tableau Server in FIPS mode will connect without errors. Users are required to be aware of the security settings they are using. Running Tableau Server in FIPS mode only guarantees that the cryptographic algorithms in use conform to the FIPS standard. [Skip to main content](#main-content) # Format Animations Animate visualizations to better highlight changing patterns in your data, reveal spikes and outliers, and see how data points cluster and separate. Animations visually transition between filter, sort, and zoom settings, different pages, and changes to filter, parameter, and set actions. As visualizations animate in response to these changes, viewers can more clearly see how data differs, helping them make better informed decisions. ## Understanding simultaneous and sequential animations When you author animations, you can choose between two different styles: simultaneous or sequential. Here are examples of each type. ### Simultaneous animations The default simultaneous animations are faster and work well when showing value changes in simpler charts and dashboards. ![A Tableau animation.](/tableau/next/en-us/server-linux/en-us/Img/animations.gif) Click the image above to replay the animation. ### Sequential animations Sequential animations take more time but make complex changes clearer by presenting them step-by-step. ![A sequential animation.](/tableau/next/en-us/server-linux/en-us/Img/animations_sequential.gif) Click the image above to replay the animation. ## Animate visualizations in a workbook When you create a new workbook, Tableau enables animations for your viz by default. You can turn animations on or off at the user and workbook level. 1. Choose Format > Animations. 2. If you want to animate every sheet, under Workbook Default, click On. Then do the following: - For Duration, choose a preset, or specify a custom duration of up to 10 seconds. - For Style, choose Simultaneous to play all animations at once or Sequential to fade out marks, move and sort them, and then fade them in. 3. To override workbook defaults for a particular sheet, change the settings under Selected Sheet. **Note:** In the Selected Sheet section, “(Default)” indicates a setting that automatically reflects the related Workbook Default setting. ![Animations pane with options to configure animations at the workbook or sheet level.](/tableau/next/en-us/server-linux/en-us/Img/animations_pane.png) To replay an animation, click the Replay button in the toolbar. From the Replay button, you can also choose the speed at which the animation replays: actual speed, 2x speed, or 1/2 speed. ![Replay button dropdown menu for choosing replay speed](/tableau/next/en-us/server-linux/en-us/Img/replay_speed.png) ## Reset animation settings for a workbook You can reset animations to return an entire workbook to the default animation settings. Be aware that this turns animations off by default. 1. Choose Format > Animations. 2. In the middle of the Animations pane, click Reset All Sheets. ## Completely disable all animations When you create a new workbook, animations are enabled by default. If you find animations distracting while viewing vizzes, you can completely disable them so they never play. (This isn't a system-wide setting; each user needs to apply it separately.) - In Tableau Desktop, choose Help > Settings and Performance, and deselect Enable Animations. - In Tableau Cloud or Tableau Server, click your profile image or initials in the top right corner of the browser, and choose My Account Settings. Then scroll down to the bottom of the page, deselect Enable animations, and click Save Changes. **Note:** When animations are disabled, you can still choose Format > Animations in authoring mode and adjust settings—but they will have no effect. ## Format decimals for axes animations If the number of decimal places for a measure is set to the default, then the number of decimals shown during the axis animation might fluctuate during the axes animation. To avoid this, format the number of decimal places displayed for a measure. For more information, see [Format Numbers and Null Values](https://help.tableau.com/current/pro/desktop/en-us/formatting_specific_numbers.htm). ## Why animations won't play ### Server rendering Animations won't play if a viz is server-rendered. To ensure that vizzes render on a client computer or mobile device, use these techniques: - If you're a viz author, [reduce viz complexity](https://help.tableau.com/current/pro/desktop/en-us/perf_visualization.htm). - If you're a Tableau Server administrator, [increase the complexity threshold for client-side rendering](https://help.tableau.com/current/server/en-us/browser_rendering.htm). **Note:** On computers with lower processing power, animations may appear choppy, but users can continue to interact with vizzes without any delays in responsiveness. ### Unsupported browsers and features Animations are supported by all web browsers except Internet Explorer. The following Tableau features don't animate: - Maps, polygons, and density marks in web browsers - Pie and text marks - Headers - Forecasts, trends, and reference lines - Page history trails (If a viz includes these, turn off animations to avoid unexpected behavior.) [Skip to main content](#main-content) # Format Numbers and Null Values You can specify the format for numeric values that display in your viz, including measures, dimensions, parameters, calculated fields, and axis labels. When specifying a number format, you can select from a set of standard formats, such as number, currency, scientific, and percentage. You can also define a custom number format with the option to include special characters. When a measure contains null values, you can use formatting to handle the null values in a different way, such as replacing nulls with zeros or hiding them. ## For Tableau Desktop ### Specify a number format 1. Right-click (control-click on Mac) a number in the view and select Format. 2. In the Format pane, click the Numbers drop-down menu. 3. Select a number format. Some formats require additional settings. For example, if you select Scientific, you must also specify the number of decimal places. ![Formatting pane with options to select how many decimal points for scientific numbers.](/tableau/next/en-us/server-linux/en-us/Img/numbers1.png) Here are the number formats and associated options available in Tableau.

NUMBER FORMAT	FORMAT OPTIONS
Automatic: format is automatically selected based on either the format specified by the data source or the data contained in the field.	None.
Number (Standard): format is based on locale selected.	Locale: number format changes based on the geographical location selected.
Number (Custom): format is customized to your choice.	Decimal Places: the number of decimal places to display. Negative Values: how negative values are displayed. Units: the number is displayed using the specified units. For example, if the number is 20,000 and the units are thousands, the number will be displayed as 20K. Prefix/Suffix: characters that precede and follow each displayed number. Include thousands separators: whether the number shows separators every thousand (example: 100,000 vs. 100000).
Currency (Standard): format and currency symbol is based on locale selected.	Locale: currency format based on the geographical location selected.
Currency (Custom): format and currency symbol is customized to your choice.	Decimal Places: the number of decimal places to display. Negative Values: how negative values are displayed. Units: the number is displayed using the specified units. For example, if the number is 20,000 and the units are thousands, the number is displayed as 20K. Prefix/Suffix: characters that precede and follow each displayed number. Include thousands separators: whether the number shows separators every thousand (example: 100,000 vs. 100000).
Scientific: numbers are displayed in scientific notation.	Decimal: the number of decimal places to display.
Percentage: numbers are displayed as a percentage with the percent symbol. The value of 1 is interpreted as 100% and 0 as 0%	Decimal: the number of decimal places to display.
Custom: format is based entirely on what is specified in the format options.	Custom: type in the format you want to use, including special characters (optional). See "Define a custom number format" in this topic for details.

### Scale values automatically With the `[scale]` token, you can format custom number strings to dynamically scale values and append the appropriate International System of Unit (SI) suffixes based on their magnitude. This token is ideal when a single field spans multiple magnitudes (such as thousands and millions), which ensures that each value is displayed clearly in a readable format, avoiding the need for a uniform unit across the column. While Display Units (such as Thousands, Millions, or Billions) enforce a single fixed unit across all values in a field, the `[scale]` token applies dynamic scaling per individual value. - **Display Units**: Best for enforcing uniform units across all numbers. - **`[scale]` token**: Best for adaptive, value-level formatting within a single field. #### How the `[scale]` token works Applying `[scale]` to a custom format triggers the following process: - Tableau evaluates every data point individually. - Values are divided by powers of 1,000 as appropriate. - The output is appended with a matching SI suffix. #### Scaled value formatting examples Using 0.0`[scale]`: - 12 renders as 12.0 - 1,000 renders as 1.0k - 1,500,000 renders as 1.5M - 2,300,000,000 renders as 2.3G - 0.004 renders as 4.0m #### Use `[scale]` in a custom value string 1. Right-click (or Control-click on macOS) the target number in your view and choose Format. 2. Navigate to the Format pane, open the Numbers dropdown menu, and select Custom. 3. Insert the `[scale]` token into the Format input box (for example, `0.0[scale]`). #### Important notes on suffixes and units - `[scale]` utilizes standard SI prefixes, including `k`, `M`, `G`, and `T` for larger numbers, and `m`, `µ`, and `n` for smaller numbers. - SI unit prefixes differ from standard Display Units labels. For instance, 1,000,000,000 displays using `G` (giga) rather than `B` (billions). - The `[scale]` tag is typed directly into the custom number formatting text string. ### Define a custom number format To apply a custom number format in your viz: 1. Right-click (control-click on Mac) a number in the view and select Format. 2. In the Format pane, click the Numbers drop-down menu and select Custom. 3. In the Format field, define your formatting preferences using the following syntax: `Positive number format;Negative number format;Zero values`. When defining your number format code, keep in mind that: - You can specify the formatting for up to three types of numbers in the following order: positive numbers, negative numbers, and zeros. - Each number type must be separated by a semicolon (;). - If you specify only one number type, the format for that type is used for all numbers. - If you specify two number types, the format for the first type is applied to positive numbers and zeros, while the format for the second type is applied to negative numbers. - If you skip types in your number format code, you must include a semicolon (;) for each of the missing types. #### Custom number format examples Refer to the following table for examples of commonly used custom number format codes that you can use in your viz. The syntax has three portions: `;;` separated by semicolons.

USE CASE	NUMBER CODE SYNTAX	EXAMPLE OUTPUT
Show only positive values	#,##; ; (note a blank space after the 2nd and 3rd semicolon)	Positive values: 1,234 Negative values: (only the blank space displays) Zero values: (only the blank space displays)
Show only negative values	;-#,##;	Positive values: (nothing displays) Negative values: -1,234 Zero values: (nothing displays)
Show only zero values	;;0;	Positive values: (nothing displays) Negative values: (nothing displays) Zero values: 0
Hide zero values	#,###;-#,###;;	Positive values: 1,234 Negative values: -1,234 Zero values: (nothing displays)
Show negative values in parentheses	#,###;(#,###);;	Positive values: 1,234 Negative values: (1,234) Zero values: (nothing displays)
Add a character prefix to a value	$#,###.##;-$#,###.##;$0;	Positive values: $1,234.56 Negative values: -$1,234.56 Zero values: $0
Add a character suffix to a value	#%;-#%;0%;	Positive values: 12% Negative values: -34% Zero values: 0%
Add text descriptors	"$"#,#" Surplus";"$"-##" Shortage"; "$"0;	Positive values: $1,234 Surplus Negative values: $-1,234 Shortage Zero values: $0

There are several ways to customize your number format to meet your needs. For more code guidance and examples, see [Review guidelines for customizing a number format](https://support.microsoft.com/en-us/office/review-guidelines-for-customizing-a-number-format-c0a1d1fa-d3f4-4018-96b7-9c9354dd99f5) in the Microsoft Knowledge Base. **Note:** There are slight deviations between the options described by Microsoft and those available in Tableau. For example, custom number formats that align text within columns aren't relevant in Tableau. Additionally, custom number formats to color code text aren't applicable because you can apply color to text using the Marks card. (For more information on applying color, see [Control the Appearance of Marks in the View](https://help.tableau.com/current/pro/desktop/en-us/viewparts_marks_markproperties.htm).) Be sure to only use custom number formats that apply in Tableau. #### Include special characters in a custom number format One of the benefits of custom number formatting is the ability to include special characters or symbols. Symbols can make it easier to quickly understand comparisons between measures and calculations in your viz. For example, let’s say you want to show a month-over-month comparison of profits for three of your company’s top-selling products. Rather than using the standard label to show that the profit for these products changed +5%, -2%, and 0% label from last month, you can set the custom number format as follows to show these changes as ▲5%,▼2%, and ►0. ![Custom number format defined using special characters ](/tableau/next/en-us/server-linux/en-us/Img/CustomNumberFormatCode.png) ### Set the default number format for a field Right-click (control-click on Mac) the field in the Data pane and select Default Properties \> Number Format. In the subsequent dialog box, specify a number format to be used whenever the field is added to the view. The default number format is saved with the workbook. It’s also exported when you export the connection information. **Note:** Formatting numbers using the Format pane overrides any number formatting applied elsewhere. ### Format a measure as currency The view in the following image shows profit over time. Notice that the profit figures on the vertical axis aren’t formatted as currency. ![ ](/tableau/next/en-us/server-linux/en-us/Img/FormattingNumbersDates_InitialView.png) **To format the numbers as currency:** 1. Right-click the Profit axis and choose **Format**. ![ ](/tableau/next/en-us/server-linux/en-us/Img/FormattingNumbersDates_FormatAxis.png) 2. On the Axis tab in the Format pane, under Scale, select the **Numbers** drop-down list, and then select one of the following: **Currency (Standard)** to add a dollar sign and two decimal places to the figures. ![ ](/tableau/next/en-us/server-linux/en-us/Img/FormattingNumbersDates_FormatCurrency.png) **Currency (Custom)** to specify the number of decimal places, how to show negative values, the units, whether to include a prefix or suffix, and whether to include a separator character. ### Use locale to specify number formats By default, Tableau uses your computer's locale and language settings to format numbers. But you can explicitly set a different locale in the **Format** pane. The following steps show how to set Swiss German currency, using the same view as in the previous section. 1. Right-click the Profit axis and select **Format**. 2. On the Axis tab, under Scale, select the **Numbers** drop-down list and then select **Currency (Standard)**. 3. In the **Locale** drop-down list, items appear in a **Language (Country)** format. For this example, select **German (Switzerland)**. The view updates to show the sales figures as Swiss Francs, formatted for the German language. **Tip:** You can change the default currency setting so that every time you drag the Profit measure to a view it uses the settings you want. In the Data pane, right-click **Profit** (or other monetary measure), and select **Default Properties** > **Number Format**. Then format the field as shown above. ### Format null values When a measure contains null values, they’re usually plotted in a view as zero. However, sometimes that changes the view and you’d rather just suppress null values altogether. You can format each measure to handle null values in a unique way. **To format null values for a specific field:** 1. Right-click the field in the view that has the null value (Control-click on a Mac) and choose Format. 2. Go to the **Pane** tab. 3. In the Special Values area, specify whether to show the null value using an indicator in the lower right corner of the view, plot it at a default value (such as zero for number fields), hide the value but connect the line, or hide and break the line to indicate that a null value exists. ![Formatting pane with options on how to show null values.](/tableau/next/en-us/server-linux/en-us/Img/nullvalues3.png) 4. If you specify text in the **Text** field, it appears in the view for a null value when mark labels are turned on. See [Show and Hide Mark Labels](https://help.tableau.com/current/pro/desktop/en-us/annotations_marklabels_showhideworksheet.htm#show-and-hide-individual-mark-labels). **Note**: The Special Values area isn’t available for dimensions or discrete measures. ## For Tableau Server or Tableau Cloud ### Specify a number format When authoring a view on the web, you can specify the number format for a field used in the view. 1. In web editing mode, right-click a measure in the view and select **Format Number**. ![Measure context menu with option to format numbers.](/tableau/next/en-us/server-linux/en-us/Img/format_numbers_web1.png) 2. In the dialog box that appears, select a number format. Some formats provide additional settings. For example, if you select Currency, you can also specify the number of decimal places, as well as the units, and whether or not to include separators, such as commas. In this example, Sales is formatted as a Currency with zero decimal places and thousand (k) units. Sales numbers in the view update with these settings. Labels and tooltips update as well. ![A dropdown menu with options for formatting numbers as automatic, standard number, custom number, standard currency, custom currency, percentage, scientific, or custom.](/tableau/next/en-us/server-linux/en-us/Img/format_numbers_web2.png) Here are the number formats and associated options available in Tableau.

NUMBER FORMAT	FORMAT OPTIONS
Automatic: format is automatically selected based on either the format specified by the data source or the data contained in the field.	None.
Number (Custom): format is customized to your choice.	Decimal Places: the number of decimal places to display. Units: the number is displayed using the specified units. For example, if the number is 20,000 and the units are thousands, the number is displayed as 20K. Include separators: whether the number shows separators every thousand (example: 100,000 vs. 100000).
Currency (Custom): format and currency symbol is customized to your choice.	Decimal Places: the number of decimal places to display. Units: the number is displayed using the specified units. For example, if the number is 20,000 and the units are thousands, the number is displayed as 20K. Include separators: whether the number shows separators every thousand (example: 100,000 vs. 100000).
Percentage (Custom): numbers are displayed as a percentage with the percent symbol. The value of 1 is interpreted as 100% and 0 as 0%	Decimal Places: the number of decimal places to display.
Scientific (Custom): numbers are displayed in scientific notation.	Decimal Places: the number of decimal places to display.

[Skip to main content](#main-content) # gatewaySettings Entity You must configure the gateway settings for the Tableau Server computer. Use the configuration file template below to create a json file. After you have filled in the options with the appropriate values, pass the json file and apply settings with the following commands: `tsm settings import -f /path/to/file.json` `tsm pending-changes apply` If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). ### Gateway settings The gateway settings in the template below specify the HTTP settings for Tableau Server. We recommend using SSL/TLS. Tableau Server is hard-coded to use port 443 for SSL/TLS. Therefore, if you enable SSL, you do not need to update the gatewaySettings entity. ### Configuration template Use this template to configure the gateway settings. **Important:** All entity options are case sensitive. For more explanation about configuration files, entities, and keys see [Configuration File Example](https://help.tableau.com/v0.0/server-linux/en-us/config_file_example.htm). { "configEntities": { "gatewaySettings": { "\_type": "gatewaySettingsType", "port": 80, "sslRedirectEnabled": true, "publicHost": "localhost" } } } ### Configuration file reference This table includes all of the options that can be included with the `"gatewaySettings"` entity set. \_type Required. Value: `"gatewaySettingsType"` Do not change. port Specifies HTTP port. Default is port 80. sslRedirectEnabled Options: `true` or `false`. publicHost Specifies host name for http/s service. trustedIPs Specifies trusted IP addresses that communicate with Tableau Server. Trusted IP addresses include upstream proxy servers and servers that are used for trusted authentication with Tableau Server. See [Configuring Proxies and Load Balancers for Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/proxy.htm) and [Add Trusted IP Addresses or Host Names to Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_trustIP.htm). If you are running Tableau Server in a cluster then all other nodes of the cluster will automatically be included in the corresponding configuration file that this entity updates. Therefore, if you specify a new value for `trustedIPs`, then you must include the IP addresses for the other nodes in the value. This option takes a list of strings, which requires passing each IP or host in quotes, separated by a comma (no space) and within brackets. For example: `["192.168.1.101","192.168.1.102","192.168.1.103"]` or `["webserv1","webserv2","webserv3"]`. trustedHosts Specifies trusted IP addresses that communicate with Tableau Server. Typically, this value contains a list of upstream proxy servers. The values in trustedHosts are used to determine client request targets. If you are running Tableau Server in a cluster then all other nodes of the cluster will automatically be included in the corresponding configuration file that this entity updates. Therefore, if you specify a new value for `trustedIPs`, then you must include the IP addresses for the other nodes in the value. This option takes a list of strings, which requires passing each IP or host in quotes, separated by a comma (no space) and within brackets. For example: `["192.168.1.101","192.168.1.102","192.168.1.103"]` or `["webserv1","webserv2","webserv3"]`. [Skip to main content](#main-content) # General Performance Guidelines ## Hardware and Software **Add more cores and memory**: Regardless of whether you’re running Tableau Server on one computer or several, the general rule is that more CPU cores and more RAM will give you better performance. Make sure you meet the Tableau Server recommended hardware and software requirements. If you are running Tableau Server in a virtual environment, use your VM host's best practices for vCPU allocation in relation to the number of physical CPU cores on the VM host. ## External repository For optimal performance for Tableau Server we recommend isolating the repository on a dedicated node in your deployment. If you have an Advanced Management license, consider running the repository as an external database. If your organization has a peak load of more than 1000 VizQL sessions per hour, we also recommend running Tableau Server on Linux. In this scenario, VizQL sessions refer to any user actions that display or generate visualizations from Tableau Server. For more information, see [Tableau Server External Repository](https://help.tableau.com/current/server-linux/en-us/server_external_repo.htm). ## Configuration **Schedule refreshes for off-peak hours**: Backup tasks tend to stall other background tasks until the backup is completed. Use the [Background Tasks for Extracts](https://help.tableau.com/v0.0/server-linux/en-us/adminview_backgrnd.htm) administrative view to see your refresh and backup task schedules. Your refresh tasks should be scheduled for off-peak hours that don't overlap with your backup window. **Look at caching**: Caching helps Tableau Server respond to client requests quickly, especially for views that connect to live databases. Use the [tsm data-access caching list](https://help.tableau.com/v0.0/server-linux/en-us/cli_data-access.htm#caching-list) command to confirm the caching frequency is set to `low` (this is the default). Tableau Server uses a query cache to store query results. The size of the query cache is automatically set based on the amount of available system memory, as long as you have not set it manually. The query cache consists of the logical query cache, the metadata cache, and the native query cache. The default settings are suitable for most situations but it is possible to manually configure them using the TSM command line interface. The TSM settings are: `native_api.InitializeQueryCacheSizeBasedOnWeights`, `native_api.QueryCacheMaxAllowedMB`, `native_api.LogicalQueryCacheMaxAllowedWeight`, `native_api.MetadataQueryCachMaxAllowedWeight`, `native_api.NativeQueryCacheMaxAllowedWeight`, and `native_api.QueryCacheEntryMaxAllowedInPercent`. For more information, see [native\_api.InitializeQueryCacheSizeBasedOnWeights](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#querycachesizeadaptiveinit). **Consider changing two session memory settings**: - **VizQL session timeout limit**: The default VizQL session timeout limit is 30 minutes. Even if a VizQL session is idle, it is still consuming memory and CPU cycles. If you can make do with a lower limit, use [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm) to change the `vizqlserver.session.expiry.timeout` setting. - **VizQL clear session**: By default, VizQL sessions are kept in memory even when a user navigates away from a view. This reduces the need to rebuild views but consumes more session memory. To free up memory, you can end sessions when users leave views by changing the value of the `vizqlserver.clear_session_on_unload` setting to `true`. (Regardless of this setting, sessions for the Tableau Mobile app are always kept in memory, improving mobile performance.) **Assess your process configuration**: Tableau Server is divided into six different components called server processes. While their default configuration is designed to work for a broad range of scenarios, you can also reconfigure them to achieve different performance goals. Specifically, you can control on which computers the processes run and how many are run. See [Performance Tuning](https://help.tableau.com/v0.0/server-linux/en-us/perf_tuning.htm) for general guidelines for one-, two-, and three-node deployments. ## Server Resource Manager (SRM) The Server Resource Manager (SRM) monitors the system resources each Tableau process is using as well as tracking the total usage of Tableau Server on the system. If either a specific process or the product as a whole takes up too much system resources, SRM can notify the processes to free the resources or restart those processes. The thresholds that determine when SRM will notify or restart a process are set in the SRM configuration options. The Tableau development team has set the default settings based on internal testing and don’t recommend you change these settings directly. If you are seeing excessive system resource usage, we recommend that you contact Tableau Support to help determine if these configuration options need to be modified to solve the problem or issue that you are seeing. [Skip to main content](#main-content) # Get a Ticket from Tableau Server After you’ve [added trusted IP addresses](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_trustIP.htm) to Tableau Server, you’re ready to configure your web server to get tickets from Tableau Server via POST requests ([Step 2 in the diagram](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth.htm)). The POST request must be sent to `http:///trusted`. For example, the POST request must be sent to `http://tabserv/trusted` not `http://tabserv`. **Note:** If SSL is enabled you must use https instead of http. For example: `https://tabserv/trusted`. Here’s the data you can use in a POST request to Tableau Server: - **`username=`** (required): The username for a licensed Tableau Server user. If you are using Local Authentication the username can be a simple string (for example, `username=jsmith`). If you are using Active Directory with multiple domains you must include the domain name with the user name (for example, `username=MyCo\jsmith`). - **`target_site=`** (required if view not on Default site): Specifies the site containing the view if Tableau Server is running [multiple sites](https://help.tableau.com/v0.0/server-linux/en-us/sites.htm) and the view is on a site other than the Default site (for example, `target_site=Sales`). The value you use for `` should be the [Site ID](https://help.tableau.com/v0.0/server-linux/en-us/sites_add.htm) that was provided when the site was created. This value is case sensitive. If the Site ID is `SAles`, then the `target_site=SAles`. - **`client_ip=`** (optional): Used to specifiy the IP address of the computer whose web browser is accessing the view (for example, `client_ip=123.45.67.891`). It is not the IP address of the web server making the POST request of Tableau Server. If you decide to use this parameter, see [Optional: Configure Client IP Matching](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_optional.htm) for more information. Tableau Server’s response to the POST request will be a unique string (the ticket). If Tableau Server isn’t able to process the request, the return will be `-1`. See [Ticket Value of -1 Returned from Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_trouble_1return.htm) for tips on how to correct this. Also, in order for users to successfully authenticate when they click an embedded view, their browsers must be configured to [allow third-party cookies](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_trouble_cookie.htm). The ticket format changed in Tableau Server 10.2. The ticket format is now a string composed of two parts. Each part is a 128 bit string that is encoded before it is returned to the client. The first part is a universally unique ID (UUID v4) that is Base64-encoded. The second part is a 24-character secure random string. The concatenation of these parts can be expressed as Base64(UUIDv4):SecureRandomString. An example of a ticket might look like this: `9D1ObyqDQmSIOyQpKdy4Sw==:dg62gCsSE0QRArXNTOp6mlJ5`. Next, you need to add code that allows the web server to [construct an URL](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_webURL.htm) for the view that includes the view’s location and the ticket. [Skip to main content](#main-content) # Get Eventing Status After you have enabled Tableau Catalog (or the Tableau Metadata API) in your Tableau Server environment, you can use the Eventing API to gauge indexing performance. The steps described below must be performed by a server admin. ## Step 1: Authenticate using the REST API To access the Eventing API, you must first authenticate against Tableau Server and get a token. You can do this using the Tableau REST API. For more information, see [Signing In and Signing Out (Authentication)](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm) in the REST API Help. Alternatively, you can sign in to Tableau Server using your admin credentials. ## Step 2: Make a GET request Make the following GET request or paste the URL into your browser: http://my\_tableau\_server/api/metadata/v1/control/eventing/status ### Status values from the response The following values are returned by the Eventing API. - `contentType` is the content type that was most recently indexed. - `queueSize` is the number of items in the indexing queue. The larger the queue size, the longer it can take for items to show in Catalog or Metadata API. If the queue size increases over time, you might need to adjust backgrounder capacity to support the non-interactive containers and indexing process. For more information, see [Memory for non-interactive microservice containers](https://help.tableau.com/v0.0/server-linux/en-us/dm_catalog_enable.htm#Memory). - `checkpointCreatedTime` is the last recorded time, in UTC, an item was indexed. The Eventing API checks for the last indexed item every five minutes. ### Example response The request returns JSON text. To view the JSON in a more readable format, you can use a JSON viewer or browser add-on. { "contentType": "PublishedDatasource", "queueSize": 312, "checkpointCreatedTime": "2020-07-29T23:50:25.763Z" } [Skip to main content](#main-content) # Get Initial Ingestion Status After enabling the Tableau Metadata API using the `tsm maintenance metadata-services` command, you can use the Backfill API to monitor progress of initial ingestion and get status information for content and lineage backfills. The steps described below must be performed by a server admin and recommended to be used in conjunction with [Step 7: Monitor initial ingestion progress and validate its status](https://help.tableau.com/v0.0/server-linux/en-us/dm_catalog_enable.htm#step7) in the Enable Tableau Catalog topic. ## Step 1: Authenticate using the REST API To access the Backfill API, you must first authenticate against Tableau Server and get a token. You can do this using the Tableau REST API. For more information, see [Signing In and Signing Out (Authentication)](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm) in the REST API Help. Alternatively, you can sign in to Tableau Server using your admin credentials. ## Step 2: Make a GET request Make the following GET request or paste the URL into your browser: http://my\_tableau\_server/api/metadata/v1/control/backfill/status The request initially returns information about content backfill. When content backfill is complete, lineage backfill information is returned. - For content backfill, the request returns a status summary and additional status information for each content type depending on what content is available on Tableau Server. Indexing for each content type happens concurrently. - For lineage backfill, the request returns a status summary. ### Status values from the response The following values are returned by the Backfill API. - `contentBackfillTotalDurationSeconds` and `lineageBackfillTotalDurationSeconds` is how much time has progressed, in seconds, on the respective backfill type. When `backfillComplete` is `true`, `contentBackfillTotalDurationSeconds` and `lineageBackfillTotalDurationSeconds` is the total time spent to complete the respective backfill type. For content backfill: - `contentType` can show the following content types: `PublishedDatasource`, `Database`, `DatabaseTable`, `Metric`, `Workbook`, and `Flow`. - `contentId` is the identifier of the last indexed item. - `successfullyIngestedCount` is the number of items successfully indexed. - `failedIngestedCount` is the number of items that could not be indexed. - `durationSeconds` is the time spent, in seconds, to index items for the content type. - `totalCount` is the total number of items to index. - `checkpointCreatedTime` is the last recorded time, in UTC, an item was indexed. The Backfill API checks for the last indexed item every five minutes. - `backfillComplete` is `true` when indexing is complete for all items of the content type. For lineage backfill: - `totalCount` is the total number of lineage relationships to index. - `processedCount` is the number of indexed lineage relationships. - `lastLineageConnection` is the last indexed lineage relationship. - `backfillComplete` is `true` when indexing is complete for all lineage relationships. ### Example response The request returns JSON text. To view the JSON in a more readable format, you can use a JSON viewer or browser add-on. { "contentBackfillTotalDurationSeconds": 362, "lineageBackfillTotalDurationSeconds": 14, "contentBackfillStatuses": \[ { "contentType": "PublishedDatasource", "contentId": "sites/1/datasources/-631379806-1912815680", "successfullyIngestedCount": 20, "failedToIngestCount": 0, "durationSeconds": 312, "totalCount": 20, "checkpointCreatedTime": "2020-07-29T23:50:25.763Z", "backfillComplete": true }, { "contentType": "Database", "contentId": "sites/1/databases/e1331f9d-4d73-ee04-9edf-96fd1c37cb8e", "successfullyIngestedCount": 35, "failedToIngestCount": 0, "durationSeconds": 26, "totalCount": 35, "checkpointCreatedTime": "2020-04-29T23:50:25.769Z", "backfillComplete": true }, { "contentType": "DatabaseTable", "contentId": "sites/1/tables/d946d084-53a8-09b6-2ad2-93301e6b4b15", "successfullyIngestedCount": 64, "failedToIngestCount": 0, "durationSeconds": 49, "totalCount": 64, "checkpointCreatedTime": "2020-04-29T23:50:25.774Z", "backfillComplete": true }, { "contentType": "Metric", "contentId": "sites/1/metrics/metric1", "successfullyIngestedCount": 2, "failedToIngestCount": 0, "durationSeconds": 254, "totalCount": 2, "checkpointCreatedTime": "2020-04-29T23:50:25.779Z", "backfillComplete": true }, { "contentType": "Workbook", "contentId": "sites/1/workbooks/6749399-1501801290", "successfullyIngestedCount": 10, "failedToIngestCount": 0, "durationSeconds": 267, "totalCount": 10, "checkpointCreatedTime": "2020-04-29T23:50:25.784Z", "backfillComplete": true }, { "contentType": "Flow", "contentId": "sites/1/flows/4", "successfullyIngestedCount": 4, "failedToIngestCount": 0, "durationSeconds": 195, "totalCount": 4, "checkpointCreatedTime": "2020-04-29T23:50:25.788Z", "backfillComplete": true } \], "lineageBackfillStatus": { "totalCount": 45, "processedCount": 18, "lastLineageConnection": "CloudFile downstreamWorkbooks Workbook", "backfillComplete": false } } [Skip to main content](#main-content) # Get Process Status as XML To get a machine-readable version of the server process status, that is, a version of the status formatted in XML, use the following URL: http://my\_tableau\_server/admin/systeminfo.xml You must be signed in to Tableau Server to view the machine-readable process status, or have [enabled remote access](https://help.tableau.com/v0.0/server-linux/en-us/service_remote.htm). The server returns a status report similar to the following: ## Status values in the XML - worker \- The name of the node running the process and the port the process is using. - status \- The status of the process on the node. Possible values are: `Active`, `Passive`, `Unlicensed`, `Busy`, `Down`, `ReadOnly`, `ActiveSyncing`, `StatusNotAvailable`, `StatusNotAvailableSyncing`, `NotAvailable`, `DecommisionedReadOnly`, `DecomisioningReadOnly`, and `DecommissionFailedReadOnly` - pendingTransfers - A count of the workbook or data source extracts the node needs to get to be fully synced. These represent items that were published to this file store node, and items that were published to other file store nodes and need to be copied to this node. - failedTransfers - A count of the workbooks or data sources that did not transfer successfully to this file store node during the last automated job. The automated job normally runs about every 15 to 30 minutes, but may take longer when transferring a large number of extracts or large extracts. Failed transfers do not necessarily indicate a problem with Tableau Server. The recurring automated job will normally transfer files that failed during the previous sync. Reasons for failed file transfers are listed in the logs. - syncTimestamp - The time in UTC of the last automated job that ran and synchronized files. [Skip to main content](#main-content) # Get Started with Explain Data Use Explain Data in your flow of analysis as you are exploring the marks in a viz. Explain Data runs automatically when the Data Guide pane is open and updates based on the current selection (dashboard, sheet, or mark).

Use Explain Data

Run Explain Data on a dashboard, sheet, or mark
Drill into explanations
View analyzed fields
Terms and concepts in explanations
Explanation Types

Author Workbooks and Control Access

## Run Explain Data on a dashboard, sheet, or mark These are the basic steps to run Explain Data in Tableau Desktop, Tableau Cloud, and Tableau Server: 1. Open a dashboard or sheet in a workbook. 2. In the view toolbar, select Data Guide ![Data Guide icon](/tableau/next/en-us/server-linux/en-us/Img/data_guide_icon.png) to open the Data Guide pane. 3. If you open a dashboard, Explain Data will analyze it for outliers. ![Detected Outliers showing in the Data Guide for a dashboard](/tableau/next/en-us/server-linux/en-us/Img/explaindata_dg_dashboard.png) If you select a sheet in the dashboard, Explain Data analyzes the marks in that sheet for outliers. ![Explain Data detailed explanation for a selected sheet.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_dg_sheet.png) If you select a mark in the dashboard, Explain Data specifically analyzes that mark for explanations. ![Explain Data detailed explanation for a selected mark.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_dg_mark.png) The marks that are being explained are highlighted in the viz as you select corresponding explanations. Optionally, you can select a mark in a viz, hover the cursor over the mark. In the tooltip menu, select **Data Guide** ![Data Guide icon](/tableau/next/en-us/server-linux/en-us/Img/data_guide_icon.png). ![Image of mark tooltip with Data Guide icon selected](/tableau/next/en-us/server-linux/en-us/Img/explaindata_tooltip_dg2.png) In Tableau Public, select the lightbulb in the tooltip menu to run Explain Data. ![Click the lightbulb icon in a mark tooltip menu to run Explain Data.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_tooltip_button.png) Possible explanations for the value of the analyzed mark are displayed in the Data Guide pane. Select different explanation names to expand the details and start exploring. ### Explain Data permissions required for seeing explanations If you see Detected Outliers with a note to contact the owner of the viz, it is because you need permission to see these types of explanations. Select the owner name to go to their Tableau content page with their email address. Contact the owner to ask them to give you Explain Data permissions for the workbook or view. If you are the owner of the workbook, for more information on setting permissions, see [Control who can use Explain Data and what they can see](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_control_access.htm#Control). ### Tips for using Explain Data - Multiple marks can't be selected for comparison with each other. - The view must contain marks that are aggregated using SUM, AVG, COUNT, COUNTD, or AGG (a calculated field). - When Explain Data cannot analyze the type of mark selected, a message is displayed to indicate why. For more information, see [Situations where Explain Data is not available](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_requirements.htm#NotAvailable). - The data you analyze must be drawn from a single, primary data source. Explain Data does not work with blended or cube data sources. - For information on what characteristics make a data source more interesting for use with Explain Data, see [Requirements and Considerations for Using Explain Data](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_requirements.htm). ## Drill into explanations 1. In the Data Guide pane, select an explanation name to see more details. Select an explanation to expand or contract its details. 2. Scroll to see more explanation details. 3. Hover over charts in the explanations to see details on different data points. Select the Open ![Open View icon.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_openviewicon.png) icon to see a larger version of the visualization. Creators or Explorers who open the view for editing can select the Open ![Open View icon.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_openviewicon.png) icon to open the visualization as a new worksheet and explore the data further. **Note**: Creators and Explorers who have editing permissions can also control Explain Data Settings. For more information, see [Control Access to Explain Data](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_control_access.htm). 4. Hover over a Help icon ![Explain Data Help icon.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_helpicon.png) to see tooltip help for an explanation. Select the Help icon ![Explain Data Help icon.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_helpicon.png) to keep the tooltip open. Select a **Learn More** link to open the related help topic. ## View analyzed fields 1. [Run Explain Data on a dashboard, sheet, or mark](#RunExD). 2. In the Data Guide pane, under **Explore underlying values for**, select a target measure name. ![Explain Data details about an analyzed mark, with text highlighted that describes a higher than expected trip distance sum value of 8,800.](/tableau/next/en-us/server-linux/en-us/Img/explaindata_viewfields1.png) 3. Select the _number-of-fields_ link at the bottom of the pane. ![Explain Data details about an analyzed mark, with text highlighted that reads "14 of 23 fields".](/tableau/next/en-us/server-linux/en-us/Img/explaindata_viewfields2.png) Authors have the option to open Explain Data Settings to control which fields are included in the analysis. For more information, see [Change fields used for statistical analysis](https://help.tableau.com/v0.0/server-linux/en-us/explain_data_lm_status.htm#IncludeExcludeFields). ## Terms and concepts in explanations The following terms and concepts appear frequently in explanations. You may find it helpful to become acquainted with their meaning in the context of using Explain Data. What is a mark? A mark is a selectable data point that summarizes some underlying record values in your data. A mark can be made of a single record or multiple records aggregated together. Marks in Tableau can be displayed in many different ways such as lines, shapes, bars, and cell text. Tableau gets the records that make up the mark based on the intersection of the fields in the view. The **analyzed mark** refers to a mark in a dashboard or sheet that was analyzed by Explain Data. For more information on marks, see [Marks](https://help.tableau.com/current/pro/desktop/en-us/view_parts.htm#Marks). What does expected mean? The expected value for a mark is the median value in the expected range of values in the underlying data in your viz. The expected range is the range of values between the 15th and 85th percentile that the statistical model predicts for the analyzed mark. Tableau determines the expected range each time it runs a statistical analysis on a selected mark. If an expected value summary says the mark is _lower than expected_ or _higher than expected_, it means the aggregated mark value is outside the range of values that a statistical model is predicting for the mark. If an expected value summary says the mark is _slightly lower_ or _slightly higher_ than expected or _within the range of natural variation_, it means the aggregated mark value is within the range of predicted mark values, but is lower or higher than the median. For more information, see [What is an expected range?](https://help.tableau.com/current/pro/desktop/en-us/explain_data_explained.htm#ExpectedRangeLM) What are dimensions and measures? Each column name in a database is a field. For example, Product Name and Sales are each fields. In Tableau, fields like Product Name that categorize data are called dimensions; fields with quantifiable data like Sales are called measures. Tableau aggregates measures by default when you drag them into a view. Some explanations describe how the underlying record values and the aggregations of those values may be contributing to the value of the analyzed mark. Other explanations may mention the distribution of values across a dimension for the analyzed mark. When you run Explain Data on mark, the analysis considers dimensions and measures in the data source that aren't represented in the view. These fields are referred to as unvisualized dimensions and unvisualized measures. For more information on dimensions and measures, see [Dimensions and Measures](https://help.tableau.com/current/pro/desktop/en-us/datafields_typesandroles.htm). What is an aggregate or aggregation? An aggregate is a value that is a summary or total. Tableau automatically applies aggregations such as SUM or AVG whenever you drag a measure onto Rows, Columns, a Marks card option, or the view. For example, measures are displayed as SUM(Sales) or AVG(Sales) to indicate how the measure is being aggregated. To use Explain Data, your visualization must use a measure that is aggregated with SUM, AVG, COUNT, COUNTD, or AGG. For more information about aggregation, see [Data Aggregation in Tableau](https://help.tableau.com/current/pro/desktop/en-us/calculations_aggregation.htm). What is a record value? A record is a row in a database table. A row contains values that correspond to each field. In this example, Category, Product Name, and Sales are fields (or columns). Furniture, Floor Lamp, and $96 are the values.

Category	Product Name	Sales
Furniture	Floor Lamp	$96.00

What is a distribution? A distribution is a list of all the possible values (or intervals) of the data. It also indicates how often each value occurs (frequency of occurrence). [Skip to main content](#main-content) # Get Started with Tableau Server on Linux Looking for Tableau Server on Windows? See [Get Started with Tableau Server](https://help.tableau.com/current/server/en-us/get_started_server.htm "Opens topic in a new browser tab"). For a brief overview, watch the [Getting Started with Tableau Cloud and Tableau Server](https://www.tableau.com/learn/tutorials/on-demand/getting-started-tableau-cloudserver?playlist=509087) training video (2 mins). ## Plan ![Add description of the image](/tableau/next/en-us/server-linux/en-us/Img/Help_Spot_GetStarted_big.png) - [Tableau Blueprint](https://help.tableau.com/current/blueprint/en-us/bp_overview.htm) - [Server administrator overview](https://help.tableau.com/v0.0/server-linux/en-us/admin.htm) - [Before you install...](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm) - [Infrastructure planning](https://help.tableau.com/v0.0/server-linux/en-us/server_infrastructure_planning.htm) - [more](https://help.tableau.com/v0.0/server-linux/en-us/plan.htm) ## Deploy ![Deploy Tableau Server.](/tableau/next/en-us/server-linux/en-us/Img/Help_Spot_InstallConfigure_big.png) - [Jump-start installation](https://help.tableau.com/v0.0/server-linux/en-us/jumpstart.htm) - [Install and configure Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/install_config_top.htm) - [Install drivers](https://www.tableau.com/support/drivers) - [Tableau Server Enterprise Deployment Guide](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_intro.htm) - [more](https://help.tableau.com/v0.0/server-linux/en-us/install.htm) ## Migrate and Upgrade ![Migrating Tableau Server and upgrading to new versions of Tableau Server](/tableau/next/en-us/server-linux/en-us/Img/Help_Spot_Migrate_big.png) - [Technical Considerations for Migrating from Tableau Server to Tableau Cloud](https://help.tableau.com/v0.0/server-linux/en-us/migrate_server_to_cloud_overview.htm) - [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) - [Upgrade](https://help.tableau.com/v0.0/server-linux/en-us/upgrade.htm) - [more](https://help.tableau.com/v0.0/server-linux/en-us/migrate.htm) ## Deploy Client Software ![Deploy Tableau mobile and desktop](/tableau/next/en-us/server-linux/en-us/Img/Help_Spot_Deploy_big.png) - [Tableau Desktop and Tableau Prep deployment guide](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_welcome.htm) - [Tableau Mobile deployment](https://help.tableau.com/current/mobile/mobile-admin/en-us/admin_mobile_intro.htm) - [more](https://help.tableau.com/v0.0/server-linux/en-us/install.htm) ## Manage Server ![Server management.](/tableau/next/en-us/server-linux/en-us/Img/Help_Spot_ManageServer_big.png) - [TSM command line reference](https://help.tableau.com/v0.0/server-linux/en-us/tsm.htm) - [Extract refresh schedules](https://help.tableau.com/v0.0/server-linux/en-us/publish.htm) - [Add or update sites](https://help.tableau.com/v0.0/server-linux/en-us/sites_add.htm) - [Add users to the server](https://help.tableau.com/v0.0/server-linux/en-us/users_add.htm) - [more](https://help.tableau.com/v0.0/server-linux/en-us/manage_server.htm) ## Manage Sites ![Sites!](/tableau/next/en-us/server-linux/en-us/Img/Help_Spot_ManageSites_big.png) - [What is a site](https://help.tableau.com/v0.0/server-linux/en-us/sites.htm) - [Manage users and groups](https://help.tableau.com/v0.0/server-linux/en-us/users.htm) - [Manage content access](https://help.tableau.com/v0.0/server-linux/en-us/permissions_section.htm) - [Manage data](https://help.tableau.com/v0.0/server-linux/en-us/manage_data_section.htm) - [more](https://help.tableau.com/v0.0/server-linux/en-us/manage_site.htm) ## Automate and Extend ![Rest API, WDC, developer](/tableau/next/en-us/server-linux/en-us/Img/Help_Spot_Embed_big.png) - [Tableau tools and samples on GitHub](https://tableau.github.io/) - [REST API](https://help.tableau.com/current/api/rest_api/en-us/help.htm) - [Web Data Connector (wdc)](https://tableau.github.io/webdataconnector/docs/) - [Dashboard extensions](https://help.tableau.com/v0.0/server-linux/en-us/dashboard_extensions_server.htm) - [more](https://www.tableau.com/developer) ## Related Products ![Extras](/tableau/next/en-us/server-linux/en-us/Img/Help_Spot_Addon_big.png) - [Tableau Advanced Management](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm) - [Data Management](https://help.tableau.com/v0.0/server-linux/en-us/dm_overview.htm) ## Other articles in this section [Skip to main content](#main-content) # Get Started with Tableau Resource Monitoring Tool This article will help you get started with Tableau Resource Monitoring Tool. It contains links to other articles about information you need to prepare before installing Resource Monitoring Tool, links to upgrade and other useful resources. In an effort to align with our company values of Equality, we have changed non-inclusive terminology where possible. Because changing terms in certain places can causing a breaking change, we maintain the existing terminology. So, you may continue to see the terms in CLI commands and options, installation folders, configuration files. and other instances. For more information, see [About Tableau Help](https://help.tableau.com/current/tableau/en-us/about-tableau-help.htm). ## Pre-Installation ### Product Compatibility with Tableau Server The Resource Monitoring Tool can be installed to monitor supported Tableau Server versions. The table below lists the version compatibility between Resource Monitoring Tool(RMT) and Tableau Server:

RMT Version	OS support	Tableau Server Version
2026.2.x	Windows, Linux	2024.2.x, 2024.3.x, 2025.1.x, 2025.2.x, 2025.3.x, 2026.1.x, 2026.2.x
2026.1.x	Windows, Linux	2024.1.x, 2024.2.x, 2024.3.x, 2025.1.x, 2025.2.x, 2025.3.x, 2026.1.x
2025.3.x	Windows, Linux	2022.3.x, 2023.1.x, 2023.3.x, 2024.2.x, 2025.1.x, 2025.3.x
2025.1.x, 2025.2.x	Windows, Linux	2022.3.x, 2023.1.x, 2023.3.x, 2024.2.x, 2025.1.x
2024.2.x	Windows, Linux	2022.3.x, 2023.1.x, 2023.3.x, 2024.2.x
2023.3.x	Windows, Linux	2022.3.x, 2023.1.x, 2023.3.x
2023.1.x	Windows, Linux	2022.3.x, 2023.1.x
2022.3.x	Windows, Linux	2022.3.x

### Resource Monitoring Tool Server (RMT Server) and Agent Compatibility Generally, we recommend that you install the same version of RMT Server and Agent to be sure that they are compatible. If you have Agents using versions not compatible with the RMT Server version, a critical incident is logged. For more information, see [Agent Incidents](https://help.tableau.com/v0.0/server-linux/en-us/rmt-incidents-agents-unlicensed.htm). ### Concepts and Terms Get familiar with the concepts and terms used in the Resource Monitoring Tool topics. For more information, see [Concepts](https://help.tableau.com/v0.0/server-linux/en-us/rmt-concepts.htm). ### Setup Architecture The Resource Monitoring Tool has two main components: Resource Monitoring Tool Server (RMT Server) and Agent. The RMT Server should be installed on its own machine, and the Agent is installed on each node of your Tableau Server Cluster. For a more details about the setup architecture, see [Install the Tableau Resource Monitoring Tool](https://help.tableau.com/v0.0/server-linux/en-us/rmt-admin-installation.htm). A high level view of the Resource Monitoring Tool setup. This diagram shows a three node Tableau Server Cluster. ![Diagram illustrating the relationships between a master server and Tableau server clusters for both production and development/testing.](/tableau/next/en-us/server-linux/en-us/Img/rmt-setup-architecture.png) ### Minimum Hardware Requirements and Recommendations for Resource Monitoring Tool Resource Monitoring Tool handles all of the processing, aggregation, storage, and web interface to the monitoring data collected from your Tableau Server installation. For production use, the machine you install Resource Monitoring Tool on should meet or exceed the minimum hardware recommendations. For more details, see [Minimum Hardware Requirements and Recommendations for Tableau Resource Monitoring Tool](https://help.tableau.com/v0.0/server-linux/en-us/rmt-min-hardware-req.htm). ### Pre-Installation Checklist for Resource Monitoring Tool Before you install Resource Monitoring Tool, review these action items and complete any necessary steps: [Pre-Installation Checklist - Tableau Resource Monitoring Tool](https://help.tableau.com/v0.0/server-linux/en-us/rmt-install-checklist.htm) ## Troubleshoot Be sure to check our [Troubleshoot Tableau Resource Monitoring Tool Issues](https://help.tableau.com/v0.0/server-linux/en-us/rmt-faq.htm) for answers to common questions before contacting support. ## Other articles in this section [Skip to main content](#main-content) # Getting Started with Tableau Content Migration Tool This article will help you get started with the Tableau Content Migration Tool. It contains links to other articles about information you need to prepare before installing the Content Migration Tool, and steps to design a migration plan and upgrade existing installations. ## Pre-installation ### Installation requirements The Content Migration Tool can only be installed on Windows operating systems. Before installing, you must be able to connect to the Tableau source site (the site you are migrating from) and the destination site (the site you are migrating to) from the computer where Content Migration Tool is installed. Both the source and destination sites must have a valid [Advanced Management](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm) license. For more information about installing and upgrading Content Migration Tool, see [Install Tableau Content Migration Tool](https://help.tableau.com/v0.0/server-linux/en-us/cmt-install.htm). ### Compatibility with Tableau Server The Content Migration Tool supports content migration for Tableau Server versions 2019.3 and later. The table lists compatible versions of Tableau Server based on the installed version of Content Migration Tool. | CMT Version | Tableau Server Version | | --- | --- | | 2025.2x | 2023.3x - 2025.1.x | | 2025.1x | 2023.3x - 2025.1.x | | 2024.3x | 2022.3x - 2024.2.x | | 2024.2x | 2022.3x - 2024.2.x | | 2024.1x | 2022.1x - 2024.1.x | | 2023.3.x | 2021.4.x - 2023.3.x | | 2023.2.x | 2021.3.x - 2023.2.x | | 2023.1.x | 2021.2.x - 2023.1.x | | 2022.4.x | 2021.1.x - 2022.4.x | | 2022.3.x | 2020.4.x - 2022.3.x | | 2022.2.x | 2020.3.x - 2022.2.x | | 2022.1.x | 2020.2.x - 2022.1.x | | 2021.4.x | 2020.1.x - 2021.4.x | | 2021.3.x | 2019.4.x - 2021.3.x | | 2021.2.x | 2019.3.x - 2021.2.x | | 2021.1.x | 2019.3.x - 2021.1.x | | 2020.4.x | 2019.3.x - 2020.4.x | | 2020.3.x | 2019.3.x - 2020.3.x | ### Compatibility with Tableau Cloud Content Migration Tool version 2022.2.1 and later support content migration for all Tableau Cloud deployments. We recommend installing the most recent version from the [Tableau Advanced Management](https://www.tableau.com/support/releases/advanced-management) downloads page to take advantage of the latest features and fixes. ### Compatibility with Tableau content The Content Migration Tool supports migrating workbooks and published data sources saved in the eight most recent versions of Tableau. While you can migrate existing data sources, only data sources that use the connection types in the table below can be changed and modified during migration. For more information, see Data Source Transformations in [Migration Plans: Workbooks](https://help.tableau.com/v0.0/server-linux/en-us/cmt-plan_workbooks.htm) and [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/server-linux/en-us/cmt-plan_datasources.htm).

Actian Matrix

Actian Vectorwise

Amazon Athena

Amazon Aurora

Amazon EMR

Amazon Redshift

Apache Drill

Aster Database

Box

Cloudera Hadoop

Delimited Text File

EXASOL

Firebird

Google Analytics

Google BigQuery

Google Cloud SQL

Google Drive

HortonWorks Hadoop Hive

HP Vertica

IBM DB2

IBM Netezza

Map R Hadoop Hive

Microsoft Access

Microsoft Analysis Services

Microsoft Excel

Microsoft Excel Direct

Microsoft OneDrive

Microsoft SQL Server

MySQL

OData

Oracle

Oracle Essbase

Pivotal Greenplum Database

PostgreSQL

Progress OpenEdge

Salesforce

SAP HANA

SAP Sybase ASE

SAP Sybase IQ

Snowflake

Spark SQL

Statistical File

Tableau Extract

Tableau Published Data Source

Teradata

Text File

Web Data Connector

Other Databases (ODBC)

## Post-installation ### Limitations when migrating content Before you start, make sure you understand the limitations when migrating content using the Content Migration Tool. For more information, see [Migration Limitations](https://help.tableau.com/v0.0/server-linux/en-us/cmt-migration_limitations.htm). ### Create a migration plan The Content Migration Tool walks you through migrating content across projects on a single site, to a new site on the same Tableau Server instance, and to sites that exist on different Tableau Server instances. The plan you create can be saved and used again for future migrations. For more information, see [Migration Plan Overview](https://help.tableau.com/v0.0/server-linux/en-us/cmt-depl_plan_overview.htm). [Skip to main content](#main-content) # Grant License on Sign In Grant license on sign in (Grant role on sign in) lets unlicensed users in specific groups become licensed when they sign into a Tableau site. This streamlines license provisioning for administrators and removes the user’s need to request a license before using Tableau. For more information about site role capabilities and minimum site roles, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/server-linux/en-us/users_site_roles.htm). For example, imagine an Active Directory group called Marketing with 100 users, but only 25 users need to access Tableau Server. A site or server administrator can import all users in the Marketing Active Directory group, set the group's minimum site role to Explorer, and select Grant role on sign in. When any of the Tableau users in Marketing sign into their Tableau site, they'll be granted Explorer licenses. Users who don't need Tableau Server remain unlicensed unless they sign in. **Note**: For more information about benefits and best practices, see [Grant Role on Sign In](https://help.tableau.com/current/blueprint/en-us/bp_license_management.htm#grant-role-on-sign-in) in Tableau Blueprint, Tableau's planning tool for data-driven organizations. ## Activate Grant role on sign in You can enable Grant role on sign in on new or existing groups. The following steps walk through how to use Grant role on sign in to add new users that are eligible for a license but may not consume one. This may be the case when your company has a lot of eligible users, but limited Tableau licenses. 1. On a site, click Groups, and then click Add Group. Add new users by importing an Active Directory group. Type the name of the group you want to import, and then select the group name in the resulting list. ![Dialog for importing a group from Active Directory.](/tableau/next/en-us/server-linux/en-us/Img/import_AD_group1.png) 2. Select the minimum site role for the users, and select Grant role on sign in. All users in the selected Active Directory group will be imported as unlicensed users. The minimum site role set for the group will only be provisioned to group users who sign into Tableau Server. ![Dialog for importing a group from Active Directory with the Site role dropdown expanded and the Site Administrator Explorer selected.](/tableau/next/en-us/server-linux/en-us/Img/import_AD_group2.png) 3. Click Import. **Note:** Grant Site Role on Sign In can also be activated in local groups to provision minimum site roles to group members when they sign in to Tableau Server. For more information, see [Create a Local Group](https://help.tableau.com/v0.0/server-linux/en-us/groups_create_local.htm). ## Modifying user roles with Grant role on sign in If a user is part of a group using Grant role on sign in, then that user role can't be set to unlicensed or downgraded to a role lower than the minimum site role set for the group, whether or not they sign in. Administrators or a user with an admin profile with sufficient capabilities can upgrade a user’s site role manually, however. To downgrade a user’s site role, or unlicense the user from the site, remove the user from the group(s) that have Grant role on sign in enabled. In accordance with the terms of the [End User License Agreement](https://mkt.tableau.com/legal/tableau_eula.pdf), licenses granted on an Authorized User basis may be permanently reassigned to new users. Users may only be downgraded to a lower site role (including Unlicensed) when they will permanently discontinue access to Server Software at the higher role. ## Removing users affected by Grant role on sign in You can remove a user from a site only if the user does not own content. If you attempt to remove a user who owns content, the user site role will be set to Unlicensed and removed from all groups, but the user will not be removed from the site. To remove content owners, remove owners from group with Grant site role enabled or reassign content ownership to another user. For more information, see Remove users from a site in the [View, Manage, or Remove Users](https://help.tableau.com/v0.0/server-linux/en-us/users_view.htm) Help topic. If the default All Users group has Grant site role enabled, users who own content can't be removed from the site or unlicensed. To remove or unlicense these users, reassign content ownership to another user, then remove or unlicense the user. Tableau REST API can be used to reassign content ownership of a workbook. For more information, see [Update Workbook](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#update_workbook) method in the REST API Help. REST API can also be used to remove users from the site and transfer content ownership to another user. For more information, see [Remove User from Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#remove_user_from_site) method in the REST API Help. For more information on changing content ownership in Tableau Server, see [Manage Content Ownership](https://help.tableau.com/v0.0/server-linux/en-us/owner.htm#change-the-owner-of-a-content-resource). [Skip to main content](#main-content) # Guest User Core-based licenses of Tableau Server include a Guest user option, which you can use to let people access Tableau views without an account on the server. Guest user access is enabled by default when Tableau Server is installed with a core-based license. It is not available with user-based licensing. If you do not intend to use Guest user access, you should disable it. Guest access allows users only to see and interact with Tableau views and comments on those views. The Guest user cannot browse the Tableau Server interface or see server interface elements in the view, such as user name, account settings, and so on. For more information about licenses, see [Manage Licenses](https://help.tableau.com/v0.0/server-linux/en-us/license_manage.htm). **Tip:** To share views with Guest users, either provide URL links or embed views into web pages. For more information, [see Tableau User Help](https://help.tableau.com/current/pro/desktop/en-us/shareworkbooks.htm). ## Guest user permissions A Guest user can have the following maximum capabilities: - **Workbooks and views**: View, Export Image, Summary Data, View Comments, Filter, Full Data, Web Edit, Download (to save a local copy) - **Data sources**: View and Download If you add the Guest user to a group that has a higher level of access to a content resource, the Guest user’s access does not exceed the capabilities listed above. However, the Guest user account will comply with more restrictive permissions settings. The Guest user can only access data with embedded credentials or where credentials are not required. A data source that prompts the user for credentials cannot be accessed by the Guest user. See [Data access for published Tableau data sources](https://help.tableau.com/current/server/en-us/permissions.htm#data-access-for-published-tableau-data-sources). ## Enable or disable Guest access You must be a server administrator to change Guest account settings at either the server or the site level. **Note:** Enabling the Guest user for a site can increase the number of potential simultaneous viewers beyond the user list you might be expecting. The administrative view Status > Traffic to Views can help you gauge the activity. 1. In the site menu, click **Manage All Sites** and then click Settings \> General. 2. For Guest Access, select or clear **Enable guest access**. 3. Click **Save**. This enables the Guest user on all sites. You can then go to the same setting for a specific site. To disallow Guest access for a site: 1. In the site menu, select a site. 2. Click Settings, and on the General tab, clear the Enable guest access for this site check box. If the Guest account is enabled on some or all sites, and you turn off Guest access at the server level, it is turned off for all sites as well. Note: You can turn off Guest user access at the server or site level; however, you aren’t able to remove the user. So, although no one can access data or views without signing in to the server, the Guest user still appears in the Site Users list and group lists for groups you’ve added the Guest user to. ## Additional Guest account characteristics The Guest user is unique in the following additional ways: - As a single user account, it represents all unauthenticated users accessing Tableau views. - When enabled, it is a member of the All Users group. - You can add it as a member of other groups on a site. - You cannot edit it or select it as the owner of a content resource. - The account is not allowed to save custom views. - Guest cannot be used in a user filter. - You cannot delete the account; however, you can turn off access to it by clearing the check box described in the steps above. [Skip to main content](#main-content) # Handle an Unlicensed Server Process There are several status indicators on the Tableau Server Status page that help you understand the state of Tableau Server processes. An orange-color status box, "Unlicensed", indicates that one of the server processes is unable to retrieve the Tableau Server license information. In the image below, one of the VizQL processes is unlicensed: ![A table that shows the current state of Tableau Server processes.](/tableau/next/en-us/server-linux/en-us/Img/server_status_orange.png) There may be several reasons why a process is unable to access licensing information. For example, there may be network issues preventing a process running on an additional node from communicating with the licensing service on the initial node. Or, the unlicensed process may be getting sent more requests than it can accept at a particular moment and can’t handle the licensing request. The impact to users depends on which process is unable to confirm its license, and whether there are other instances of the process on one of the server nodes. In the case of the unlicensed VizQL process above, some users may be able to access views while others cannot. To resolve the problem, [stop](https://help.tableau.com/v0.0/server-linux/en-us/cli_stop_tsm.htm#stop), then [start](https://help.tableau.com/v0.0/server-linux/en-us/cli_start_tsm.htm#start) Tableau Server. [Skip to main content](#main-content) # Handle Extract Refresh Alerts When Tableau Server cannot complete a scheduled refresh, an alert appears to indicate that the refresh has failed. If a scheduled refresh fails five consecutive times, Tableau Server suspends the refresh. When a refresh is suspended, Tableau Server does not try to run it again until someone takes an action that attempts to correct the cause of the failure. **Note:** The number of consecutive failures for a refresh is set to five by default, but can be changed by a Tableau Server administrator, using the `backgrounder.failure_threshold_for_run_prevention` opti0n. For more information, see [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm). ![Alerts menu with three related icons.](/tableau/next/en-us/server-linux/en-us/Img/maintenance_alerts.png) You will see the Alerts menu only if an extract refresh failed and you are: - A system or site administrator - The author of the workbook or data source that couldn’t be refreshed - The author of a workbook that connects to a data source that couldn’t be refreshed When you open the Alerts menu you can see more information about the refresh failure(s): ![Details of a maintenance alert for an outdated data source.](/tableau/next/en-us/server-linux/en-us/Img/maintenance_alerts_details.png) When a Data source is listed as Embedded it means that the data source definition (which includes things like the data source credentials or the database name) is embedded, or resides, within the workbook itself, originally created in Tableau Desktop. When a data source name or workbook name is listed as the Data source (for example, Data source: sales\_data), it means that the data source is a Tableau Server data source. The data source definition resides on Tableau Server. In the Data pane on Tableau Desktop, you can determine whether the data source is on Tableau Server or is local. If the data source is on the server, a Tableau icon is displayed next to the data source name instead of a database icon : ![A menu with a highlighted option for population data.](/tableau/next/en-us/server-linux/en-us/Img/data_source_ts_icon.png) ## Resolving Extract Refresh Problems To resolve refresh issues, you can take any of these actions, based on the cause indicated in the alert: - **Errors related to access token validation or user credentials** You can resolve some extract refresh problems by clicking the Connection Details in the alert. Select the check box next to the problematic data source, click Actions > Edit Connection, and then enter the missing information. Click Save when you're done. After you update the connection information, Tableau Server restarts the refresh schedule. If you originally embedded the credentials or other data connection information when you published the workbook or data source from Tableau Desktop, you can also republish the workbook or data source. As part of the publishing process, you can choose to set a new refresh schedule. If you don't choose a new schedule, Tableau Server restarts the existing schedule. - **Errors that indicate the database was unreachable** Confirm that the database is online and that you can sign in to access the data. You can use the Try again link in the alert to restart the refresh schedule. - **Errors when using user filters or impersonation** See the [Tableau Knowledge Base](https://kb.tableau.com/articles/issue/extract-refresh-unsuccessful-when-using-user-filters). If the problem cannot be corrected by editing the data connection, you will need to resolve it in Tableau Desktop and republish the workbook. **Tip:** Administrators can edit data connections at any time on the Data Connections page, accessible from each site by clicking the Content tab and Data Connections [Skip to main content](#main-content) # Hardware Incidents _Hardware_ incidents monitor the server itself. These can be used to help identify server issues that may affect Tableau Server’s performance. You can set thresholds for the following issues: - CPU Usage - Available Memory - Memory Usage - Free Disk Space The following incidents are configured by default when you install a new Tableau Resource Monitoring Tool: - When the available disk space falls below 10 GB for 10 minutes or more a warning incident is logged, and when available disk falls below 5 GB for 10 minutes or more, a critical incident is logged. - When available memory falls below 8 GB for over 10 minutes, a warning incident is logged. - When the CPU usage for the entire server is 80% or more for 5 minutes, a warning incident is logged. **Note:** Memory related incidents are configured in binary multiples of bytes. You can configure thresholds using the RMT Server web interface or by updating the configuration file `config.json`. To set the thresholds for hardware incidents, under the **Admin** menu, select **Configuration**, and go to the **Incidents** tab. For **CPU Usage**, set the following: To set the thresholds for hardware incidents, under the **Admin** menu, select **Configuration**, and go to the **Incidents** tab.

Key	Required?	Description
Severity	Required	See Incident Severity Level.
Process	Required	The threshold applies to the entire Tableau Server or for a single process as specified.
Start Threshold	Required	The CPU usage must surpass the value specified before an incident is created and monitored. Set the percent and the duration for this threshold.
End Threshold	Optional	The CPU usage that must fall below the value specified before an incident is considered resolved.

For **Available Memory**, set the following:

Key	Required?	Description
Severity	Required	See Incident Severity Level.
Start Threshold	Required	The available memory must fall below the value specified before an incident is created and monitored. Set the percent and the duration for this threshold.
End Threshold	Optional	The available memory must be above the value specified before an incident is considered resolved.

For **Memory Usage**, set the following:

Key	Required?	Description
Severity	Required	See Incident Severity Level.
Process	Required	The threshold applies to the entire Tableau Server or for a single process as specified.
Start Threshold	Required	The memory usage must be equal to the value specified before an incident is created and monitored. Set the percent and the duration for this threshold.
End Threshold	Optional	The memory usage must be below the value specified before an incident is considered resolved.

For **Free Disk Space**, set the following:

Key	Required?	Description
Severity	Required	See Incident Severity Level.
Start Threshold	Required	The free disk space must fall below the value specified before an incident is created and monitored. Set the percent and the duration for this threshold.
End Threshold	Optional	The free disk space must be above the value specified before an incident is considered resolved.

For **Disk Queue Length**, set the following:

Key	Required?	Description
Severity	Required	See Incident Severity Level.
Start Threshold	Required	The disk queue length must be equal to the value specified before an incident is created and monitored. Set the percent and the duration for this threshold.
End Threshold	Optional	The disk queue length must be below the value specified before an incident is considered resolved.

An example `config.json` snipped defining two hardware incidents: ``` { "monitoring": { "incidents": { "triggers": [ { "counter": "DiskSpaceAvailableKB", "severity": "warning", "threshold": 1048576 }, { "counter": "ProcessorTimePercent", "severity": "warning", "threshold": 0.95, "thresholdDuration": 300000, "endThreshold": 0.90, "endThresholdDuration": 5000 } ] } } } ``` - The **DiskSpaceAvailableKB** incident will trigger a warning once the available disk space falls below 10 GB. - The **ProcessorTimePercent** incident will trigger a warning once the CPU has had at least 95% utilization for over 5 minutes. The incident will be considered resolved once the CPU is below 90% utilization for 5 seconds. The default settings may or may not meet your requirements, and can be changed based on your environment. As an example, for an environment whose identifier was “staging-environment” to trigger a warning when the available disk space falls below 2 GBs, the configuration would look like: ``` { "environments": { "staging-environment": { "monitoring": { "incidents": { "triggers": [ { "counter": "DiskSpaceAvailableKB", "severity": "warning", "threshold": 2097152 } ] } } } } } ```

Key	Data Type	Required?	Description
`counter`	String	Required	The identifier for the hardware incident to monitor. available options are: `ProcessorTimePercent` `DiskSpaceAvailableKB` `DiskQueueTotalLength` `MemoryAvailableKB` `MemoryCommittedKB`
`severity`	String	Optional	See Incident Severity Level. Default value: `Warning`
`threshold`	Number	Required	The threshold that must be surpassed before an incident is monitored.
`thresholdDuration`	Number	Optional	The amount of time in milliseconds to monitor the situation before triggering an incident. If not specified, an incident will be triggered as soon as the `threshold` is reached.
`endThreshold`	Number	Optional	The threshold that must be surpassed before an incident is considered resolved.
endThresholdDuration	Number	Optional	The amount of time in milliseconds to monitor the situation before completing the incident. If not specified, an incident will be resolved as soon as the `endThreshold` is reached. If `endThreshold` is not defined, then `threshold` is used.

## Who can do this Resource Monitoring Tool Administrator or a Resource Monitoring Tool user with **Server/Environment Management** role. [Skip to main content](#main-content) # Hardware Changes to RMT Server - Tuning PostgreSQL Database Sometimes you may need to upgrade or change hardware on the machine where RMT Server is installed. Whenever you make any hardware changes, specifically to memory and CPU, it would be beneficial to tune the underlying PostgreSQL database that is installed with the RMT Server. When you install RMTr Server, the setup program configures the PostgreSQL database to optimize the use of available hardware on the machine. Example optimizations include managing the buffer and cache size. When you change the hardware on your machine, it may affect the performance. Use the following steps to make sure the configuration is updated to reflect the change in hardware: 1. Connect to the RMT Server as a user with complete sudo access. 2. Navigate to the "master" directory and run the following command: `sudo /opt/tableau/tabrmt/master/tabrmt-master optimize` You should see a message that indicates that the configuration file has been updated. It will also state that a restart of the PostgreSQL service is required for the changes to take effect. The updates to the configuration file does not require downtime of the server. 3. Restart the PostgreSQL database. You can do this during off-work hours when the Resource Monitoring Tool is not in use. [Skip to main content](#main-content) # Tableau Server Helm Chart - Deploy **Important**: This documentation assumes a knowledge of Helm and Helm charts and does not attempt to provide detailed, prescriptive examples. It is designed for customers who are familiar with both Tableau Server and Helm and Helm charts. This topic walks you through the high level steps of deploying Tableau Server on Kubernetes using a Helm chart. ## Prerequisites Before you begin, ensure you have met the prerequisites. For more information, see [Tableau Server Helm Chart - Prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-prerequisites.htm). ### Helm Chart Download The Helm charts will be shipped as part of the Tableau Server in a Container setup tool (`tableau-server-container-setup-tool-.tar.gz`) and can be downloaded from the [Tableau Server download](http://tableau.com/support/releases/server/latest) page. After extraction, the required Helm chart files are located in the `helm/tableau` directory. ## Quick overview using a Helm chart to deploy Tableau Server **Important**: This is a basic, high-level description of deploying Tableau Server using Helm charts. It is not intended to be a complete procedure. It assumes knowledge of Helm and Helm charts. Before starting, make sure you have met the prerequisites for deploying Tableau Server using Helm charts. See [Tableau Server Helm Chart - Prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-prerequisites.htm) for details. ### Add your license key to values.yaml Edit `values.yaml` and set your license key. ### Deploy a single-node Tableau Server Deploy a single-node instance of Tableau Server by executing these commands at a prompt (substitute your release namespace for ``, for example `tableau` or `default`): helm install tableau-server ./helm/tableau-server \\ -n \\ --create-namespace \\ -f ./helm/tableau-server/values-single.yaml ### Deploy a multi-node Tableau Server Deploy a multi-node instance of Server by executing these commands at a prompt, using the same namespace convention as above: helm install tableau-server ./helm/tableau-server \\ \-n \\ \--create-namespace \\ -f ./helm/tableau-server/values-multinode.yaml ## EKS multinode runbook (namespace + static bootstrap PV) This section describes the order of operations for EKS: dedicated namespace, EFS CSI add-on, IAM on the node role, static bootstrap PV, and Helm. 1. Create a dedicated namespace. This must match `claimFef.namespace` on the bootstrap PV. This example uses `tableau`. kubectl create namespace tableau-server kubectl get namespace tableau 2. Confirm the EFS CSI add-on exists. If the add-on is missing, create it and wait until the status is `ACTIVE`: kubectl get csidriver efs.csi.aws.com aws eks describe-addon \\ --cluster-name \\ --addon-name aws-efs-csi-driver \\ --region \\ --query 'addon.status' 3. Confirm the Storageclass: `efs-bootstrap` Storageclass — apply if not already present. See [Amazon Elastic Kubernetes Service (EKS) prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-prerequisites.htm#EKS-Prereq-storageclass) for details. kubectl get csidriver efs.csi.aws.com aws eks describe-addon \\ --cluster-name \\ --addon-name aws-efs-csi-driver \\ --region \\ --query 'addon.status' 4. Confirm the Static bootstrap PV. `claimRef` must refer to the same namespace and PVC name the Helm chart creates (`tableau-server-bootstrap`). Replace `fs-...` with your EFS file system ID: cat > /tmp/tableau-bootstrap-pv.yaml <<'EOF' apiVersion: v1 kind: PersistentVolume metadata: name: tableau-bootstrap-pv spec: capacity: storage: 1Gi volumeMode: Filesystem accessModes: - ReadWriteMany persistentVolumeReclaimPolicy: Retain storageClassName: efs-bootstrap claimRef: namespace: tableau name: tableau-server-bootstrap csi: driver: efs.csi.aws.com volumeHandle: EOF kubectl apply -f /tmp/tableau-bootstrap-pv.yaml kubectl get pv tableau-bootstrap-pv 5. IAM on the node instance role. Attach EFS client and EC2 read-only policies. See [Amazon Elastic Kubernetes Service (EKS) prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-prerequisites.htm#EKS-Prereq-storageclass) for resolving `` from the node group. `efs-bootstrap` Storageclass — apply if not already present. See [Amazon Elastic Kubernetes Service (EKS) prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-prerequisites.htm#EKS-Prereq-storageclass) for details. kubectl get csidriver efs.csi.aws.com aws eks describe-addon \\ --cluster-name \\ --addon-name aws-efs-csi-driver \\ --region \\ --query 'addon.status' 6. Values In `values-multinode.yaml` (or an overlay), set manual static PV mode persistence: bootstrap: createPV: false volumeName: tableau-bootstrap-pv storageClass: efs-bootstrap 7. Ensure `image.repository`, `image.tag`, and secrets/license are set as required. 8. Install the Helm chart Install the chart into the same namespace as the PV `claimRef`: helm install tableau-server ./helm/tableau-server \\ -n tableau \\ -f ./helm/tableau-server/values-multinode.yaml 9. Verify storage and pods: kubectl get pv,pvc -n tableau kubectl get pods -n tableau -w 10. Data PVC status Data PVCs may show `Pending` briefly until EBS volumes attach. All PVCs should transition to `Bound`, then `Running`, and eventually `READY 1/1`. 11. Topology (optional) If the post-install hook is disabled, you may need to set node `clustercontroller` and apply pending changes (see Post-Install Topology Automation (Hook) later in this document). The `tsm pending-changes apply` command may result in warnings about Index and Search Server distribution or the Coordination Service ensemble when you have multiple Tableau nodes. Address these warnings as documented in [Index and Search Server](https://help.tableau.com/v0.0/server-linux/en-us/server_process_index-and-search.htm) and [Tableau Server Coordination Service](https://help.tableau.com/v0.0/server-linux/en-us/server_process_coordination.htm). ### Custom installation 1. Customize values cp ./helm/tableau-server/values.yaml ./helm/tableau-server/my-values.yaml \# Edit ./helm/tableau-server/my-values.yaml with your configuration 2. Install with custom values helm install tableau-server ./helm/tableau-server -f ./helm/tableau-server/my-values.yaml ## Configuration ### Deployment modes #### Single-node deployment Single-node deployment runs Tableau Server as a monolithic container. Use `values-single.yaml` or set: deploymentMode: "single" primary: replicaCount: 1 worker: replicaCount: 0 #### Multi-node deployment Multi-node deployment runs one primary and one or more workers. Set the worker count with `worker.replicaCount` — use 1, 2, or any higher value your cluster capacity and Tableau topology allow. The chart creates `tableau-server-worker-0 … tableau-server-worker-(N-1)` for `replicaCount: N`. Use `values-multinode.yaml` (default example uses two workers) or set explicitly: deploymentMode: "multinode" primary: replicaCount: 1 worker: replicaCount: 3 # example: three workers Topology alignment: `values-multinode.yaml` ships with a sample `config.configJson` topology (node IDs such as `node1`, `node2`, `node3`). If you change `worker.replicaCount` or rearrange services, update that topology (and any related Tableau process assignments) so the number and roles of TSM nodes match your deployment — see Tableau Server help for clustering and process layout. ### Key configuration options #### Image configuration image: repository: tableau\_server\_image tag: "latest" pullPolicy: IfNotPresent pullSecrets: \[\] #### License and secrets secrets: licenseKey: "YOUR-LICENSE-KEY" tsmRemotePassword: "password" tableauUsername: "admin" tableauPassword: "password" Alternatively, you can set these using environment variables: env: LICENSE\_KEY: "YOUR-LICENSE-KEY" TSM\_REMOTE\_PASSWORD: "password" TABLEAU\_USERNAME: "admin" TABLEAU\_PASSWORD: "password" We recommend using a separate file (for example, `secrets.yaml`) and passing it with the `-f` switch. `secrets.yaml`: secrets: licenseKey: "YOUR-LICENSE-KEY" tsmRemotePassword: "YOUR-TSM-PASSWORD" tableauUsername: "YOUR-ADMIN-USER" tableauPassword: "YOUR-ADMIN-PASSWORD" Install/upgrade example with `secrets.yaml`: helm upgrade --install tableau-server ./helm/tableau-server \\ -n default \\ -f ./helm/tableau-server/values-multinode.yaml \\ -f ./helm/tableau-server/secrets.yaml **Note:** Referencing a pre-existing Kubernetes Secret (for example s`ecrets.existingSecret`) is not currently supported. The only supported method is using chart values with a separate secrets value file. #### External PostgreSQL Repository The Helm chart does not enable an external repository by default using dedicated values keys. We recommend you take these steps to enable an external repository: 1. Deploy the chart and confirm primary is healthy. 2. Run Tableau `tsm external repository` commands from the primary pod. 3. Apply pending changes. Example workflow (command discovery and apply): \# Discover command syntax for your Tableau version kubectl exec -n default tableau-server-primary-0 -- sh -lc 'tsm topology external-services repository enable --help' \# After enabling external repository with Tableau-supported args/options: kubectl exec -n default tableau-server-primary-0 -- sh -lc 'tsm pending-changes apply -iw --ignore-prompt' kubectl exec -n default tableau-server-primary-0 -- sh -lc 'tsm status -v' Notes: - External repository configuration is Tableau version-specific (SSL mode, failover options, credentials fields). For more information, see [Tableau Server External Repository](https://help.tableau.com/v0.0/server-linux/en-us/server_external_repo.htm) and [tsm topology](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm). - For customer deployments, store database credentials in Kubernetes Secrets and avoid plain text in shell history. #### Persistent storage persistence: enabled: true storageClass: "standard" accessMode: ReadWriteOnce size: 100Gi # Bootstrap volume (required for multi-node) bootstrap: enabled: true storageClass: "standard" accessMode: ReadWriteMany size: 1Gi createPV: false For clusters using static EFS CSI (for example with `mounttargetip`), Helm can manage both bootstrap PV and PVC: persistence: bootstrap: enabled: true storageClass: "efs-bootstrap" accessMode: ReadWriteMany size: 1Gi createPV: true permissionsFix: enabled: true pv: name: "tableau-bootstrap-pv" csi: driver: efs.csi.aws.com volumeHandle: "fs-xxxxxxxx" volumeAttributes: mounttargetip: "10.x.x.x" `permissionsFix.enabled` adds an init container that `chown/chmods /docker/config/bootstrap` so the Tableau process (UID/GID 999:998) can write `bootstrap.json` on shared EFS mounts that default to `root:root`. When `createPV: true`, the chart creates the bootstrap PV from values (for example `tableau-bootstrap-pv`) and binds `tableau-server-bootstrap` PVC to it. If you manage bootstrap PV manually, create `tableau-bootstrap-pv` first, then install Helm with `createPV: false` and `volumeName: tableau-bootstrap-pv:` apiVersion: v1 kind: PersistentVolume metadata: name: tableau-bootstrap-pv spec: capacity: storage: 1Gi volumeMode: Filesystem accessModes: - ReadWriteMany persistentVolumeReclaimPolicy: Retain storageClassName: efs-bootstrap csi: driver: efs.csi.aws.com volumeHandle: fs-xxxxxxxx volumeAttributes: mounttargetip: 10.x.x.x kubectl apply -f tableau-bootstrap-pv.yaml kubectl get pv tableau-bootstrap-pv #### Resource limits primary: resources: limits: cpu: "4" memory: "8Gi" requests: cpu: "2" memory: "4Gi" worker: resources: limits: cpu: "4" memory: "8Gi" requests: cpu: "2" memory: "4Gi" #### Service configuration service: primary: type: ClusterIP # or NodePort, LoadBalancer ports: http: 80 https: 8080 tsm: 8850 #### Ingress ingress: enabled: true className: "nginx" hosts: - host: tableau.example.com paths: - path: / pathType: Prefix tls: - secretName: tableau-tls hosts: - tableau.example.com #### Ingress Setup Runbook (Example: NGINX Ingress Controller) 1. Install an ingress controller in the cluster (required before enabling chart ingress). 2. Set ingress values in your values file: ingress: enabled: true className: "nginx" annotations: nginx.ingress.kubernetes.io/proxy-body-size: "64m" nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" hosts: - host: tableau.example.com paths: - path: / pathType: Prefix tls: - secretName: tableau-tls hosts: - tableau.example.com 3. Create DNS record pointing tableau.example.com to your ingress/load balancer endpoint. 4. Create TLS secret (or use cert-manager) in the release namespace. 5. Deploy/upgrade chart and verify ingress: helm upgrade --install tableau-server ./helm/tableau-server -n default -f ./helm/tableau-server/values.yaml kubectl get ingress -n default kubectl describe ingress tableau-server For more information, see: - [Kubernetes Ingress Concept](https://kubernetes.io/docs/concepts/services-networking/ingress/) - [ingress-nginx Deployment Guide](https://kubernetes.github.io/ingress-nginx/deploy/) - [cert-manager Getting Started](https://cert-manager.io/docs/tutorials/getting-started-aks-letsencrypt/) #### Health Checks The chart supports startup, liveness, and readiness probes. The startup probe allows long first-time initialization (e.g. failureThreshold: 200 × periodSeconds) before liveness/readiness run: healthChecks: startup: enabled: true initialDelaySeconds: 300 periodSeconds: 15 timeoutSeconds: 30 failureThreshold: 200 liveness: enabled: true initialDelaySeconds: 300 periodSeconds: 30 timeoutSeconds: 10 failureThreshold: 3 readiness: enabled: true initialDelaySeconds: 300 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 3 For multinode worker pods, the chart defaults `worker.healthChecks.enabled: false` to avoid false probe failures when workers run limited process sets (for example admin agent + cluster controller only). ### Usage #### Accessing Tableau Server After installation, access Tableau Server based on your service configuration: - **ClusterIP**: Use port-forwarding or Ingress - **NodePort**: Access via `:` - **LoadBalancer**: Access via the external IP provided #### Using TSM commands \# Get pod name POD\_NAME=$(kubectl get pods -l app.kubernetes.io/component=primary -o jsonpath='{.items\[0\].metadata.name}') # Run tabcmd kubectl exec -it $POD\_NAME -- tsm status kubectl exec -it $POD\_NAME -- tsm configuration get #### Using tabcmd \# Get pod name POD\_NAME=$(kubectl get pods -l app.kubernetes.io/component=primary -o jsonpath='{.items\[0\].metadata.name}') # Run tabcmd kubectl exec -it $POD\_NAME -- tabcmd login -u admin -p password kubectl exec -it $POD\_NAME -- tabcmd sites #### Viewing Tableau Server logs \# Primary node logs kubectl logs -l app.kubernetes.io/component=primary -f # Worker node logs (multi-node) kubectl logs -l app.kubernetes.io/component=worker -f # All logs kubectl logs -l app.kubernetes.io/instance=tableau-server -f #### Shell access \# Get pod name POD\_NAME=$(kubectl get pods -l app.kubernetes.io/component=primary -o jsonpath='{.items\[0\].metadata.name}') # Open shell kubectl exec -it $POD\_NAME -- /bin/bash ### Upgrading #### Upgrade the Tableau Server Helm chart helm upgrade tableau-server ./helm/tableau-server -f ./helm/tableau-server/values.yaml #### Upgrade with new values helm upgrade tableau-server ./helm/tableau-server -f ./helm/tableau-server/new-values.yaml ### Post-install topology automation (hook) For multinode installs, this chart can run a post-install/post-upgrade hook job that: - waits for worker nodes to register in TSM - sets worker `clustercontroller` process assignment - runs `tsm pending-changes apply -iw --ignore-prompt` when changes are pending Configuration: hooks: autoApplyWorkerTopology: enabled: true kubectlImage: "bitnami/kubectl:latest" timeoutSeconds: 3600 Defaults: - disabled in `values.yaml` - in `values-multinode.yaml`, check `hooks.autoApplyWorkerTopology.enabled` (may be `true` or `false` depending on release; enable for hands-off worker `clustercontroller` setup) Verify hook execution: kubectl get jobs -n default kubectl get pods -n default -l job-name=tableau-server-hook-topology kubectl logs -n default job/tableau-server-hook-topology Manual fallback if hook is disabled or fails — run `tsm topology set-process` for each worker TSM node (commonly node2 through node(1+N) when you have N workers; confirm IDs with `tsm topology list-nodes -v`): kubectl exec -n default tableau-server-primary-0 -- sh -lc ' tsm topology set-process -n node2 -pr clustercontroller -c 1 tsm topology set-process -n node3 -pr clustercontroller -c 1 # Add one line per additional worker node, e.g. for four workers: # tsm topology set-process -n node4 -pr clustercontroller -c 1 # tsm topology set-process -n node5 -pr clustercontroller -c 1 tsm pending-changes apply -iw --ignore-prompt tsm topology list-nodes -v tsm status -v **Note**: Use `-iw` for `tsm pending-changes apply`. The `-ig` option is not valid in this environment. ### Uninstalling helm uninstall tableau-server **Warning**: This will delete all resources including persistent volumes. Make sure to backup your data before uninstalling. #### Validation steps Before release or when changing the chart, run: 1. Lint: helm lint helm/tableau-server -f helm/tableau-server/values-single.yaml helm lint helm/tableau-server -f helm/tableau-server/values-multinode.yaml 2. Template (dry-run): helm template tableau-server helm/tableau-server -f helm/tableau-server/values-single.yaml helm template tableau-server helm/tableau-server -f helm/tableau-server/values-multinode.yaml 3. Install test (optional): 1. In a test namespace, run `helm install` with values-single or values-multinode. 2. Run `kubectl rollout status` (for StatefulSet, wait for pod Ready) and basic smoke checks (e.g. `tsm status` or HTTP to the service). For detailed troubleshooting, see [Tableau Server Helm Chart - Troubleshooting](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-troubleshooting.htm). ## Additional Resources - [Tableau Server Documentation](https://help.tableau.com/current/server-linux/en-us/) - [Helm Documentation](https://helm.sh/docs/) - [Helm Chart Upgrade](https://helm.sh/docs/helm/helm_upgrade/) [Skip to main content](#main-content) # Tableau Server Helm Chart - Examples **Important**: This documentation assumes a knowledge of Helm and Helm charts and does not attempt to provide detailed, prescriptive examples. It is designed for customers who are familiar with both Tableau Server and Helm and Helm charts. ## Introduction This document provides examples for deploying Tableau Server using a Helm chart in various configurations and scenarios. ## Helm Chart Download and Distribution The Helm charts will be shipped as part of the Tableau Server in a Container setup tool (`tableau-server-container-setup-tool-.tar.gz`) and can be downloaded from the [Tableau Server download](http://tableau.com/support/releases/server/latest) page. After extraction, the required Helm chart files are located in the `helm/tableau` directory. ## Example 1: Single-node with NodePort deploymentMode: "single" service: primary: type: NodePort secrets: licenseKey: "YOUR-LICENSE-KEY" ## Example 2: Multi-node with LoadBalancer (three workers) For multi-node deployments, use `worker.replicaCount ≥ 1` where the number is the count of workers. The example below uses three workers. deploymentMode: "multinode" primary: replicaCount: 1 worker: replicaCount: 3 service: primary: type: LoadBalancer persistence: bootstrap: enabled: true accessMode: ReadWriteMany secrets: licenseKey: "YOUR-LICENSE-KEY" ### Example 3: Production with Ingress and TLS deploymentMode: "single" ingress: enabled: true className: "nginx" hosts: - host: tableau.company.com paths: - path: / pathType: Prefix tls: - secretName: tableau-tls hosts: - tableau.company.com service: primary: type: ClusterIP persistence: storageClass: "fast-ssd" size: 500Gi primary: resources: limits: cpu: "8" memory: "16Gi" requests: cpu: "4" memory: "8Gi" ## Additional Resources - [Tableau Server Helm Chart - Overview](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container_helm-chart.htm) - [Tableau Server Helm Chart - Prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-prerequisites.htm) - [Tableau Server Helm Chart - Deploy](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-deploy.htm) - [Tableau Server Helm Chart - Troubleshooting](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-troubleshooting.htm) - [Tableau Server Helm Chart - Examples](#) - [Tableau Server Documentation](https://help.tableau.com/current/server-linux/en-us/) [Skip to main content](#main-content) # Tableau Server Helm Chart - Prerequisites **Important**: This documentation assumes a knowledge of Helm and Helm charts and does not attempt to provide detailed, prescriptive examples. It is designed for customers who are familiar with both Tableau Server and Helm and Helm charts. This topic explains the prerequisites necessary to use a Helm chart for deploying Tableau Server. ## Helm Chart Download and Distribution The Helm charts will be shipped as part of the Tableau Server in a Container setup tool (`tableau-server-container-setup-tool-.tar.gz`) and can be downloaded from the [Tableau Server download](http://tableau.com/support/releases/server/latest) page. After extraction, the required Helm chart files are located in the `helm/tableau` directory. ## Required Tools - `kubectl` CLI configured to access your Kubernetes cluster - `helm` CLI version 3.x or later - Access to a Kubernetes cluster (1.19+) ## Cluster Requirements - At least one node with 16GB RAM and 4 CPU cores (8 cores recommended). - StorageClass configured for dynamic PersistentVolume provisioning. - Ability to create LoadBalancer services or Ingress resources. ## Required Information Be sure you have the following before starting: - Your Tableau Server **license key** - The **TSM Administrator `username` and** `**password**` for the initial account - The Tableau Server **hostname** for access ## Amazon Elastic Kubernetes Service (EKS) prerequisites ### `efs-bootstrap` StorageClass By default `efs-bootstrap` is not created in EKS. For multinode bootstrap sharing, create it before Helm install. For multinode deplyment, bootstrap storage must be provisionable before pods can schedule. If your `efs-bootstrap` StorageClass does not dynamically provision EFS volumes, you must either: - Create a static bootstrap PV in advance and bind it to `tableau-server-bootstrap` or - Set `persistence.bootstrap.createPV: true` and provide `valid persistence.bootstrap.pv.csi.volumeHandle` (real EFS ID, fs-...). If this is not done, pods remain in a Pending state with unbound PVCs. 1. Ensure the EFS CSI driver is installed in your cluster. kubectl get csidriver efs.csi.aws.com A `CSIDriver` object can exist even when the EKS managed add-on is not installed. Confirm the add-on explicitly. If you get a `ResourceNotFoundException` error (no add-on), or pods later fail with mount errors such as `driver name efs.csi.aws.com not found in the list of registered CSI drivers`, install the EKS add-on and wait until the status is ACTIVE and then verify the node plugin pods. This is necessary because multinode bootstrap uses an EFS-backed volume (ReadWriteMany). Without the EFS CSI node plugin on additional nodes, bootstrap PVCs can bind but mounts fail and pods stay in `Init/Pending` states. If EFS mounts fail with: is not authorized to perform: elasticfilesystem:DescribeMountTargets or Failed to resolve "fs-....efs..amazonaws.com" Use one of these remediations: - **IAM fix on EKS node role** (Preferred): grant EFS and EC2 read permissions so mount target and AZ discovery work. Resolve the node instance role name from your node group: aws eks list-nodegroups --cluster-name aws eks describe-nodegroup \\ \--cluster-name \\ \--nodegroup-name \\ \--query "nodegroup.nodeRole" \\ \--output text - **Use the IAM \*\*role name\*\*** (last segment of the ARN) in `attach-role-policy`: aws iam attach-role-policy \\ \--role-name \\ \--policy-arn arn:aws:iam::aws:policy/AmazonElasticFileSystemClientReadWriteAccess aws iam attach-role-policy \\ \--role-name \\ \--policy-arn arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess - Typical permissions involved: - elasticfilesystem:DescribeMountTargets, elasticfilesystem:DescribeFileSystems - `ec2:DescribeAvailabilityZones` (often needed when `DescribeAvailabilityZones` appears in mount errors) - **explicitly mount target IP**: set `mounttargetip` on the bootstrap PV CSI volume attributes when DNS/discovery is restricted in your environment. - Helm values (`createPV: true` path): persistence: bootstrap: pv: csi: volumeAttributes: mounttargetip: "10.x.x.x" - Manual PV path spec: csi: driver: efs.csi.aws.com volumeHandle: fs-xxxxxxxx volumeAttributes: mounttargetip: 10.x.x.x 2. Create `efs-bootstrap` StorageClass (example): apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: efs-bootstrap provisioner: efs.csi.aws.com reclaimPolicy: Retain volumeBindingMode: Immediate allowVolumeExpansion: true 3. Choose one bootstrap provisioning path (required): - **Dynamic EFS provisioning path**: use an EFS CSI dynamic StorageClass configured for Access Points (for example `provisioningMode: efs-ap, fileSystemId`, and permissions/basePath parameters according to your platform standard). - **Static PV path**: create `tableau-bootstrap-pv` manually with `csi.driver: efs.csi.aws.com` and `csi.volumeHandle: fs-...` then set: - `persistence.bootstrap.createPV: false` - `persistence.bootstrap.volumeName: tableau-bootstrap-pv` - **Helm-created static PV path**: set: - `persistence.bootstrap.createPV: true` - `persistence.bootstrap.pv.csi.volumeHandle: fs-...` ## Non-EKS prerequisite ### `ReadWriteMany` StorageClass For clusters not hosted on EKS (or if not using EFS), the critical requirement for multinode bootstrap sharing is providing a StorageClass that supports `ReadWriteMany (RWX)` access mode for the bootstrap volume. This is required because bootstrap storage must be provisionable before pods can schedule. Common self-hosted RWX storage backends for Kubernetes include: - NFS (most common, easiest to test) - CephFS - Longhorn (if installed) - GlusterFS - NetApp/other enterprise storage You must ensure the corresponding CSI driver for your chosen backend is installed. To configure Tableau Server to use your custom RWX StorageClass, update your Helm values (e.g., `values-multinode.yaml`) to set `persistence.bootstrap.storageClass` to the name of your StorageClass: persistence: # ... other persistence settings ... # Bootstrap volume (required for multi-node) bootstrap: enabled: true storageClass: "my-rwx-storage" # <--- Replace with your StorageClass name accessMode: ReadWriteMany size: 1Gi createPV: false ## Additional Resources - [Tableau Server Helm Chart - Overview](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container_helm-chart.htm) - [Tableau Server Helm Chart - Deploy](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-deploy.htm) - [Tableau Server Helm Chart - Troubleshooting](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-troubleshooting.htm) - [Helm Documentation](https://helm.sh/docs/) - [Tableau Server Documentation](https://help.tableau.com/current/server-linux/en-us/) [Skip to main content](#main-content) # Tableau Server Helm Chart - Reference **Important**: This documentation assumes a knowledge of Helm and Helm charts and does not attempt to provide detailed, prescriptive examples. It is designed for customers who are familiar with both Tableau Server and Helm and Helm charts. ## Introduction This topic provides reference information for deploying Tableau Server on Kubernetes using a Helm chart. ### Values property matrix The table below lists all leaf properties from `values.yaml`. - **Value**: dotted key path - **Optional**: whether the property can be omitted for chart rendering - **Expected value(s)**: valid type or allowed values - Range: numeric or semantic range where applicable | Value | Default | Description | Optional | Expected value(s) | Range | | --- | --- | --- | --- | --- | --- | | deploymentMode | single | Deployment pattern selector | true | `single` or `multinode` | N/A | | image.repository | "" | Tableau image repository | false | container image repo string | non-empty string | | image.tag | "" | Tableau image tag | false | image tag string | non-empty string | | image.pullPolicy | IfNotPresent | Image pull policy | true | `Always,IfNotPresent,Never` | N/A | | image.pullSecrets | \[\] | Image pull secret refs | true | string array of secret names | N/A | | serviceAccount.create | true | Create dedicated ServiceAccount | true | boolean | N/A | | serviceAccount.name | "" | ServiceAccount name override | true | string | DNS label | | serviceAccount.annotations | {} | ServiceAccount annotations | true | map\[string\]string | N/A | | securityContext.runAsUser | 999 | Container UID | true | integer | \>=0 | | securityContext.runAsGroup | 998 | Container GID | true | integer | \>=0 | | podSecurityContext.runAsUser | 999 | Pod-level UID | true | integer | \>=0 | | podSecurityContext.runAsGroup | 998 | Pod-level GID | true | integer | \>=0 | | podSecurityContext.fsGroup | 998 | Shared volume FS group | true | integer | \>=0 | | podSecurityContext.fsGroupChangePolicy | OnRootMismatch | FS group ownership policy | true | `OnRootMismatch` or `Always` | N/A | | primary.replicaCount | 1 | Primary StatefulSet replicas | true | integer | \>=1 | | primary.hostname | primary | Primary hostname hint | true | string | non-empty | | primary.resources.limits.cpu | "16" | Primary CPU limit | true | Kubernetes CPU quantity | \>0 | | primary.resources.limits.memory | "64Gi" | Primary memory limit | true | Kubernetes memory quantity | \>0 | | primary.resources.requests.cpu | "8" | Primary CPU request | true | Kubernetes CPU quantity | \>0 | | primary.resources.requests.memory | "32Gi" | Primary memory request | true | Kubernetes memory quantity | \>0 | | primary.nodeSelector | {} | Primary node selector | true | map\[string\]string | N/A | | primary.tolerations | \[\] | Primary tolerations | true | array of toleration objects | N/A | | primary.affinity | {} | Primary affinity rules | true | affinity object | N/A | | worker.replicaCount | 1 | Worker StatefulSet replicas | true | integer | \>=0 | | worker.hostname | worker | Worker hostname hint | true | string | non-empty | | worker.resources.limits.cpu | "16" | Worker CPU limit | true | Kubernetes CPU quantity | \>0 | | worker.resources.limits.memory | "64Gi" | Worker memory limit | true | Kubernetes memory quantity | \>0 | | worker.resources.requests.cpu | "8" | Worker CPU request | true | Kubernetes CPU quantity | \>0 | | worker.resources.requests.memory | "32Gi" | Worker memory request | true | Kubernetes memory quantity | \>0 | | worker.nodeSelector | {} | Worker node selector | true | map\[string\]string | N/A | | worker.tolerations | \[\] | Worker tolerations | true | array of toleration objects | N/A | | worker.affinity | {} | Worker affinity rules | true | affinity object | N/A | | worker.healthChecks.enabled | false | Enable worker probes | true | boolean | N/A | | env.ACCEPTEULA | "1" | Accept Tableau EULA | true | "`1`" or "`0`" | N/A | | env.LICENSE\_KEY | "" | License key via env | true | string | non-empty if used | | env.TABLEAU\_HOSTNAME | "" | Explicit Tableau hostname | true | string | DNS name/FQDN | | env.TSM\_ONLY | "0" | Run TSM-only mode | true | "`1`" or "`0`" | N/A | | env.TSM\_REMOTE\_UID | "" | TSM remote UID | true | numeric string | \>=0 | | env.TSM\_REMOTE\_USERNAME | "" | TSM remote username | true | string | N/A | | env.TSM\_REMOTE\_PASSWORD | "" | TSM remote password via env | true | string | non-empty if used | | env.TABLEAU\_USERNAME | "" | Tableau admin username via env | true | string | non-empty if used | | env.TABLEAU\_PASSWORD | "" | Tableau admin password via env | true | string | non-empty if used | | env.ALWAYS\_WRITE\_BOOTSTRAP\_FILE | "0" | Write bootstrap file from primary | true | "`1`" or "`0`" | N/A | | env.BOOTSTRAP\_INSTALL | "0" | Worker bootstrap install mode | true | "`1`" or "`0`" | N/A | | env.WAIT\_FOR\_BOOTSTRAP\_FILE | "0" | Worker bootstrap install mode | true | "`1`" or "`0`" | N/A | | env.HTTP\_PROXY | "" | Wait for bootstrap file | true | URL string | N/A | | env.HTTPS\_PROXY | "" | HTTPS proxy URL | true | URL string | N/A | | env.NO\_PROXY | "" | HTTPS proxy URL | true | comma-separated hosts/CIDRs | N/A | | env.PORT\_RANGE\_MIN | 8600 | Dynamic port range minNo-proxy list | true | numeric string | 1-65535 | | env.PORT\_RANGE\_MAX | 9000 | Dynamic port range max | true | numeric string | 1-65535; >= min | | env.COORDINATION\_SERVICE\_CLIENT\_PORT | "" | ZK client port override | true | numeric string | 1-65535 | | env.COORDINATION\_SERVICE\_PEER\_PORT | "" | ZK peer port override | true | numeric string | 1-65535 | | env.LICENSE\_SERVICE\_VENDOR\_DAEMON\_PORT | "" | ZK leader port override | true | numeric string | 1-65535 | | env.COORDINATION\_SERVICE\_LEADER\_PORT | "" | License daemon port override | true | numeric string | 1-65535 | | env.AGENT\_FILE\_TRANSFER\_PORT | "" | Agent file transfer port override | true | numeric string | 1-65535 | | env.CONTROLLER\_PORT | "" | Controller port override | true | numeric string | 1-65535 | | persistence.enabled | true | Enable data PVCs | true | boolean | N/A | | persistence.storageClass | "" | Data PVC storage class | true | string | existing StorageClass | | persistence.accessMode | ReadWriteOnce | Data PVC access mode | true | `ReadWriteOnce,ReadOnlyMany,ReadWriteMany` | N/A | | persistence.size | 100Gi | Data PVC size | true | Kubernetes quantity | \>0 | | persistence.bootstrap.enabled | true | Enable bootstrap PVC (multinode) | true | boolean | N/A | | persistence.bootstrap.storageClass | "" | Bootstrap PVC storage class | true | string | existing StorageClass | | persistence.bootstrap.accessMode | ReadWriteMany | Bootstrap PVC access mode | true | typically `ReadWriteMany` | N/A | | persistence.bootstrap.size | 1Gi | Bootstrap PVC size | true | Kubernetes quantity | \>0 | | persistence.bootstrap.createPV | false | Let chart create static PV | true | boolean | N/A | | persistence.bootstrap.volumeName | "" | Explicit bootstrap PV name binding | true | string | existing PV name | | persistence.bootstrap.pv.name | "" | PV name when `createPV=true` | true | string | DNS-1123 | | persistence.bootstrap.pv.capacity | 1Gi | PV capacity | true | Kubernetes quantity | \>0 | | persistence.bootstrap.pv.reclaimPolicy | Retain | PV reclaim policy | true | `Retain,Delete,Recycle` | N/A | | persistence.bootstrap.pv.volumeMode | Filesystem | PV volume mode | true | `Filesystem` or `Block` | N/A | | persistence.bootstrap.pv.csi.driver | efs.csi.aws.com | CSI driver for bootstrap PV | true | CSI driver name | N/A | | persistence.bootstrap.pv.csi.volumeHandle | "" | EFS/FileSystem handle | true | provider-specific ID | non-empty if `createPV=true` | | persistence.bootstrap.pv.csi.volumeAttributes | {} | CSI volume attributes map | true | map\[string\]string | N/A | | persistence.bootstrap.permissionsFix.enabled | false | Enable bootstrap permission init | true | boolean | N/A | | persistence.bootstrap.permissionsFix.image | busybox:1.36 | Permission-fix image | true | valid image ref | N/A | | persistence.bootstrap.permissionsFix.runAsUser | 0 | UID for permission-fix init | true | integer | \>=0 | | persistence.bootstrap.permissionsFix.fsOwner | 999 | chown UID for bootstrap dir | true | integer | \>=0 | | persistence.bootstrap.permissionsFix.fsGroup | 998 | chown GID for bootstrap dir | true | integer | \>=0 | | persistence.bootstrap.permissionsFix.dirMode | "2775" | chmod mode for bootstrap dir | true | string octal mode | 0000-7777 | | config.configJson | JSON block | Tableau `config.json` content | true | valid JSON string | N/A | | config.regInfoJson | JSON block | Tableau registration JSON | true | valid JSON string | N/A | | config.tabsvcYml | YAML block | Tableau `tabsvc.yml` content | true | valid YAML string | N/A | | | | License key via chart secret | true | string | non-empty if used | | secrets.tsmRemotePassword | "" | TSM remote password via secret | true | string | non-empty if used | | secrets.tableauUsername | "" | Tableau admin username via secret | true | string | non-empty if used | | secrets.tableauPassword | "" | Tableau admin password via secret | true | string | non-empty if used | | service.primary.type | ClusterIP | Primary service type | true | `ClusterIP,NodePort,LoadBalancer` | N/A | | service.primary.ports.http | 80 | Primary HTTP port | true | integer | 1-65535 | | service.primary.ports.gateway | 8080 | Primary gateway port | true | integer | 1-65535 | | service.primary.ports.ssl | 8443 | Primary SSL port | true | integer | 1-65535 | | service.primary.ports.tsm | 8850 | Primary TSM port | true | integer | 1-65535 | | service.primary.ports.dynamic.start | 8600 | Dynamic port start | true | integer | 1-65535 | | service.primary.ports.dynamic.end | 9000 | Dynamic port end | true | integer | 1-65535; >= star | | service.primary.annotations | {} | Primary service annotations | true | map\[string\]string | N/A | | service.worker.ports.http | ClusterIP | Worker service type | true | `ClusterIP,NodePort,LoadBalancer` | N/A | | service.worker.ports.http | 80 | Worker HTTP port | true | integer | 1-65535 | | service.worker.ports.gateway | 8080 | Worker gateway port | true | integer | 1-65535 | | service.worker.ports.ssl | 8443 | Worker SSL port | true | integer | 1-65535 | | service.worker.ports.tsm | 8850 | Worker TSM port | true | integer | 1-65535 | | service.worker.ports.dynamic.start | 8600 | Worker dynamic start | true | integer | 1-65535 | | service.worker.ports.dynamic.end | 9000 | Worker dynamic end | true | integer | 1-65535; >= start | | service.worker.annotations | {} | Worker service annotations | true | map\[string\]string | N/A | | ingress.enabled | false | Enable ingress | true | boolean | N/A | | ingress.className | "" | Ingress class name | true | string | existing class | | ingress.annotations | {} | Ingress annotations | true | map\[string\]string | N/A | | ingress.hosts | \[{host: tableau.example.com, paths:\[...\]}\] | Ingress host/path config | true | array of host/path objects | N/A | | ingress.tls | \[\] | Ingress TLS entries | true | array of TLS objects | N/A | | healthChecks.startup.enabled | true | Enable startup probe | true | boolean | N/A | | healthChecks.startup.initialDelaySeconds | 300 | Startup probe delay | true | integer | \>=0 | | healthChecks.startup.periodSeconds | 15 | Startup probe period | true | integer | \>=1 | | healthChecks.startup.timeoutSeconds | 30 | Startup probe timeout | true | integer | \>=1 | | healthChecks.startup.failureThreshold | 200 | Startup failure threshold | true | integer | \>=1 | | healthChecks.liveness.enabled | true | Enable liveness probe | true | boolean | N/A | | healthChecks.liveness.initialDelaySeconds | 300 | Liveness probe delay | true | integer | \>=0 | | healthChecks.liveness.periodSeconds | 30 | Liveness probe period | true | integer | \>=1 | | healthChecks.liveness.timeoutSeconds | 10 | Liveness probe timeout | true | integer | \>=1 | | healthChecks.liveness.successThreshold | 1 | Liveness success threshold | true | integer | \>=1 | | healthChecks.liveness.failureThreshold | 3 | Liveness failure threshold | true | integer | \>=1 | | healthChecks.readiness.enabled | true | Enable readiness probe | true | boolean | N/A | | healthChecks.readiness.initialDelaySeconds | 300 | Readiness probe delay | true | integer | \>=0 | | healthChecks.readiness.periodSeconds | 10 | Readiness probe period | true | integer | \>=1 | | healthChecks.readiness.timeoutSeconds | 5 | Readiness probe timeout | true | integer | \>=1 | | healthChecks.readiness.successThreshold | 1 | Readiness success threshold | true | integer | \>=1 | | healthChecks.readiness.failureThreshold | 3 | Readiness failure threshold | true | integer | \>=1 | | podDisruptionBudget.enabled | false | Enable PodDisruptionBudget | true | boolean | N/A | | podDisruptionBudget.minAvailable | 1 | Minimum pods available | true | integer or percent string | \>=0 | | labels | {} | Extra common labels | true | map\[string\]string | N/A | | annotations | {} | Extra common annotations | true | map\[string\]string | N/A | | podLabels | {} | Extra pod labels | true | map\[string\]string | N/A | | podAnnotations | {} | Extra pod annotations | true | map\[string\]string | N/A | | hooks.autoApplyWorkerTopology.enabled | false | Enable post-install/upgrade topology hook | true | boolean | N/A | | hooks.autoApplyWorkerTopology.kubectlImage | bitnami/kubectl:latest | Hook job kubectl image | true | valid image ref | N/A | | hooks.autoApplyWorkerTopology.timeoutSeconds | 3600 | Hook timeout while waiting for workers | true integer >=60 | integer >=60 | \>=60 | ## Additional Resources - [Tableau Server Helm Chart - Overview](https://help.tableau.com/v0.0/server-linux/en-us/server-in-container_helm-chart.htm) - [Tableau Server Helm Chart - Prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-prerequisites.htm) - [Tableau Server Helm Chart - Deploy](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-deploy.htm) - [Tableau Server Helm Chart - Examples](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-examples.htm) - [Tableau Server Helm Chart - Troubleshooting](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-troubleshooting.htm) - [Tableau Server Documentation](https://help.tableau.com/current/server-linux/en-us/) [Skip to main content](#main-content) # Tableau Server Helm Chart - Troubleshooting **Important**: This documentation assumes a knowledge of Helm and Helm charts and does not attempt to provide detailed, prescriptive examples. It is designed for customers who are familiar with both Tableau Server and Helm and Helm charts. ## Introduction This topic provides help for you to diagnose and resolve common issues when deploying Tableau Server on Kubernetes using a Helm chart. It covers installation problems, runtime issues, and debugging techniques. ## General Troubleshooting Steps When encountering issues with Tableau Server in Kubernetes: 1. Check pod status and events 2. Review container logs 3. Verify resource availability 4. Check persistent volume claims 5. Review Helm release status 6. Examine service and network connectivity ## Pods not starting 1. Check pod status: kubectl get pods -l app.kubernetes.io/instance=tableau-server kubectl describe pod 2. Check logs: kubectl logs 3. Check events: kubectl get events --sort-by='.lastTimestamp' ## Persistent volume issues 1. Check PVC status: kubectl get pvc kubectl describe pvc 2. Verify storage class: kubectl get storageclass ## License key issues 1. Verify license key is set: kubectl get secret tableau-server-secrets -o jsonpath='{.data.LICENSE\_KEY}' | base64 -d 2. Update license key: \# Edit values.yaml and upgrade helm upgrade tableau-server ./helm/tableau-server -f ./helm/tableau-server/values.yaml ## Health check failures 1. Check health check script: kubectl exec -- /docker/alive-check kubectl exec -- /docker/server-ready-check 2. Adjust health check timing: healthChecks: liveness: initialDelaySeconds: 600 # Increase if server takes longer to start ## Multi-node bootstrap issues 1. Verify bootstrap volume: kubectl get pvc | grep bootstrap 2. Check bootstrap file: kubectl exec -- ls -la /docker/config/bootstrap 3. Verify ReadWriteMany access mode: persistence: bootstrap: accessMode: ReadWriteMany # Required for multi-node 4. Verify bootstrap PV/PVC binding for EFS static provisioning: kubectl get pv tableau-bootstrap-pv kubectl get pvc -n default tableau-server-bootstrap kubectl describe pv tableau-bootstrap-pv kubectl describe pvc -n default tableau-server-bootstrap 5. If mount fails after PVC is Bound, check for EFS CSI/IAM errors: kubectl describe pod -n default tableau-server-primary-0 kubectl get events -n default --sort-by='.lastTimestamp' 6. `driver name efs.csi.aws.com not found` errors: Install and verify the EKS add-on as described in [Amazon Elastic Kubernetes Service (EKS) prerequisites](https://help.tableau.com/v0.0/server-linux/en-us/server-helm-prerequisites.htm#EKS-Prereq-storageclass). 7. Fix `DescribeMountTargets` authorization failures - Preferred method: aws iam attach-role-policy \\ --role-name \\ --policy-arn arn:aws:iam::aws:policy/AmazonElasticFileSystemClientReadWriteAccess Then restart affected pods (primary node and all worker nodes. Workers are selected by label so any replica count is covered. - Alternate method Force mount the target IP in bootstrap PV config: Set `persistence.bootstrap.pv.csi.volumeAttributes.mounttargetip` (or manual PV `volumeAttributes.mounttargetip`) and re-apply/upgrade. ## Additional Resources - [Tableau Server Documentation](https://help.tableau.com/current/server-linux/en-us/) - [Tableau Server Logs Reference](https://help.tableau.com/current/server-linux/en-us/logs.htm) - [Kubernetes Troubleshooting](https://kubernetes.io/docs/tasks/debug/) - [Helm Troubleshooting](https://helm.sh/docs/faq/troubleshooting/) - [Helm Documentation](https://helm.sh/docs/) [Skip to main content](#main-content) # Help Output for initialize-tsig Script The following help content is the output when you run the following command: `sudo ./initialize-tsig -h` The initialize-tsig script is installed to `/opt/tableau/tableau_tsig/packages/scripts./`. ## Output REQUIRED --accepteula Indicate that you have accepted the End User License Agreement (EULA). You can find a link to the EULA in /opt/tableau/tableau\_tsig/packages/docs. -c The network location of all nodes in the Tableau Server cluster. These may send "housekeeping" requests to the TSIG node. The locations must be one of the forms that are acceptable to Apache httpd mod\_authz\_host "Require" directive as described at https://httpd.apache.org/docs/2.4/mod/mod\_authz\_host.html. Use quotes if there are embedded spaces. OPTIONAL -i A unique identifier for the TSIG instance. Default: The computer name. -p Port listening for external requests. Default: 80. -t Protocol used for external requests. Options are "http" or "https". Default: "http". -k Port listening for housekeeping requests from Tableau Server. Default: 21319. -s Protocol used for housekeeping requests. Options are "http" or "https". Default: "http". -d data-dir Set a custom location for the data directory if it's not already set. If not set, the default is "/var/opt/tableau/tableau\_tsig". -f Bypass warning messages and distribution version checks. -g Do not add the current user to the "tableau-tsig" group. Use this for easier access to log files and runtime files. -a Name of the user to be added to the appropriate groups instead of the current user running the script. You cannot use both -g and -a. -q Quiet, suppress output except for errors and warnings. --unprivileged-user= Name of the unprivileged account to run Tableau Server Independent Gateway. Default: "tableau-tsig". --disable-account-creation Do not create groups or user accounts for Tableau Server Independent Gateway. However, the values in: unprivileged-user will still be used in TSIG configuration. ## Related topics - [Install Tableau Server with Independent Gateway](https://help.tableau.com/v0.0/server-linux/en-us/server_tsig_new_install.htm) [Skip to main content](#main-content) # Help Output for initialize-tsm Script The following help content is the output when you run the following command: `sudo ./initialize-tsm -h` The initialize-tsm script is installed to `/opt/tableau/tableau_server/packages/scripts./`. ## Output REQUIRED --accepteula Indicate that you have accepted the End User License Agreement (EULA). You can find the EULA in /opt/tableau/tableau\_server/packages/docs. OPTIONAL -c config-name Set the service configuration name. If not set, the default is "tabsvc". -d data-directory Set a custom location for the data directory if it's not already set. If not set, the default is "/var/opt/tableau/tableau\_server". -b bootstrap-file Optional. Location of the bootstrap file downloaded from the Tableau Services Manager on existing node. Must be provided to join existing Tableau Server cluster. -u username Name of the user with admin privileges on existing Tableau Services Manager. Required if -b option specified. -p password Password for the Tableau Services Manager admin user. Note: This option was removed beginning in version 2021.3.0 to improve script security. -f Bypass warning messages. -g Do NOT add the current user to the "tsmadmin" administrative group, used for default access to Tableau Services Manager, or to the "tableau" group, used for easier access to log files. -a username The provided username will be used as the user to be added to the appropriate groups, instead of the user running this script. Providing both -a and -g is not allowed. -q Quiet, suppress output except for errors and warnings. -i coordinationservice-client-port Client port for the coordination service -e coordinationservice-peer-port Peer port for the coordination service -m coordinationservice-leader-port Leader port for the coordination service -t licenseservice-vendordaemon-port Vendor daemon port for the licensing service -n agent-filetransfer-port Filetransfer port for the agent service -o controller-port Https port for the controller service -l port-range-min Lower port bound for automatic selection -r port-range-max Upper port bound for automatic selection --disable-port-remapping Disable automatic port selection --unprivileged-user= Name of the unprivileged account to run Tableau Server. Default: "tableau". --tsm-authorized-group= Name of the group(s) that allows authorization to access Tableau Services Manager. Default: "tsmadmin". --disable-account-creation Do not create groups or user accounts for Server and TSM authorization. However, the values in: unprivileged-user and tsm-authorized-group will still be used in TSM configuration. --http\_proxy= Http forward proxy for Tableau Server. Its value should be http://:/ For example, --http\_proxy=http://1.2.3.4:3128/ or --http\_proxy=http://example.com:3128/ --https\_proxy= Https forward proxy for Tableau Server. Its value should be http://:/ For example, --https\_proxy=http://1.2.3.4:3128/ or --https\_proxy=http://example.com:3128/ Take care to use http when you specify the URL for the https\_proxy environmental variable. Do not specify the https protocol for the value of the https\_proxy environmental variable. --no\_proxy= Environment variable that directs certain URLs to bypass the forward proxy. For example, --no\_proxy=localhost,127.0.0.1,localaddress,.localdomain.com --\[no-\]activation-service Specify whether the Tableau authorization-to-run (ATR) service should be used to activate Tableau Server. This option is ideal for cloud-based or virtual environments, but is available to anyone who can activate their copy of Tableau Server online. Selecting ATR for product activation is a permanent choice that cannot be undone later. If no option is specified, the Tableau authorization-to-run (ATR) service will be used to activate Tableau Server. ## Related topics - [Controlling port remapping with initialize-tsm](https://help.tableau.com/v0.0/server-linux/en-us/ports.htm#PortsAtInitializeTSM) - [Install and Initialize TSM](https://help.tableau.com/v0.0/server-linux/en-us/setup.htm) - [System user and groups](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm#System) - [Data directory](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm#Data) [Skip to main content](#main-content) # Help Output for tableau-server-obliterate Script The following help content is the output when you run the following command: `sudo ./tableau-server-obliterate -h` The ./tableau-server-obliterate script is installed to `/opt/tableau/tableau_server/packages/scripts./`. ## Output Remove Tableau Server from this computer. This script will stop and remove all Tableau Services from this computer. It also removes data and configuration files. It leaves licensing in place. It also preserves logs and backup files, which are moved to a temp directory under the Tableau data folder. You can force removal of these files, and licensing, using optional parameters. This script is destructive and not reversible. It should only be used to clean Tableau Server from a computer. For multi-node installations, you must run the script separately on each node. This script must be run as the root user. -y Required. Yes, remove Tableau Server from this computer. Must be specified three times to confirm. -l Optional. Delete licensing files and data. This command will attempt to deactivate licenses before deleting licensing data. Internet access is required for license deactivation. Offline deactivation is not supported. To deactivate license before removing Tableau Server, run 'tsm licenses deactivate' before running this script. -k Optional. Do not copy backups to logs\_temp directory. -g Optional. Do not copy logs to logs\_temp directory. -a Optional. Do not copy anything to logs\_temp directory. [Skip to main content](#main-content) # Help Output for upgrade-tsm Script The following help content is the output when you run the following command: `sudo ./upgrade-tsm -h` The upgrade-tsm script is installed to `/opt/tableau/tableau_server/packages/scripts./`. ## Output Usage: upgrade-tsm \[optional parameters\] Perform upgrade using the specified parameters. Global Parameters -u, --username TSM administrator user name. Current user will be assumed if not provided. -p, --password TSM administrator password. You will be prompted for a password if upgrading from a version prior to 2019.2 and the password is not provided. -sp,--service-runas-password Service runas user password. You will be prompted for password if not set and non-default runas user is configured. Optional Parameters --trust-admin-controller-cert Do not validate the server certificate. --no-prompt Suppress script prompts. You will only be prompted for missing required parameters, for example, if you specify a user name but not a password. If the script needs to stop or restart Tableau Server it will do so without warning or prompting. Use this if you automate the upgrade, for example, with a script. --skip-preflight-check Skip the preflight check. This option should only be used if you are sure the preflight check is failing in error. --external-repository-config-file= Required if upgrading from a Tableau Server to a version of Tableau Server that uses a later major version of PostgreSQL and is configured to use an external repository. The filename is a configuration file describing a new instance of the external repository. The new repository should use the same type of external service as the current external repository, but with the supported version of PostgreSQL. --external-repository-cert-file= Required if upgrading from a Tableau Server to a version of Tableau Server that uses a later major version of PostgreSQL and is configured to use an external repository. The filename is a SSL certificate file for the new external repository. The new repository should use the same type of external service as the current external repository, but with the supported version of PostgreSQL. [Skip to main content](#main-content) # How Explain Data Works Use Explain Data as an incremental, jumping-off point for further exploration of your data. The possible explanations that it generates help you to see the different values that make up or relate to an analyzed mark in a view. It can tell you about the characteristics of the data points in the data source, and how the data might be related (correlations) using statistical modeling. These explanations give you another tool for inspecting your data and finding interesting clues about what to explore next. **Note**: Explain Data is a tool that uncovers and describes relationships in your data. It can't tell you what is causing the relationships or how to interpret the data. **You are the expert on your data.** Your domain knowledge and intuition is key in helping you decide what characteristics might be interesting to explore further using different views. For related information on how Explain Data works, and how to use Explain Data to augment your analysis, see these Tableau Conference presentations: - [From Analyst to Statistician: Explain Data in Practice (1 hour)](https://www.tableau.com/events/tc/2019/analyst-statistician-explain-data-practice) - [Leveraging Explain Data (45 minutes)](https://www.tableau.com/events/tc/2019/leveraging-explain-data) ## What Explain Data is (and isn’t) Explain Data is: - A tool and a workflow that leverages your domain expertise. - A tool that surfaces relationships in your data and recommends where to look next. - A tool and a workflow that helps expedite data analysis and make data analysis more accessible to a broader range of users. Explain Data is not: - A statistical testing tool. - A tool to prove or disprove hypotheses. - A tool that is giving you an answer or telling you anything about causality in your data. When running Explain Data on marks, keep the following points in mind: - **Use granular data that can be aggregated**. This feature is designed explicitly for the analysis of aggregated data. This means that your data must be granular, but the marks that you select for Explain Data must be aggregated or summarized at a higher level of detail. Explain Data can't be run on disaggregated marks (row-level data) at the most granular level of detail. - **Consider the shape, size, and cardinality of your data**. While Explain Data can be used with smaller data sets, it requires data that is sufficiently wide and contains enough marks (granularity) to be able to create a model. - **Don't assume causality**. Correlation is not causation. Explanations are based on models of the data, but are not causal explanations. A correlation means that a relationship exists between some data variables, say A and B. You can't tell just from seeing that relationship in the data that A is causing B, or B is causing A, or if something more complicated is actually going on. The data patterns are exactly the same in each of those cases and an algorithm can't tell the difference between each case. Just because two variables seem to change together doesn't necessarily mean that one causes the other to change. A third factor could be causing them both to change, or it may be a coincidence and there might not be any causal relationship at all. However, you might have outside knowledge that is not in the data that helps you to identify what's going on. A common type of outside knowledge would be a situation where the data was gathered in an experiment. If you know that B was chosen by flipping a coin, any consistent pattern of difference in A (that isn't just random noise) must be caused by B. For a longer, more in-depth description of these concepts, see the article [Causal inference in economics and marketing](https://www.pnas.org/content/pnas/113/27/7310.full.pdf) by Hal Varian. ## How explanations are analyzed and evaluated Explain Data runs a statistical analysis on a dashboard or sheet to find marks that are outliers, or specifically on a mark you select. The analysis also considers possibly related data points from the data source that aren't represented in the current view. Explain Data first predicts the value of a mark using only the data that is present in the visualization. Next, data that is in the data source (but not in the current view) is considered and added to the model. The model determines the range of predicted mark values, which is within one standard deviation of the predicted value. ### What is an expected range? The expected value for a mark is the median value in the expected range of values in the underlying data in your viz. The expected range is the range of values between the 15th and 85th percentile that the statistical model predicts for the analyzed mark. Tableau determines the expected range each time it runs a statistical analysis on a selected mark. Possible explanations are evaluated on their explanatory power using statistical modeling. For each explanation, Tableau compares the expected value with the actual value. | value | Description | | --- | --- | | Higher than expected / Lower than expected | If an expected value summary says the mark is _lower than expected_ or _higher than expected_, it means the aggregated mark value is outside the range of values that a statistical model is predicting for the mark. If an expected value summary says the mark is _slightly lower_ or _slightly higher_ than expected, or _within the range of natural variation_, it means the aggregated mark value is within the range of predicted mark values, but is lower or higher than the median. | | Expected Value | If a mark has an expected value, it means its value falls within the expected range of values that a statistical model is predicting for the mark. | | Random Variation | When the analyzed mark has a low number of records, there may not be enough data available for Explain Data to form a statistically significant explanation. If the mark’s value is outside the expected range, Explain Data can’t determine whether this unexpected value is being caused by random variation or by a meaningful difference in the underlying records. | | No Explanation | When the analyzed mark value is outside of the expected range and it does not fit a statistical model used for Explain Data, no explanations are generated. | ### Models used for analysis Explain Data builds models of the data in a view to predict the value of a mark and then determines whether a mark is higher or lower than expected given the model. Next, it considers additional information, like adding additional columns from the data source to the view, or flagging record-level outliers, as potential explanations. For each potential explanation, Explain Data fits a new model, and evaluates how unexpected the mark is given the new information. Explanations are scored by trading off complexity (how much information is added from the data source) against the amount of variability that needs to be explained. Better explanations are simpler than the variation they explain.

Explanation type	Evaluation
Extreme values	Extreme values are aggregated marks that are outliers, based on a model of the visualized marks. The selected mark is considered to contain an extreme value if a record value is in the tails of the distribution of the expected values for the data. An extreme value is determined by comparing the aggregate mark with and without the extreme value. If the mark becomes less surprising by removing a value, then it receives a higher score. When a mark has extreme values, it doesn't automatically mean it has outliers, or that you should exclude those records from the view. That choice is up to you depending on your analysis. The explanation is simply pointing out an interesting extreme value in the mark. For example, it could reveal a mistyped value in a record where a banana cost 10 dollars instead of 10 cents. Or, it could reveal that a particular sales person had a great quarter.
Number of records	The number of records explanation models the aggregate sum in terms of the aggregate count; average value of records models it in terms of the aggregate average. The better the model explains the sum, the higher the score. This explanation describes whether the sum is interesting because the count is high or low, or because the average is high or low.
Average value of the mark	This type of explanation is used for aggregate marks that are sums. It explains whether the mark is consistent with the other marks because in terms of its aggregate count or average, noting the relation SUM(X) = COUNT(X) * AVG(X). This explanation describes whether the sum is interesting because the count is high or low, or because the average is high or low.
Contributing Dimensions	This explanation models the target measure of the analyzed mark in terms of the breakdown among categories of the unvisualized dimension. The analysis balances the complexity of the model with how well the mark is explained. An unvisualized dimension is a dimension that exists in the data source, but isn't currently being used in the view. This type of explanation is used for sums, counts and averages. The model for unvisualized dimensions is created by splitting out marks according to the categorical values of the explaining column, and then building a model with the value that includes all of the data points in the source visualization. For each row, the model attempts to recover each of the individual components that made each mark. The analysis indicates whether the model predicts the mark better when components corresponding to the unvisualized dimension are modeled and then added up, versus using a model where the values of the unvisualized dimension are not known. Aggregate dimension explanations explore how well mark values can be explained without any conditioning. Then, the model conditions on values for each column that is a potential explanation. Conditioning on the distribution of an explanatory column should result in a better prediction.
Contributing Measures	This explanation models the mark in terms of this unvisualized measure, aggregated to its mean across the visualized dimensions. An unvisualized measure is a measure that exists in the data source, but isn't currently being used in the view. A Contributing Measures explanation can reveal a linear or quadratic relationship between the unvisualized measure and the target measure.

[Skip to main content](#main-content) # How Impersonation Works Here’s an illustration of how database user impersonation works: ![A diagram that illustrates how Tableau Server and SQL Server interact to impersonate workbook viewers.](/tableau/next/en-us/server-linux/en-us/Img/impersonate.png) In the above illustration, Jane Smith (MyCo\\jsmith) is a West Coast sales representative and Henry Wilson (MyCo\\hwilson) covers the East. In the SQL Server database, the account permissions for Jane's account, MyCo\\jsmith, only give her access to West Coast data. Henry's account, MyCo\\hwilson, can only access data for the East Coast. A view has been created that displays data for the entire country. It has a live connection to a SQL Server database. Both users sign in to Tableau Server and click the view. Tableau Server connects to SQL Server using a database account with IMPERSONATE permission for each user's database account. This account acts on behalf of each user's database account. When the view displays, it is restricted by each user's individual database permissions: Jane sees only the West Coast sales data, Henry sees only the East Coast data. **Note:**Tableau Bridge does not support SQL impersonation using Initial SQL. [Skip to main content](#main-content) # How Mutual SSL Authentication Works Mutual (or two-way) SSL authentication provides a combination of an encrypted data stream, mutual authentication of both server and client, and direct access convenience. To use mutual SSL with Tableau Server, you need the following: - External SSL configured on Tableau Server. - A trusted CA-issued SSL certificate for Tableau Server. The file is a concatenation of CA certificate files. A "CA" is a _certificate authority_ that issues certificates to the client computers that will connect to Tableau Server. The action of uploading the CA certificate file establishes a trust, which enables Tableau Server to authenticate the individual certificates that are presented by the client computers. - A certificate on each client that will connect to Tableau Server. - A Tableau Server configured to use mutual SSL. Tableau Server and the client verify that each other has a valid certificate, and Tableau Server authenticates the user, based on the user name in the client certificate. The following image shows a little more detail about the sequence of events that occurs with mutual SSL. ![A diagram that shows the communication process between a Tableau Server user and the Tableau Server.](/tableau/next/en-us/server-linux/en-us/Img/ssl_mutual02.png) 1. The user navigates to Tableau Server. 2. Tableau Server sends its SSL certificate to the client computer. 3. The client computer verifies the Tableau Server certificate. 4. The client computer sends its certificate to Tableau Server. 5. Tableau Server verifies the client certificate. 6. Tableau Server references the user name in the client certificate to authenticate the user. [Skip to main content](#main-content) # How Relationships Differ from Joins Relationships are a dynamic, flexible way to combine data from multiple tables for analysis. You don't define join types for relationships, so you won't see a Venn diagram when you create them. Think of a relationship as a contract between two tables. When you are building a viz with fields from these tables, Tableau brings in data from these tables using that contract to build a query with the appropriate joins. - **No up-front join type**. You only need to select matching fields to define a relationship ([no join types](#WhereAreJoins)). Tableau first attempts to create the relationship based on existing key constraints and matching field names. You can then check to ensure they are the fields you want to use, or add more field pairs to better define how the tables should be related. - **Automatic and context-aware**. Relationships defer joins to the time and context of analysis. Tableau automatically selects join types based on the fields being used in the visualization. During analysis, Tableau adjusts join types intelligently and preserves the native level of detail in your data. You can see aggregations at the level of detail of the fields in your viz rather than having to think about the underlying joins. You don't need to use LOD expressions such as FIXED to deduplicate data in related tables. - **Flexible**. Relationships can be many-to-many and support full outer joins. When you combine tables using relationships, it's like creating a custom, flexible data source for every viz, all in a single data source for the workbook. Because Tableau queries only tables that are needed based on fields and filters in a viz, you can build a data source that can be used for a variety of analytic flows. For more information, see [Relate Your Data](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm) and [Don't Be Scared of Relationships.](https://help.tableau.com/current/pro/desktop/en-us/datasource_dont_be_scared.htm) > [!TIP] > > **Joins are still available as an option for combining your data**. Double-click a logical table to go to the join canvas. For more information, see [Where did joins go?](#WhereAreJoins) **Watch a video**: For an introduction to using relationships in Tableau, see this 5-minute video. **Note**: The interface for editing relationships shown in this video might differ slightly from the current release but has the same functionality. Also see video podcasts on relationships from [Action Analytics](https://action-analytics.com/library/), such as [Why did Tableau Invent Relationships?](https://action-analytics.com/ep-1-why-did-tableau-invent-relationships/) Click "Video Podcast" in the [Library](https://action-analytics.com/library/) to see more. For related information about how relationship queries work, see these Tableau blog posts: - [Relationships, part 1: Introducing new data modeling in Tableau](https://www.tableau.com/about/blog/2020/5/relationships-part-1-meet-new-tableau-data-model) - [Relationships, part 2: Tips and tricks](https://www.tableau.com/about/blog/2020/5/relationships-part-2-tips-and-tricks) - [Relationships, part 3: Asking questions across multiple related tables](https://www.tableau.com/about/blog/2020/6/relationships-part-3-asking-questions-across-multiple-related-tables) ## Characteristics of relationships and joins Relationships are a dynamic, flexible way to combine data from multiple tables for analysis. We recommend using relationships as your first approach to combining your data because it makes data preparation and analysis easier and more intuitive. [Use joins only when you absolutely need to](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_faq.htm#can-i-use-joins-between-logical-tables). Here are some advantages to using relationships to combine tables: - Make your data source easier to define, change, and reuse. - Make it easier to analyze data across multiple tables at the correct level of detail (LOD). - Do not require the use of LOD expressions or LOD calculations for analysis at different levels of detail. - Only query data from tables with fields used in the current viz. ### Relationships - Are displayed as flexible noodles between logical tables - Require you to select matching fields between two logical tables - Do not require you to select join types - Make all row and column data from related tables potentially available in the data source - Maintain each table's level of detail in the data source and during analysis - Create independent domains at multiple levels of detail. Tables aren't merged together in the data source. - During analysis, create the appropriate joins automatically, based on the fields in use. - Do not duplicate aggregate values (when Performance Options are set to Many-to-Many) - Keep unmatched measure values (when Performance Options are set to Some Records Match) ### Joins Joins are a more static way to combine data. Joins must be defined between physical tables up front, before analysis, and can't be changed without impacting all sheets using that data source. Joined tables are always merged into a single table. As a result, sometimes joined data is missing unmatched values, or duplicates aggregated values. - Are displayed with Venn diagram icons between physical tables - Require you to select join types and join clauses - Joined physical tables are merged into a single logical table with a fixed combination of data - May drop unmatched measure values - May duplicate aggregate values when fields are at different levels of detail - Support scenarios that require a single table of data, such as extract filters and aggregation ## Requirements for using relationships - When relating tables, the fields that define the relationships must have the same data type. Changing the data type in the Data Source page does not change this requirement. Tableau will still use the data type in the underlying database for queries. - You can't define relationships based on geographic fields. - Circular relationships aren't supported in the data model. - You can't define relationships between published data sources. ### Factors that limit the benefits of using related tables - Dirty data in tables (i.e. tables that weren't created with a well-structured model in mind and contain a mix of measures and dimensions in multiple tables) can make multi-table analysis more complex. - Using data source filters will limit Tableau's ability to do join culling in the data. Join culling is a term for how Tableau simplifies queries by removing unnecessary joins. - Tables with a lot of unmatched values across relationships. - In versions 2020.2 through 2024.1: Interrelating multiple fact tables with multiple dimension tables (attempting to model shared or conformed dimensions). In version 2024.2 and later, you can use multi-fact relationships to address these cases. For more information, see [Multi-fact analysis with relationships](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel.htm#multifact-analysis) and [About Multi-fact Relationship Data Models](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm). ## Where did joins go? You can still specify joins between tables in the physical layer of a data source. Double-click a logical table to go to the Join/Union canvas in the physical layer and add joins or unions. Every top-level, logical table contains at least one physical table. Open a logical table to view, edit, or create joins between its physical tables. Right-click a logical table, and then click Open. Or, just double-click the table to open it. ![Data model with two joins.](/tableau/next/en-us/server-linux/en-us/Img/data_model_singletable_joins.gif) When you create a data source, it has two layers. The top-level layer is the logical layer of the data source. You combine data between tables in the logical layer using relationships. The next layer is the physical layer of the data source. You combine data between tables at the physical layer using joins. For more information, see [Logical and physical tables in the data model](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel.htm). ![A data model diagram displays a logical layer with two tables linked by a relationship, and a physical layer that illustrates how the logical tables are constructed from physical tables.](/tableau/next/en-us/server-linux/en-us/Img/data_model_layers_sm.png) [Skip to main content](#main-content) # How Scheduled Server Jobs are Prioritized ## Jobs and Tasks In Tableau Server, users can schedule extract refreshes, subscriptions, or flows to run periodically. These **scheduled items** are referred to as **tasks**. The Backgrounder process initiates unique instances of these tasks to run them at the scheduled time. The **unique instances of the tasks** that are initiated as a result are referred to as **jobs**. **Jobs** are also created for runs that are initiated **manually**, by clicking the **Run now** option. For example, an extract refresh task is created to run daily at 9 AM. This is an extract refresh task, and every day at 9 AM, a job will be created for the Backgrounder to run. You can assign a priority number to Tasks and Schedules using values from 1 to 100. Lower the number, higher the priority, 1 is the highest priority, and 100 is the lowest. ## Priority Rules for Jobs When processing scheduled extract refreshes, subscriptions and flow runs, Tableau Server prioritizes background jobs in this order: 1. Any job already in process is completed first. 2. Any task or schedule that you initiate manually using Run now starts when the next backgrounder process becomes available. Exception to this are the flow tasks and schedules. Flow runs use the assigned task priority to determine the order in when they should run. If there is no task priority assigned it defaults to 0 which is the highest priority. Note: Learn how to restrict Run now settings- [Server Settings (General and Customization)](https://help.tableau.com/v0.0/server-linux/en-us/maintenance_set.htm). 3. Jobs with the highest priority (the lowest number) start next, independent of how long they have been in the queue. For extract refreshes and flows, this is the task priority. The task priority is inherited from the schedule priority when the task is first created. The task priority can be subsequently changed but the task priority returns to the default value when the data source is republished. For subscriptions, this is the schedule priority. If you have enabled custom schedules for subscriptions, then the priority of those jobs is set to 50. For example, a job with a priority of 20 will run before a job with a priority of 50, even if the second job has been waiting longer. To change task priority, see [Create or Modify a Schedule](https://help.tableau.com/v0.0/server-linux/en-us/schedule_manage_create.htm). 4. Jobs with the same priority are executed in the order they were added to the queue. The first job added to the queue starts first; then the second job starts. 5. When multiple jobs with the same priority are scheduled to run at the same time, they start in the order they were created or enabled. Jobs scheduled for the same time are executed by task type with the fastest category of jobs starting first: flow runs, followed by data driven alerts, followed by system jobs, followed by subscriptions, followed by extract creation, followed by incremental extracts, and then full extracts. Flows that are scheduled to run as part of a linked task are all assigned the same priority and run in the order they are defined in the linked task. For more information about linked tasks, see [Schedule linked tasks](https://help.tableau.com/current/server/en-us/prep_conductor_schedule_flow_task.htm#linked_tasks). 6. As the last tie breaking measure, the Backgrounder uses the historical run time. Jobs that have run faster in the previous runs, will be prioritized over jobs that have taken longer historically. **Note:** Setting backgrounder resource limits on a specific site will have an additional queue as these jobs are picked up after other higher priority jobs. For details, see [Tableau Server Backgrounder Resource Limits](https://help.tableau.com/v0.0/server-linux/en-us/server-backgrounder-resource-limits.htm). The following limitations also impact when the jobs are run: - The number of concurrent jobs is limited to the number of backgrounder processes you have configured for Tableau Server. - Separate refreshes for the same extract or data source cannot run at the same time. - Jobs associated with a schedule that is set to run serially run one at a time. [Skip to main content](#main-content) # How Tableau Server Upgrade Works When upgrading from Tableau Server 2018.2 or later, you do not uninstall the previous version. The upgrade process is designed to install a new version side-by-side with your existing version, and then switch from the earlier version to the later one. When doing a TSM-to-TSM upgrade (version 2018.2.x to later version), you must leave your existing version in place and running until just before you upgrade using the upgrade script. If you uninstall your existing version before upgrading, you will not be able to upgrade. For your end-users, this has the impact of reducing downtime because you install your new version while the existing version is running. The only time the server is not running is during the period the upgrade script is actually upgrading to the new version. After installing the new version and upgrading, you can uninstall the previous version when you choose to do so. You can leave the older version installed indefinitely, though one reason you might choose to uninstall it is to free up disk space used by files specific to the older version. To understand the difference between uninstalling Tableau Server and completely removing all aspects of Tableau Server, see [Uninstall Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/uninstall_server.htm). Upgrading Tableau Server requires a stop and start the server as part of the upgrade process. During this stop/restart Tableau Server is unavailable. [Skip to main content](#main-content) # HTTP 401 - Not Authorized If you receive a **401- Not Authorized error**, it could be for one of the following reasons: - You may have configured Tableau Server to use Active Directory with SSPI. If your web server uses SSPI, you do not need to set up trusted authentication. You can embed views and your users will have access to them as long as they are licensed Tableau server users and members of your Active Directory. For more information, see [tsm authentication sspi ](https://help.tableau.com/v0.0/server-linux/en-us/cli_authentication_tsm.htm#TSMSspi). **Note:** SSPI can only be configured on Tableau Server for Windows. - Or a **302- Redirect error** after you have deployed Tableau Server, then it's likely the trusted ticket code you have written to construct the URL for the client has not been updated to account for the two-part ticket URL format. For more information, see [Get a Ticket from Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_webrequ.htm). [Skip to main content](#main-content) # HTTP 404 - File Not Found You may receive this error if your program code references a Tableau Server URL that does not exist. For example, your web server may construct an invalid URL that cannot be found when the webpage tries to retrieve it. Another cause for this error is if you did not enter the trusted web servers as specified in [Add Trusted IP Addresses or Host Names to Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/trusted_auth_trustIP.htm). If you have already entered the trusted web servers, verify that the IP addresses or host names are correct. [Skip to main content](#main-content) # HTTP Response Headers Tableau Server supports some of the response headers specified in the [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/#div-headers). This topic describes how to configure the following response headers for Tableau Server: - HTTP Strict Transport Security (HSTS) - Referrer-Policy - X-Content-Type-Options - X-XSS-Protection Tableau Server also supports the Content Security Policy (CSP) standard. CSP configuration is not covered in this topic. See [Content Security Policy](https://help.tableau.com/v0.0/server-linux/en-us/security_csp.htm). ## Configuring response headers All response headers are configured with the [tsm configuration set](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration_tsm.htm#TSMSet) command. When you are finished configuring response headers, run [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). ## HTTP Strict Transport Security (HSTS) HSTS forces clients connecting to Tableau Server to connect with HTTPS. For more information see the OWASP entry, [HTTP Strict Transport Security (HSTS)](https://owasp.org/www-project-secure-headers/#div-headers). ### Options gateway.http.hsts Default value: `false` The HTTP Strict Transport Security (HSTS) header forces browsers to use HTTPS on the domain where it is enabled. gateway.http.hsts\_options Default value: `"max-age=31536000"` By default, HSTS policy is set for one year (31536000 seconds). This time period specifies the amount of time in which the browser will access the server over HTTPS. ## Referrer-Policy Beginning in 2019.2, Tableau Server includes the ability to configure Referrer-Policy HTTP header behavior. This policy is enabled with a default behavior that will include the origin URL for all "secure as" connections (policy `no-referrer-when-downgrade`). In previous versions, the Referrer-Policy header was not included in responses sent by Tableau Server. For more information about the various policy options that Referrer-Policy supports, see the OWASP entry, [Referrer-Policy](https://owasp.org/www-project-secure-headers/#div-headers). ### Options gateway.http.referrer\_policy\_enabled Default value: `true` To exclude the Referrer-Policy header from responses sent by Tableau Server, set this value to `false`. gateway.http.referrer\_policy Default value: `no-referrer-when-downgrade` This option defines the referrer policy for Tableau Server. You may specify any of the policy value strings listed in the [Referrer-Policy](https://owasp.org/www-project-secure-headers/#div-headers) table on the OWASP page. ## X-Content-Type-Options The X-Content-Type-Options response HTTP header specifies that the MIME type in the Content-Type header should not be changed by the browser. In some cases, where MIME type is not specified, a browser may attempt to determine the MIME type by evaluating the characteristics of the payload. The browser will then display the content accordingly. This process is referred to as "sniffing." Misinterpreting the MIME type can lead to security vulnerabilities. For more information see the OWASP entry, [X-Content-Type-Options](https://owasp.org/www-project-secure-headers/#div-headers). ### Option gateway.http.x\_content\_type\_nosniff Default value: `true` The X-Content-Type-Options HTTP header is set to 'nosniff' by default with this option. ## X-XSS-Protection The HTTP X-XSS-Protection response header is sent to the browser to enable cross-site scripting (XSS) protection. The X-XSS-Protection response header overrides configurations in cases where users have disabled XXS protection in the browser. For more information see the OWASP entry, [X-XSS-Protection](https://owasp.org/www-project-secure-headers/#div-headers). ### Option gateway.http.x\_xss\_protection Default value: `true` The X-XSS-Protection response header is enabled by default with this option. ## Other articles in this section [Skip to main content](#main-content) # Hyper Query Processing (Beta) **Note:** Since Hyper Query Processing is a Beta release the name can change before general release. The Customer Data Platform (CDP) connector is now powered with the Hyper Query Processing Engine. It supports interactive analytics with fast data query processing and simplifies the connect-to- data experience for faster data exploration. The Hyper query processing engine speeds up query time when querying Customer Data Platform data from Tableau with live connections and Tableau data extracts. > [!IMPORTANT] > > **Beta Feature:** Hyper Query Processing beta feature offers extra functionality at no cost. You can opt to try this service with your sole discretion. Any use of the Beta Service is subject to the applicable Beta Services Terms provided at [Agreements and Terms](https://www.salesforce.com/company/legal/agreements/). ## Enable Hyper Query Processing in Tableau Server Complete the following steps to enable Hyper Query Processing. 1\. Connect to Salesforce CDP. 2\. Follow the directions on the screen to install the hyper jdbc driver. `-Salesforce-cdp-hyper-beta-1.15.0.jar` or download the .jar file from [here](https://github.com/forcedotcom/Salesforce-CDP-jdbc/releases). 3\. Move the downloaded file to any of the following directory paths depending on your system. Windows - `C:\Program Files\Tableau\Drivers` macOS - `/Users/[user]/Library/Tableau/Drivers` 4\. After you’ve moved the driver to the correct path, connect again. Your Customer Data Platform connector is ready to use in Tableau Server. **Note:** The Hyper Query Processing support is a beta release. It’s available for Tableau Server. Tableau Desktop and Tableau Online will be supported from December 2022. These dates are subject to change. ### See Also - Tableau Help: [Connect Tableau Server to the Customer Data Platform](https://help.tableau.com/current/server-linux/en-us/config_oauth_sfdc_cdp.htm) - Salesforce Help: [Set Up Tableau in Customer Data Platform](https://help.salesforce.com/s/articleView?id=sf.c360_a_set_up_tableau_connected_app.htm&type=5&language=en_US) - Salesforce Help: [Enable Customer Data Platform in Tableau](https://help.salesforce.com/s/articleView?id=sf.c360_a_enable_tableau_connector.htm&type=5&language=en_US) - Salesforce Help: [Using Customer Data Platform Data in Tableau](https://help.salesforce.com/s/articleView?id=sf.c360_a_using_customer_360_aud_data_in_tableau.htm&type=5&language=en_US) [Skip to main content](#main-content) # Hyper Spooling Incidents _Hyper Spooling_ incidents will be logged as a warning when Hyper queries are spooled to disk. Typically, this happens when there is not enough available memory and the Tableau Server Data Engine process shifts to spooling by temporarily writing to disk. The [Tableau Server Data Engine](https://help.tableau.com/v0.0/server-linux/en-us/data_engine2_intro.htm) topic describes this in more detail in the memory usage section. ## Who can do this Resource Monitoring Tool Administrator or a Resource Monitoring Tool user with **Server/Environment Management** role. [Skip to main content](#main-content) # Identity Store Tableau Server requires an identity store to manage user and group information. There are two kinds of identity stores: local and external. When you install Tableau Server you must configure either a local identity store or an external identity store. For information about configuration options for the identity store, see [identityStore Entity](https://help.tableau.com/v0.0/server-linux/en-us/entity_identity_store.htm) and [External Identity Store Configuration Reference](https://help.tableau.com/v0.0/server-linux/en-us/ldap_config.htm). For more information about adding more flexibility to the single identity store model, see [Provision and Authenticate Users Using Identity Pools](https://help.tableau.com/v0.0/server-linux/en-us/identity_pools.htm). ## Local identity store When you configure Tableau Server with a local identity store, all user and group information is stored and managed in the Tableau Server repository. In the local identity store scenario, there is no external source for users and groups. ## External identity store When you configure Tableau Server with an external store, all user and group information is stored and managed by an external directory service. Tableau Server must synchronize with the external identity store so that local copies of the users and groups exist in the Tableau Server repository, but the external identity store is the authoritative source for all user and group data. If you have configured the Tableau Server identity store to communicate with an external LDAP directory, then all users (including the initial admin account) that you add to Tableau Server must have an account in the directory. When Tableau Server is configured to use an external LDAP directory, you must first import user identities from the external directory into the Tableau Server repository as system users. When users sign in to Tableau Server, their credentials are passed to the external directory, which is responsible for authenticating the user; Tableau Server does not perform this authentication. However, the Tableau user names stored in the identity store are associated with rights and permissions for Tableau Server. Therefore, after authentication is verified, Tableau Server manages user access (authorization) for Tableau resources. Active Directory is an example of an external user store. Tableau Server is optimized to interface with Active Directory. For example, when you install Tableau Server on an Active Directory domain-joined computer using the [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm#tsm-ui-steps), Setup will detect and configure most Active Directory settings. If, on the other hand, you are using TSM CLI to install Tableau Server, you must specify all the Active Directory settings. In this case, be sure to use the [LDAP - Active Directory](https://help.tableau.com/v0.0/server-linux/en-us/entity_identity_store.htm#LDAP) template to configure identity store. If you are installing into Active Directory, we recommend that you review [User Management in Deployments with External Identity Stores](https://help.tableau.com/v0.0/server-linux/en-us/users_manage_ad.htm) before you deploy. For all other external stores, Tableau Server supports LDAP as a generic way to communicate the identity store. For example, OpenLDAP is one of several LDAP server implementations with a flexible schema. Tableau Server can be configured to query the OpenLDAP server. To do so, the directory administrator must provide information about the schema. During setup, you must use [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm#tsm-cli-steps) to configure a connection to other LDAP directories. ## LDAP bind Clients that wish to query a user store using LDAP must authenticate and establish a session. This is done by binding. There are multiple ways to bind. Simple binding is authenticating with a username and password. For organizations that connect to Tableau Server with simple bind, we recommend configuring an SSL encrypted connection, otherwise the credentials are sent over the wire in plaintext. Another type of binding Tableau Server supports is GSSAPI binding. GSSAPI uses Kerberos to authenticate. In Tableau Server’s case, Tableau Server is the client and the external user store is the LDAP server. ### LDAP with GSSAPI (Kerberos) bind We recommend binding to LDAP directory with GSSAPI using a keytab file to authenticate to the LDAP server. You will need a keytab file specifically for the Tableau Server service. We also recommend encrypting the channel with the LDAP server using SSL/TLS. See [Configure Encrypted Channel to LDAP External Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/config_encrypt_ldap.htm). If you are installing into Active Directory, and the computer where you are installing Tableau Server is already joined to the domain, then the computer may already have a configuration file and a keytab file. In this case, the Kerberos files are for the operating system functionality and authentication. Strictly speaking, you can use these files for GSSAPI bind, but we don't recommend using them. Instead, contact your Active Directory administrator and request a keytab specifically for the Tableau Server service. See [Understanding Keytab Requirements](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_keytab.htm). Assuming your operating system has a properly configured keytab for authentication to the domain, then the Kerberos keyfile for GSSAPI bind is all you need for the base installation of Tableau Server. If you plan to use Kerberos authentication for users, then [configure Kerberos for user authentication](https://help.tableau.com/v0.0/server-linux/en-us/config_kerberos.htm) and [Kerberos delegation to data sources](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_delegation.htm) after installation is complete. ### LDAP over SSL By default, LDAP with simple bind to arbitrary LDAP servers is not encrypted. User credentials that are used to establish the bind session with the LDAP server are communicated in plaintext between Tableau Server and the LDAP server. We strongly recommend that you encrypt the channel between Tableau Server and the LDAP server. Beginning with version 2021.2, Tableau Server on Linux requires an encrypted LDAP channel when you use Active Directory as an identity store. You must install a valid SSL/TSL certificate before installing or upgrading to 2021.2 or newer. Although not recommended, you can also disable the default encrypted LDAP channel. For more information about enabling or disabling encryption for Active Directory and other LDAP servers, see [Configure Encrypted Channel to LDAP External Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/config_encrypt_ldap.htm). ## System user and groups Tableau Server on Linux uses one user, and two groups for proper operation. The user and groups can be local or from an LDAP directory service. ### User Tableau Server requires a service account. This account is an unpriviledged user with normal login privileges. By default, Tableau Server installation will created a local user, `tableau`, for the service account. If you want to use an existing user account for the Tableau Server service account then you must disable account creation during installation. Specifically, you will need to set the `--disable-account-creation` option when you run the initialize-tsm script. You will also need to specify the account name with the `--unprivileged-user` option. If the account that you specify does not exist, then the initialize-tsm script will create it. See [Help Output for initialize-tsm Script](https://help.tableau.com/v0.0/server-linux/en-us/initialize_tsm-h.htm) for more details. If you want to specify an existing account with the `--unprivileged-user` option, verify that the user account is an unprivileged user with normal login privileges. Configure the account with the following characteristics: - Shell set to `/bin/bash`. - For convenience, consider setting the home directory to the data directory path. The account must have ownership and write privileges to the home directory. If you specify a different unprivileged account during setup, you must manually add that same user to the systemd-journal group. The unprivileged user must be a member of the systemd-journal group so that Tableau Server can collect logs from some services (such as Ask Data) when running the [tsm maintenance ziplogs](https://help.tableau.com/v0.0/server-linux/en-us/cli_maintenance_tsm.htm#tsm4ziplogs) command. If the unprivileged user is not a member of the group, ziplogs will not contain logs from the affected services ### Groups Tableau Server requires two groups for operation. In a default installation, the local `tableau` service account belongs to a primary group named `tableau`. However, if you specify an alternate unprivileged user during installation, then the primary group for that alternate account will be used. As a convenience, any account can be added to this group to be able to read the Tableau Server log files (without becoming root). The second group is used to authorize which users are authorized to authenticate to Tableau Services Manager (TSM). Any user in this group will be able to send commands to TSM, so it should be restricted to Tableau Server administrators. By default, this group is named `tsmadmin`. If you are not going to use the default name, you will need to specify the group name with the `--tsm-authorized-group` option when you run initialize-tsm. See [Help Output for initialize-tsm Script](https://help.tableau.com/v0.0/server-linux/en-us/initialize_tsm-h.htm) for more details. ## Authenticating clients Basic user authentication in Tableau Server is by username and password sign-in for both local and external user stores. In the local case, user passwords are stored as a hashed password in the repository. In the external case, Tableau Server passes the credentials to the external user store and awaits a response as to whether the credentials are valid. External user stores can also handle other kinds of authentication like Kerberos, but the concept is still the same, Tableau Server delegates the credentials or user to the external store and awaits a response. You can configure Tableau Server such that username-password sign-in is disabled. In these scenarios other authentication methods, such as trusted authentication, OpenID, or SAML can be used. See [Authentication](https://help.tableau.com/v0.0/server-linux/en-us/security_auth.htm). In some cases, you may need to update LDAP external directories to allow bind operations with username + DN format from Tableau Server. See [User binding behavior on sign in](https://help.tableau.com/v0.0/server-linux/en-us/users_manage_ad.htm#User). [Skip to main content](#main-content) # identityStore Entity Tableau Server requires an identity store to store user and group information. Review [Authentication](https://help.tableau.com/v0.0/server-linux/en-us/security_auth.htm) and [Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm) topics before configuring the identity store for the first time. After you have installed the identity store on Tableau Server, you cannot change it without reinstalling the server. **Important:** All entity options are case sensitive. ## Before you begin Review the following information: - If you will not be using the local identity store, then you will be using some version of LDAP. In this case, work with your directory/LDAP administrator to configure Tableau Server for your LDAP schema and bind requirements. - Tableau Server configuration is optimized for Active Directory. If you are installing into Active Directory, we recommend configuring the identity store with [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm#tsm-ui-steps). - LDAP bind is independent of user authentication. For example, you can configure Tableau Server to use simple bind to authenticate to the LDAP directory and then configure Tableau Server to authenticate users with Kerberos after installation. - Do not connect to LDAP with simple bind over an unsecured connection. By default, LDAP with simple bind sends data in cleartext. Use LDAPS to encrypt traffic with simple bind. See [Configure Encrypted Channel to LDAP External Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/config_encrypt_ldap.htm). - To use Kerberos authentication for the LDAP bind with Tableau Server service, then you'll need a keytab file for GSSAPI bind, as described in the sections below. See also, [Understanding Keytab Requirements](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_keytab.htm). In the context of Kerberos, GSSAPI bind is all you need during the base installation of Tableau Server. After you install the server, you can then [configure Kerberos for user authentication](https://help.tableau.com/v0.0/server-linux/en-us/config_kerberos.htm) and [Kerberos delegation to data sources](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_delegation.htm). - In this topic, we make the distinction between _LDAP_ (the protocol for connecting to directory services) and an _LDAP server_ (an implementation of a directory service). For example, `slapd` is an LDAP server that is part of the OpenLDAP project. - Validate the LDAP configuration before initializing the server, see [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm). - Import JSON configuration files only as part of the initial configuration. If you need to make LDAP changes after you have imported the JSON configuration file and initialized Tableau Server, do not attempt to re-import the JSON file. Rather, make individual key changes with native tsm commands or with `tsm configuration set`. See [External Identity Store Configuration Reference](https://help.tableau.com/v0.0/server-linux/en-us/ldap_config.htm). ## Configuration templates The JSON templates in this section are used to configure Tableau Server with different identity store scenarios. Unless you're configuring a local identity store, you will need to select and edit a configuration file template that is specific to your LDAP environment. Consider using the [Tableau Identity Store Configuration Tool](https://tagyoureit.github.io/tableau-identitystore-config-tool/) to help generate your LDAP JSON configuration file. The tool itself is not supported by Tableau. However, using a JSON file created by the tool instead of creating a file manually does not change the supported status of your server. Select an identity store configuration template to edit: - Local - LDAP - Active Directory - OpenLDAP - GSSAPI Bind - OpenLDAP - Simple Bind For more explanation about configuration files, entities, and keys see [Configuration File Example](https://help.tableau.com/v0.0/server-linux/en-us/config_file_example.htm). ### Local Configure local as the identity store type if your organization does not already have an Active Directory or LDAP server for user authentication. When you select local as the identity store type, you use Tableau Server to create and manage users. An alternative way to configure Tableau Server for local identity store is to run Setup GUI and select "Local" during the installation process. See [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm). { "configEntities": { "identityStore": { "\_type": "identityStoreType", "type": "local" } } } ![](/tableau/next/en-us/server-linux/en-us/Img/Road-sign-alert.png) ### Important The LDAP configuration templates below are examples. The templates, as presented, will not configure LDAP connectivity in your organization. You must work with your directory administrator to edit the LDAP template values for a successful deployment. Additionally, all files that are referenced in configEntities must be located on the local computer. Do not specify UNC paths. ### LDAP - Active Directory Tableau Server configuration is optimized for Active Directory. If you are installing into Active Directory, configure the identity store with [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm#tsm-ui-steps). An encrypted connection to Active Directory is required.See [Configure Encrypted Channel to LDAP External Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/config_encrypt_ldap.htm). If for some reason you are unable to configure the identity store to communicate with Active Directory with TSM web interface, use this JSON template to configure Tableau Server to connect to Active Directory. This template uses GSSAPI (Kerberos) bind to authenticate Tableau Server service to Active Directory. Tableau Server includes support for Active Directory schema. Therefore, if you set the `"directoryServiceType"` option to `"activedirectory"` then you do not need to provide schema info in the `"identityStoreSchemaType"` option. If you are installing Tableau Server for Linux into Active Directory, and the computer where you are installing Tableau Server is already joined to the domain, then the computer will already have a Kerberos configuration file and a keytab file. Strictly speaking, you can use these files for GSSAPI bind, but we don't recommend using them. Instead, contact your Active Directory administrator and request a keytab specifically for the Tableau Server service. { "configEntities":{ "identityStore": { "\_type": "identityStoreType", "type": "activedirectory", "domain": "your-domain.lan", "nickname": "YOUR-DOMAIN-NICKNAME", "directoryServiceType": "activedirectory", "bind": "gssapi", "kerberosKeytab": "", "kerberosConfig": "/etc/krb5.conf", "kerberosPrincipal": "your-principal@YOUR.DOMAIN" } } } We recommend binding to Active Directory with GSSAPI. However, you can connect with simple bind and LDAPS. To connect with simple bind, change `bind` to `simple`, remove the three Kerberos entities, and add the `port`/`sslPort`, `username`, and `password` options. The following example shows Active Directory with simple bind json. { "configEntities":{ "identityStore": { "\_type": "identityStoreType", "type": "activedirectory", "domain": "your-domain.lan", "nickname": "YOUR-DOMAIN-NICKNAME", "directoryServiceType": "activedirectory", "hostname": "optional-ldap-server", "sslPort": "636", "bind": "simple", "username": "username", "password": "password" } } } ### OpenLDAP - GSSAPI bind Use the template below to configure OpenLDAP with GSSAPI bind. Do not use this template if your organization is running Active Directory. If you are installing into Active Directory, use the template above, LDAP - Active Directory. In most cases, organizations that use OpenLDAP with GSSAPI (Kerberos) will use a keytab file to store credentials. In the following example, a keytab file is used for authentication credentials. However, you can provide credentials through the `username` and `password` entities. You can also specify both a keytab and a username and password pair. In this case, Tableau Server will attempt to use the keytab, but if authentication fails for any reason it will fallback and use the username and password credentials. { "configEntities":{ "identityStore": { "\_type": "identityStoreType", "type": "activedirectory", "domain": "your-domain.lan", "nickname": "YOUR-DOMAIN-NICKNAME", "directoryServiceType": "openldap", "bind": "gssapi", "kerberosKeytab": "", "kerberosConfig": "/etc/krb5.conf", "kerberosPrincipal": "your-principal@YOUR.DOMAIN", "identityStoreSchemaType": { "userBaseFilter": "(objectClass=inetOrgPerson)", "userUsername": "user", "userDisplayName": "displayname", "userEmail": "email", "userCertificate": "certificate", "userThumbnail": "thumbnail", "userJpegPhoto": "photo", "groupBaseFilter": "(objectClass=groupofNames)", "groupName": "groupname", "groupEmail": "groupemail", "groupDescription": "groupdescription", "member": "member", "distinguishedNameAttribute": "", "serverSideSorting": "", "rangeRetrieval": "", "userClassNames": \["inetOrgPerson","someClass2"\], "groupClassNames": \["groupOfUniqueNames1","groupOfUniqueNames2"\] } } } } ### OpenLDAP - Simple bind { "configEntities":{ "identityStore": { "\_type": "identityStoreType", "type": "activedirectory", "domain": "my.root", "nickname": "", "hostname": "optional-ldap-server", "port": "389", "directoryServiceType": "openldap", "bind": "simple", "username": "cn=username,dc=your,dc=domain", "password": "password", "identityStoreSchemaType": { "userBaseFilter": "(objectClass=inetOrgPerson)", "userUsername": "user", "userDisplayName": "displayname", "userEmail": "email", "userCertificate": "certificate", "userThumbnail": "thumbnail", "userJpegPhoto": "photo", "groupBaseFilter": "(objectClass=groupofNames)", "groupName": "groupname", "groupEmail": "groupemail", "groupDescription": "groupdescription", "member": "member", "distinguishedNameAttribute": "", "serverSideSorting": "", "rangeRetrieval": "", "userClassNames": \["inetOrgPerson","someClass2"\], "groupClassNames": \["groupOfUniqueNames1","groupOfUniqueNames2"\] } } } } ## Configuration template reference ### Shared identity store options type Where you want to store user identity information. Either `local` or `activedirectory`. (If you want to connect to any LDAP server, select `activedirectory`.) domain The domain of the computer where you installed Tableau Server. nickname The nickname of the domain. This is also referred to as the NetBIOS name in Windows environments. The `nickname` option is required for all LDAP entities. If your organization does not require a nickname/NetBIOS, then pass a blank key, for example: `"nickname": ""`. ### LDAP GSSAPI bind options directoryservicetype The type of directory service that you want to connect to. Either `activedirectory` or `openldap`. kerberosConfig The path to the Kerberos configuration file on the local computer. If you are installing into Active Directory, we don't recommend using the existing Kerberos configuration file or keytab file that may already be on the domain-joined computer. See [Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm). kerberosKeytab The path to the Kerberos keytab file on the local computer. It is recommended that you create a keytab file with keys specifically for Tableau Server service and that you do not share the keytab file with other applications on the computer. For example, on Linux, you might place the keytab file in the `/var/opt/tableau/keytab` directory. kerberosPrincipal The service principal name for Tableau Server on the host machine. The keytab must have permission for this principal. Do not use the existing system keytab at `/etc/krb5.keytab`. Rather, we recommend that you register a new service principal name. To see principals in a given keytab, run the `klist -k` command. See [Understanding Keytab Requirements](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_keytab.htm). ### LDAP simple bind options directoryservicetype The type of directory service that you want to connect to. Either `activedirectory` or `openldap`. hostname The hostname of the LDAP server. You can enter a hostname or an IP address for this value. The host that you specify here will be used for user/group queries on the primary domain only. If user/group queries are in other domains (not in the primary domain), Tableau Server will not use this value, but instead will query DNS to identify the appropriate domain controller. port Use this option to specify the non-secure port of the LDAP server. Plaintext is usually 389. sslPort Use this option to enable LDAPS. Specify the secure port of the LDAP server. LDAPS is usually port 636. To use LDAPS you must also specify hostname option. See [Configure Encrypted Channel to LDAP External Identity Store](https://help.tableau.com/v0.0/server-linux/en-us/config_encrypt_ldap.htm). username The user name that you want to use to connect to the directory service. The account that you specify must have permission to query the directory service. For Active Directory, enter the username, for example, `jsmith`. For LDAP servers, enter the distinguished name (DN) of the user that you want to use to connect. For example, you might enter `cn=username,dc=your-local-domain,dc=lan`. password The password of the user that you want to use to connect to the LDAP server. #### LDAPS and subdomains If you're enabling LDAPS in Active Directory and connecting to subdomains, you'll need to run the following TSM command to configure the LDAPS port (TCP 636) for subdomains. The command takes arguments that specify `subdomainFQDN:port`. Example: `tsm configuration set -k wgserver.domain.ldap.domain_custom_ports -v subdomain1.lan:636,subdomain2.lan:636,subdomain3.lan:636` For more information, see [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm). ### Shared LDAP options The following options can be set for generic LDAP, OpenLDAP, or Active Directory implementations. bind The way that you want to authentication communication from the Tableau Server service to the LDAP directory service. Enter `gssapi` for GSSAPI (Kerberos). domain In Active Directory environments, specify the domain where Tableau Server is installed, for example, "example.lan". For non-AD LDAP: the string you enter for this value is displayed in the "Domain" column of user management tools. You can enter an arbitrary string, but the key cannot be blank. root LDAP only. Do not specify for Active Directory. If you do not use a dc component in the LDAP root or you want to specify a more complex root you need to set the LDAP root. Use the "o=my,u=root" format. For example, for the domain, `example.lan`, the root would be `"o=example,u=lan"`. membersRetrievalPageSize This option determines the maximum number of results returned by an LDAP query. For example, consider a scenario where Tableau Server is importing an LDAP group that contains 50,000 users. Attempting to import such a large number of users in a single operation is not a best practice. When this option is set to 1500, Tableau Server imports the first 1500 users in the first response. After those users are processed, Tableau Server requests the next 1500 users from the LDAP server, and so forth. We recommend that you modify this option only to accommodate the requirements of your LDAP server. ### `identityStoreSchemaType` options If you configure an LDAP connection to an LDAP server, you can enter schema information specific to your LDAP server in the `identityStoreSchemaType` object. **Important** If you are connecting to Active Directory (`"directoryServiceType": "activedirectory"`), then do not configure these options. userBaseFilter The filter that you want to use for users of Tableau Server. For example, you might specify an object class attribute and an organization unit attribute. userUsername The attribute that corresponds to user names on your LDAP server. userDisplayName The attribute that corresponds to user display names on your LDAP server. userEmail The attribute that corresponds to user email addresses on your LDAP server. userCertificate The attribute that corresponds to user certificates on your LDAP server. userThumbnail The attribute that corresponds to user thumbnail images on your LDAP server. userJpegPhoto The attribute that corresponds to user profile images on your LDAP server. groupBaseFilter The filter that you want to use for groups of users of Tableau Server. For example, you might specify an object class attribute and an organization unit attribute. groupName The attribute that corresponds to group names on your LDAP server. groupEmail The attribute that corresponds to group email addresses on your LDAP server. groupDescription The attribute that corresponds to group descriptions on your LDAP server. member The attribute that describes the list of users in a group. distinguishedNameAttribute The attribute that stores the distinguished names of users. This attribute is optional, but it greatly improves the performance of LDAP queries. serverSideSorting Whether the LDAP server is configured for server-side sorting of query results. If your LDAP server supports server-side sorting, set this option to `true`. If you are unsure whether your LDAP server supports this, enter `false`, as misconfiguration may cause errors. rangeRetrieval Whether the LDAP server is configured to return a range of query results for a request. This means that groups with many users will be requested in small sets instead of all at once. LDAP servers that support range retrieval will perform better for large queries. If your LDAP server supports range retrieval, set this option to `true`. If you are unsure whether your LDAP server supports range retrieval, enter `false`, as misconfiguration may cause errors. groupClassNames By default Tableau Server looks for LDAP group object classes containing the string “group”. If your LDAP group objects do not fit the default class name, override the default by setting this value. You can provide multiple classnames separated by commas. This option takes a list of strings, which requires passing each class in quotes, separated by a comma (no space) and within brackets. For example: `["basegroup","othergroup"]`. userClassNames By default Tableau Server looks for LDAP user object classes containing the string “user” and “inetOrgPerson”. If your LDAP user objects do not use these default class names, override the default by setting this value. You can provide multiple classnames separated by commas. This option takes a list of strings, which requires passing each class in quotes, separated by a comma (no space) and within brackets. For example: `["userclass1",userclass2”]`. ## Importing the JSON file After you have finished editing the JSON file, pass the file and apply settings with the following commands: `tsm settings import -f path-to-file.json` `tsm pending-changes apply` If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). [Skip to main content](#main-content) # Impersonate with a Run As Service Account Impersonating via a Run As service account is the recommended way to perform impersonation. The Run As service account is an Active Directory user account the Tableau Server service can run under on the machine hosting Tableau Server. This same account must have IMPERSONATE permission for the database user accounts in SQL Server. From a data security standpoint, using the Tableau Server Run As service account for impersonation gives the administrator the most control. To set up impersonation with a Run As User account: 1. [Enable Kerberos Service Account Access](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_runas_linux.htm). 2. Create a workbook in Tableau Desktop. When you create the data connection, select Use Windows NT Integrated security for the workbook's live connection to a SQL Server database: ![SQL Server Connection configuration window with the option to log on to the server using Windows NT Integrated security selected.](/tableau/next/en-us/server-linux/en-us/Img/impers_runas_nt.png) 3. In Tableau Desktop, publish the workbook to Tableau Server (Server > Publish Workbook). 4. In the Publish dialog box, click Authentication, then in the Authentication dialog box, select Impersonate via server Run As account from the drop-down list: ![Authentication dialog box with the “Impersonate via server Run As account" option circled.](/tableau/next/en-us/server-linux/en-us/Img/impers_runas_publish.png) 5. Click OK. 6. Test the connection by signing into Tableau Server as a user. When you click a view, you should not be prompted for database credentials and you should only see the data the user is authorized to see. [Skip to main content](#main-content) # Impersonate with Embedded SQL Credentials You can also perform impersonation by having the person who publishes a view embed their SQL Server account credentials in the view. Tableau Server can be running under any type of account, but it will use these credentials, supplied by the publisher, to connect to the database. This may be the right choice for your site if the account that handles the impersonation cannot be an Active Directory (AD) account and if you’re comfortable giving workbook publishers an account with a potentially high permission level on SQL Server. **Note:** To use this approach, [Embedded Credentials](https://help.tableau.com/v0.0/server-linux/en-us/maintenance_set.htm) must be enabled on the server Settings page in Tableau Server: ![A checkbox to enable embedded credentials.](/tableau/next/en-us/server-linux/en-us/Img/embedded.png) To impersonate with the workbook publisher’s SQL account: 1. In Tableau Desktop, create a workbook. When you create the data connection, select Use a specific username and password for the workbook's live connection to a SQL Server database: ![SQL Server Connection configuration window with the option to log on to the server using a specific username and password selected.](/tableau/next/en-us/server-linux/en-us/Img/impers_SQL_sql.png) 2. Publish the workbook to Tableau Server (Server > Publish Workbook). 3. In the Publish dialog box, click Authentication, then in the Authentication dialog box, select Impersonate via embedded password from the drop-down list: ![Authentication dialog box with the “Impersonate via embedded password" option circled.](/tableau/next/en-us/server-linux/en-us/Img/impers_sql_publish.png) 4. Click OK. 5. Test the connection by signing in to Tableau Server as a user. When you click a view, you should not be prompted for database credentials and you should only see the data the user is authorized to see. [Skip to main content](#main-content) # Impersonation Requirements Here’s what you need to use feature: - **Live connections to SQL Server only:** Impersonation can only be used for views that have a live connection to a SQL Server database, version 2005 or newer. - **Individual database accounts:** Each person who’ll be accessing the view must have an explicit, individual account in the SQL Server database to which the view connects. Members of an Active Directory (AD) group cannot be impersonated. For example, if Jane Smith is a member of the AD group Sales, and her database administrator adds the Sales AD group to the SQL Server database, Jane cannot be impersonated. - **Matching credentials and authentication type:** The credentials of each Tableau user's account and their Tableau user authentication type must match their credentials and authentication type in the SQL Server database. For example, if Jane Smith’s Tableau Server user account is `MyCo\jsmith`, the username on the SQL Server database must also be `MyCo\jsmith`. SQL Server must be using Windows Integrated Authentication. - **SQL Server prerequisites:** In SQL Server you should have a data security table, a view that enforces data security, and you should require that your database users use the view. - **SQL IMPERSONATE account:** You need a SQL Server database account that has IMPERSONATE permission for the above database users. This is either an account with the sysadmin role or one that has been granted IMPERSONATE permission for each individual user account (see the [MSDN article on EXECUTE AS](http://msdn.microsoft.com/en-us/library/ms181362.aspx)). The SQL Server account must be one of the following: - The Tableau Server Run As service account. See [Enable Kerberos Service Account Access](https://help.tableau.com/v0.0/server-linux/en-us/kerberos_runas_linux.htm). - The workbook publisher's account. See [Impersonate with Embedded SQL Credentials](https://help.tableau.com/v0.0/server-linux/en-us/impers_SQL.htm). [Skip to main content](#main-content) # Import Users To automate the process of adding users to a site, you can create a CSV file that contains user information, and then import the file. Site administrators or a user with an admin profile with sufficient capabilities can import users to a particular site; server administrators (Tableau Server only) can import users at the server level, to later add them to multiple sites. **Note:** This topic contains the steps for importing, assuming that you have already created the CSV file. If you have not created the file yet, see [CSV Import File Guidelines](https://help.tableau.com/v0.0/server-linux/en-us/csvguidelines.htm) for a list of file format requirements and import options. ## Add users from a CSV file The following steps describe how to add users to a site or to the server. The images reflect adding users at the site level. 1. Do one of the following: - To add users at the site level, select Users, and then Add Users. ![Add Users button selected to reveal options for adding users to the site, with the Import from File option selected.](/tableau/next/en-us/server-linux/en-us/Img/import_users_csv.png) - To add users at the server level on a **single-site** server, select Users, and then Add Users. - To add users at the server level on a **multi-site** server, open the list of sites, and select Manage All Sites. Select Users, and then Add Users. 2. Click Import Users From File, click Browse and navigate to the file, and then click Import Users. ![A dialog box to import users from a file.](/tableau/next/en-us/server-linux/en-us/Img/users_import_local.png) Tableau displays the results of the import process. ![Import Users success dialog.](/tableau/next/en-us/server-linux/en-us/Img/users_import_local2.png) 3. Click Done. ## How users’ site roles are assigned or maintained When you import at the site level or on a single-site server using `tabcmd`, you can specify the site role for all users in the CSV file. If a user already exists in the Tableau Server site, the site role assigned during the import process will be applied, even if it is more restrictive than users’ existing site role. The exception is that you cannot affect a server administrator’s site role. For a multi-site server, when you import users in the Server Users page, you create server users with no site affiliation. Because these users do not belong to a site, they cannot have a site role. The only site role a user can have at the server level is Unlicensed or Server Administrator. You can also specify the user’s site role when you assign site membership to a user. For information, see [Manage users’ site membership](https://help.tableau.com/v0.0/server-linux/en-us/users_view.htm#manage-site-membership). ## Importing at the server level in multi-site environments If the server is running multiple sites and you are a server administrator, you can import a CSV file from two locations. Where existing user accounts are concerned, each location has different capabilities. - The Server Users page appears in a multi-site environment. Only server administrators can access this page. ![A table of server users, including their display names, usernames, site roles, number of groups, and last sign-in dates.](/tableau/next/en-us/server-linux/en-us/Img/usersimport_srvrusers.png) You can import the CSV file from here if you want to update existing user accounts in addition to adding new ones. For example, if you import a file that has a new password for each existing user, their passwords will be reset. - The Site Users page. ![A table of site users, including their display names, usernames, site roles, number of groups, and last sign-in dates.](/tableau/next/en-us/server-linux/en-us/Img/usersimport_siteusers.png) Server administrators can add new user accounts with CSV imports. If the CSV file includes existing users, the Password and Display Name fields must either match the existing or be left blank. If new passwords or full names are used, the import will fail. ## Importing to a single-site environment Server and site administrators on a single-site server perform CSV user imports from the Users page in a site. ![A table that lists site users, their usernames, roles, number of groups, and last sign-in date.](/tableau/next/en-us/server-linux/en-us/Img/userimport_ss_users.png) ## Multi-site versus single-site import Users can belong to more than one site on the same server, but they must use the same credentials for each site. This becomes important when you're adding users to a site and those users might already be members of a different site. If you try to import a user who already exists, and if the user's credentials in the CSV file don’t match the existing credentials, the import fails for that user. If you’re importing users to a site and think the users might already exist on the server, you can try leaving the **Password** field in the CSV file blank (while including the delimiters for the field). If a user who is defined in the CSV already exists in another site, the user is added to the site where you’re importing. However, if the user _doesn’t_ already exist on the server, the user is created, and the CSV import window alerts you that the new user doesn’t have a password. You can then use the server administrator pages to assign a password to any user who doesn’t have one. **Note**: If the server is configured to use Active Directory for authentication, user passwords are managed by Active Directory, and you can leave the password field in the CSV file blank. [Skip to main content](#main-content) # Index and Search Server The Tableau Server Index and Search Server process, based on OpenSearch, handles fast search, filter, retrieval, and display of content metadata on your Tableau Server site. Beginning with Tableau Server version 2023.3, Index and Search Server completely replaces the Search and Browse process. ## Server Configuration The Index and Search Server is automatically installed on the initial node. ### Multi-Node Configuration To configure Index and Search Server for high availability, configure the process on multiple nodes. We recommend you configure an odd number of Index and Search Server instances. On Tableau Server Clusters that have 3 or more nodes, you should configure Index and Search Server on at least three different nodes.

Process	Index and Search Server
Status	Status of the Index and Search Server is visible on the Status Page and can be accessed using the TSM CLI to view. For more information, see View Server Process Status
Logging	Logs generated by the Index and Search Server are located in `/var/opt/tableau/tableau_server/data/tabsvc/logs/indexandsearchserver`. For more information, see Tableau Server Logs and Log File Locations

**What happens when the Index and Search Server fails?** If Index and Search Server fails, users can still sign in to Tableau Server, however the different content types (workbooks, projects, data sources, and views for example) will not appear in the Home page, the search bar or the Explore page. Existing workbooks and Views should still be accessible and fully functional if accessed from a bookmarked url. The content is not actually missing. Rather, the content is not being returned in the search results; it will be displayed again after the Index and Search Server restarts. A failed Index and Search Server is automatically restarted; as long as the computer itself is otherwise healthy, the service will relaunch. If more than one Index and Search Server is configured and running on multiple nodes when the failure occurs, requests made to a failed Index and Search Server will also fail, but subsequent requests will be routed to working Index and Search Server instances. Each Index and Search Server instance indexes across all nodes in the cluster, therefore as long as one Index and Search Server instance is running, results will still be returned across all nodes. ## Performance Tuning The Index and Search Server heap size can be configured by using the `tsm set configuration` command with the `indexandsearchserver.vmopts` option. For more information, see [indexandsearchserver.vmopts](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#indexandsearchserver) ## Re-indexing During restore, the restore process will initiate a full re-indexing of the content and external assets managed by Tableau Server. The re-indexing process consumes CPU resources which may be noticeable during backup and restore. [Skip to main content](#main-content) # Infrastructure Planning Before you install Tableau Server, you should review the disk requirements, recommended configurations, user accounts, security, and networking requirements. ## Validating your server deployment plan Before you commit to installing a new Tableau Server deployment in your organization, be sure to carefully evaluate your options. For most organizations, Tableau Cloud will provide a more reliable, performant, and cost-effective analytics solution when compared to self-hosting Tableau Server. For information about the viability of Tableau Cloud for your organization, review this blog post, [Should I move my analytics to the cloud?](https://www.tableau.com/blog/should-i-move-my-analytics-cloud) Already running Tableau Server and want to migrate to Tableau Cloud? See [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm). ## Other articles in this section [Skip to main content](#main-content) # Initial Node Installation Defaults By default, the Tableau Server installer configures the number of process instances that Tableau Server runs based on the hardware detected by the installer. The default configuration applies to single-server installations and to the initial server of a multi-node installation. You can calculate the default configuration based on the following rules for each process, where the "number of cores" refers to the number of physical processors: | Process Name | Number of Processes | | --- | --- | | VizQL Server | Equal to the number of cores divided by four, up to a maximum of four process instances. | | Backgrounder | Set to two unless the number of cores is fewer than eight. | | Cache Server | Set to two unless the number of cores is fewer than eight. | | Data Server | Set to two unless the number of cores is fewer than eight. | For all other process types, the number of process instances is set to one, regardless of the hardware. Here's an example default configuration for a computer with 16 cores: | Process Name | Number of Processes | | --- | --- | | VizQL Server | 4 | | Application Server | 1 | | Backgrounder | 2 | | Cache Server | 2 | | Data Server | 2 | | File Store | 1 | | Data Engine | 1 | [Skip to main content](#main-content) # Install and Configure Additional Nodes After you install Tableau Server on one computer (or node), the server is functional and ready for use, but it has no redundancy. If there is a problem with a process or a problem with the computer itself, Tableau Server may be unavailable. In addition, all processes are running on a single computer, so there can be contention for resources on that computer. You can extend your Tableau Server installation by adding Tableau to additional nodes, creating a distributed installation. This article describes the general steps for installing Tableau Server on additional nodes and assumes you have already installed Tableau on an initial node. For more information on installing Tableau on the initial node, see [Install and Initialize TSM](https://help.tableau.com/v0.0/server-linux/en-us/setup.htm). If you are installing Tableau Server on multiple nodes, you should install and configure one node at a time. This makes it easier to troubleshoot any issues you might run into. **Important**: You should add and configure additional nodes when you can fully complete the process by applying pending changes. Adding a node without finishing by applying pending changes can result in users being unable to log into Tableau Server. ## Installation location Keep in mind the following requirements and limitations: - The installation and data directory locations for Tableau Server must be the same on all nodes in a cluster. - You can specify a non-default install location on RHEL-like distributions, but cannot change the location on Ubuntu. For more information, see [Installation directory](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm#InstallDir). - When you initialize Tableau you can specify a non-default location for the data directory. For more information, see [Data directory](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm#Data). ### Generate the node bootstrap file 1. Open TSM in a browser: `https://:8850` For more information, see [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/v0.0/server-linux/en-us/sign_in_tsm.htm). 2. Click the Configuration tab, and in the Add a Node box, click Download Bootstrap File. ![A list of processes and the number of instances in a Tableau Server deployment.](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-linux-generate-bootstrap.png) The bootstrap file is created and copied to your local computer. Embedded credentials are included in the bootstrap file by default. If you don't want credentials embedded in the bootstrap file, clear the Include temporary credentials in file option. If you want to completely disable the ability to include embedded credentials in node bootstrap files, you can set a configuration option for the server. See [features.PasswordlessBootstrapInit](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#pwdlessbootstrap) for more details. ### Install and initialize an additional node Before you begin, verify that your node bootstrap file is recent. For example, if you have run `[tsm security regenerate-internal-tokens](https://help.tableau.com/v0.0/server-linux/en-us/cli_security_tsm.htm#regenerate-tokens)` after you generated a bootstrap file, then initialization will fail. 1. Copy the original installer you used on the first computer along with the bootstrap file you generated and put them in a location accessible from the new computer you are adding Tableau Server to. This could be a mounted network share, or directly on the new computer. 2. If you are running a local firewall, then you need to configure firewall rules for all the nodes in the cluster. For more information, see [Configure Local Firewall](https://help.tableau.com/v0.0/server-linux/en-us/config_firewall_linux.htm). 3. On the new node, run the Tableau Server Setup program: Use the package manager to install the Tableau Server package. You must install the new version to the same location as the existing version. The install location must be the same on all nodes. Do not install to a location using a symbolic link or to a directory on a Network File System (NFS) volume. - On RHEL-like distributions, including CentOS, you have the option to install Tableau to a non-default location. - **Default location**—To install to the default location (`/opt/tableau/tableau_server`), run the following commands, where `` is formatted as major-minor-maintenance (ex: `2025-3-5`): `sudo yum update` `sudo yum install tableau-server-.x86_64.rpm` - **Non-default location**—To install to a non-default location, you must use `rpm -i`. You will also need to install all dependent packages. See the note below. Run the following command: sudo rpm -i --prefix /preferred/install/path tableau-server.rpm **Note:** When you use `yum` to install Tableau Server, all dependent packages are automatically downloaded and installed. This is the preferred method for installing Tableau. If you want to install to a non-default location, or your organization does not allow you to use `yum` and you must install using `rpm -i`, you must also install all dependent packages separately. For information about installing dependent packages, see [Installing Tableau Server on an Air-Gapped Computer Running Linux](https://help.tableau.com/v0.0/server-linux/en-us/install_air_gapped.htm#InstallAirgap). - On Ubuntu, run the following commands, where `` is formatted as major-minor-maintenance (ex: `2019-2-5`): sudo apt-get update sudo apt-get upgrade sudo apt-get -y install gdebi-core sudo gdebi -n tableau-server-\_amd64.deb 4. To initialize communications between your new node and the initial node, run the initialize-tsm script that is installed when you install Tableau Server. Navigate to the `scripts` directory: cd /opt/tableau/tableau\_server/packages/scripts./ 5. Run the initialize-tsm script: ``` sudo ./initialize-tsm -b /path/to/.json --accepteula ``` - Use the `-b` flag to provide the path to the bootstrap file that you copied to the computer. If you have encrypted the bootstrap file, then you must pipe the file as described in [Securing secrets for import and export operations](https://help.tableau.com/v0.0/server-linux/en-us/security_secret_storage.htm#Securing). - If the bootstrap file was generated without embedded credentials, use the `-u` flag to specify the user name of the administrative user on the initial node. This is the name of an administrative user on the computer, not the Tableau Server administrator. You will be prompted for the user password. For more information, see [tsm topology nodes get-bootstrap-file](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMGetBootstrap). ``` sudo ./initialize-tsm -b /path/to/.json -u --accepteula ``` **Important:** You must enter the credentials of the same user that you used during the installation process on the initial node. - The `--accepteula` flag accepts the Tableau Server End User License Agreement (EULA). The EULA is available in the following location: [End User License Agreement.](http://www.tableau.com/legal/eula) ### Configure the additional node with Cluster Controller 1. Open TSM in a browser: https://:8850 For more information, see [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/v0.0/server-linux/en-us/sign_in_tsm.htm). 2. Click the Configuration tab. A message should tell you that the new node was added. ![Message indicating that a new node was added to a cluster in Tableau Server.](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-node-added.png) Click Continue to dismiss the message. 3. Cluster Controller is part of the minimum topology and is already selected. Each node must run Cluster Controller. If you only want to set the minimum topology for the node, go to Step 4 below. You might do this if you will be adding additional nodes and are not ready to configure this node beyond the minimum. If you want to add additional processes to the minimum topology, specify the processes that should run on the node. Do this by selecting the processes you want, or specifying the number of processes that should run on the node. For example, to add a Gateway and two instances of the Backgrounder on the node: 1. Select Gateway. 2. Set the Backgrounder count to 2. Adding Backgrounder to a node will also add an instance of Data Engine if one is not already on the node. The specific processes and process counts you set will depend on your organizational environment and needs. Some processes are added automatically when you add another process. For more information, see [Configure Nodes](https://help.tableau.com/v0.0/server-linux/en-us/config_nodes.htm) and [Tableau Server Processes](https://help.tableau.com/v0.0/server-linux/en-us/processes.htm). **Note:** The TSM Web UI limits you to a maximum of 8 instances of processes that allow you to select the number of instances. To configure more instances than this, use the command line and the `TSM topology set-process` command. For more information, see [tsm topology set-process](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMSetProcess). 4. Click Pending Changes at the top of the page: ![Tableau Server Manager toolbar indicating that there are pending changes.](/tableau/next/en-us/server-linux/en-us/Img/tsm-ui-pending-changes-btn.png) If you are configuring a cluster with three or more nodes, a Coordination Service ensemble warning displays. You can continue. You will deploy a Coordination Service ensemble in a separate step. 5. Click Apply Changes and Restart and Confirm to confirm a restart of Tableau Server. After Tableau Server restarts, the node is included with the minimum topology necessary and any additional processes you configured. ### Generate the node bootstrap file To install Tableau Server on additional computers you use the same installer you did for the initial node, along with a "bootstrap" file you generate on the initial node. **Important**: The bootstrap file contains a copy of the master keystore file used for encrypting the configuration secrets. The file can also embedded credentials which are valid for a predetermined amount of time (see [tabadmincontroller.auth.expiration.minutes](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#tabadminctrlrauthexpire)) and serve as a session cookie. We strongly recommend that you take additional measures to secure the bootstrap file. The following command set provides an example method to encrypt the bootstrap file output. This method is similar to the encryption process described in more detail at [Securing secrets for import and export operations](https://help.tableau.com/v0.0/server-linux/en-us/security_secret_storage.htm#Securing). Note however, the method here must be passed as separate arguments with trailing `&& \` operators as follows: `mkfifo -m 600 /tmp/secure1 && \` `tsm topology nodes get-bootstrap-file --file /tmp/secure1 && \` `gpg --symmetric --batch --yes --passphrase-file ~/.secrets/pgppassphrase.txt --cipher-algo AES256 --output encrypted.enc < /tmp/secure1 && \` `rm /tmp/secure1` 1. After installing Tableau Server on the initial node, generate the node bootstrap file. 2. On the initial node, open a terminal session. 3. Type this command to generate the bootstrap file: `tsm topology nodes get-bootstrap-file --file .json` Embedded credentials are included in the bootstrap file by default. If you don't want the bootstrap file to include credentials, use the `-nec` or `--no-embedded-credentials` option: `tsm topology nodes get-bootstrap-file --file .json --no-embedded-credentials`. If you want to completely disable the ability to include embedded credentials in node bootstrap files, you can set a configuration option for the server. See [features.PasswordlessBootstrapInit](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#pwdlessbootstrap) for more details. ### Install and initialize an additional node 1. Copy the original installer you used on the first computer along with the bootstrap file you generated and put them in a location accessible from the new computer you are adding Tableau Server to. This could be a mounted network share, or directly on the new computer. 2. If you are running a local firewall, then you need to configure firewall rules for all the nodes in the cluster. For more information, see [Configure Local Firewall](https://help.tableau.com/v0.0/server-linux/en-us/config_firewall_linux.htm). 3. On the new node, run the Tableau Server Setup program: Use the package manager to install the Tableau Server package. You must install the new version to the same location as the existing version. The install location must be the same on all nodes. Do not install to a location using a symbolic link or to a directory on a Network File System (NFS) volume. - On RHEL-like distributions, including CentOS, you have the option to install Tableau to a non-default location. - **Default location**—To install to the default location (`/opt/tableau/tableau_server`), run the following commands, where `` is formatted as major-minor-maintenance (ex: `2025-3-5`): `sudo yum update` `sudo yum install tableau-server-.x86_64.rpm` - **Non-default location**—To install to a non-default location, you must use `rpm -i`. You will also need to install all dependent packages. See the note below. Run the following command: sudo rpm -i --prefix /preferred/install/path tableau-server.rpm **Note:** When you use `yum` to install Tableau Server, all dependent packages are automatically downloaded and installed. This is the preferred method for installing Tableau. If you want to install to a non-default location, or your organization does not allow you to use `yum` and you must install using `rpm -i`, you must also install all dependent packages separately. For information about installing dependent packages, see [Installing Tableau Server on an Air-Gapped Computer Running Linux](https://help.tableau.com/v0.0/server-linux/en-us/install_air_gapped.htm#InstallAirgap). - On Ubuntu, run the following commands, where `` is formatted as major-minor-maintenance (ex: `2019-2-5`): sudo apt-get update sudo apt-get upgrade sudo apt-get -y install gdebi-core sudo gdebi -n tableau-server-\_amd64.deb 4. To initialize communications between your new node and the initial node, run the initialize-tsm script that is installed when you install Tableau Server. On the new node: Navigate to the `scripts` directory: cd /opt/tableau/tableau\_server/packages/scripts./ 5. Run the initialize-tsm script: ``` sudo ./initialize-tsm -b /path/to/.json --accepteula ``` - Use the `-b` flag to provide the path to the bootstrap file that you copied to the computer. If you have encrypted the bootstrap file, then you must pipe the file as described in [Securing secrets for import and export operations](https://help.tableau.com/v0.0/server-linux/en-us/security_secret_storage.htm#Securing). - If the bootstrap file was generated without embedded credentials, use the `-u` flag to specify the user name of the administrative user on the initial node. This is the name of an administrative user on the computer, not the Tableau Server administrator. You will be prompted for the user password. For more information, see [tsm topology nodes get-bootstrap-file](https://help.tableau.com/v0.0/server-linux/en-us/cli_topology_tsm.htm#TSMGetBootstrap). ``` sudo ./initialize-tsm -b /path/to/.json -u --accepteula ``` **Important:** You must enter the credentials of the same user that you used during the installation process on the initial node. - The `--accepteula` flag accepts the Tableau Server End User License Agreement (EULA). The EULA is available in the following location: ``` /opt/tableau/tableau_server/packages/docs./EULA.rtf ``` ### Configure the additional node **Note:** This basic example illustrates how to set the topology on a node. For a more detailed, working multi-node example, see [Example: Install and Configure a Three-Node HA Cluster](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha_install_3node.htm). On the initial (original) node, set the topology for the newly added node. The topology specifies which processes should run on the node, and how many instances of each process should run. The topology for the node will depend on your environment and organizational needs. The below are just examples of setting the topology. 1. On the initial (original) node, open a terminal session. 2. Get the node-id for the new node: tsm topology list-nodes -v The `-v` option lists the nodes and the processes they are currently running. You can identify the newly added node because it will not have any processes on it. 3. Specify the individual processes that should run on this node. Do this with the following command: `tsm topology set-process -n -pr -c ` You must add an instance of the Cluster Controller to each node. For example, to add the Cluster Controller, two instances of the Backgrounder, and a Gateway to node2: tsm topology set-process -n node2 -pr clustercontroller -c 1 tsm topology set-process -n node2 -pr backgrounder -c 2 tsm topology set-process -n node2 -pr gateway -c 1 The specific processes and process counts you set will depend on your organizational environment and needs. Some processes are added automatically when you add another process. For more information, see [Configure Nodes](https://help.tableau.com/v0.0/server-linux/en-us/config_nodes.htm) and [Tableau Server Processes](https://help.tableau.com/v0.0/server-linux/en-us/processes.htm). 4. Apply the node configuration. If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply). `tsm pending-changes apply` A warning about deploying a Coordination Service ensemble displays if you have deployed a three- or five-node cluster. If this is the only warning, you can safely override it using the `--ignore-warnings` option to apply the configuration changes in spite of the warning. ``` tsm pending-changes apply --ignore-warnings ``` ## Install drivers You need to install drivers so that Tableau Server can connect to data and run extracts. Install these drivers on nodes that are running any of the following processes: - VizQL Server (vizqlserver) - Application Server (vizportal) - Data Server (dataserver) - Backgrounder (backgrounder) ### Drivers and administrative views If you want to use the built-in administrative views in Tableau Server, you also need to install the PostgreSQL driver on any nodes running any of the above processes. For more information, see [Database Drivers](https://help.tableau.com/v0.0/server-linux/en-us/dbdriver.htm). [Skip to main content](#main-content) # Install and Configure Tableau Server The topics referenced at the bottom of this page describe the steps to install and configure Tableau Server. If you are installing a distributed deployment (cluster), use the steps in this topic to install the initial node, then, to install additional nodes, see [Distributed and High Availability Tableau Server Installations](https://help.tableau.com/v0.0/server-linux/en-us/distrib_ha.htm). After you run the installation, you must then continue setup by activating a license, registering Tableau Server, and configuring various settings including authentication. ## Other installation methods There are a few alternative methods that you can use to install Tableau Server. - If you want a quick start procedure to install Tableau Server in a non-production environment, see [Jump-start Installation](https://help.tableau.com/v0.0/server-linux/en-us/jumpstart.htm). - For an end-to-end procedure that describes how to deploy an enterprise-ready, four-node, reference architecture in a tiered data center, see [Tableau Server Enterprise Deployment Guide](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_intro.htm). - If you are installing Tableau Server in an environment without a connection to the internet, see [Install Tableau Server in a Disconnected (Air-Gapped) Environment](https://help.tableau.com/v0.0/server-linux/en-us/install_air_gapped.htm). - You can also install Tableau Server onto various cloud platforms. See [Self-Host Tableau Server in a Public Cloud Service](https://help.tableau.com/v0.0/server-linux/en-us/ts_tableau_server_cloud_overview.htm). ## Validating your server deployment plan Before you commit to installing a new Tableau Server deployment in your organization, be sure to carefully evaluate your options. For most organizations, Tableau Cloud will provide a more reliable, performant, and cost-effective analytics solution when compared to self-hosting Tableau Server. For information about the viability of Tableau Cloud for your organization, review this blog post, [Should I move my analytics to the cloud?](https://www.tableau.com/blog/should-i-move-my-analytics-cloud) Already running Tableau Server and want to migrate to Tableau Cloud? See [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm). ## Before you begin To install Tableau Server you must have a computer that satisfies the hardware requirements. You will get an informational message if your computer meets the minimum requirements but does not satisfy the recommended minimum requirements. In this case, your computer hardware can handle a trial installation of Tableau but is not adequate for a production environment. For more information, see [Before you install...](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm). ## Installation steps The following steps describe how to install Tableau Server on a single computer. Use the steps to install Tableau Server in a single server deployment. Use the steps to install the initial node in a multi-node Tableau Server deployment. Run the steps sequentially. 1. [Install and Initialize TSM](https://help.tableau.com/v0.0/server-linux/en-us/setup.htm) 2. [Activate and Register Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/activate.htm) 3. [Configure Initial Node Settings](https://help.tableau.com/v0.0/server-linux/en-us/config_general.htm) 4. [Add an Administrator Account](https://help.tableau.com/v0.0/server-linux/en-us/startup.htm) 5. [Validate Installation](https://help.tableau.com/v0.0/server-linux/en-us/validate_install_linux.htm) ## Other articles in this section [Skip to main content](#main-content) # Install and Initialize TSM This topic guides you through the process of installing Tableau Server and initializing Tableau Services Manager (TSM). **Important:** Do not install a beta version of Tableau Server in your production environment. You should also never restore a production Tableau Server installation using a backup of a beta version. ## Prerequisites Before proceeding, review the topic, [Before you install...](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm). ### Review optional initialization parameters Before you install and initialize TSM, it is critical that you review the parameters that you may optionally set as part of the initialization operation. You can only run `initialize-tsm` once, so be sure to run it with all of the options that your organization needs. Some options, such as non-default system user and group can only be configured as part of the initialization operation. Other configurations, such as forward proxy and dynamic port settings can be manually set after you run initialization, but doing so is a much more labor-intensive process. For a complete list of optional parameters, see [Help Output for initialize-tsm Script](https://help.tableau.com/v0.0/server-linux/en-us/initialize_tsm-h.htm). Some common scenarios where optional initialization parameters are used : - Configuring Tableau Server to work with a forward proxy server. See [Optional: common initalize-tsm parameters](#optional_parameters), later in this topic, to configure Tableau Server during installation. You can also configure Tableau Server after you install, see [Configuring Tableau Server on Linux to work with a forward proxy](https://help.tableau.com/v0.0/server-linux/en-us/proxy.htm#Configur3) - Specifying dynamic port mapping. By default, most ports needed by Tableau Server are assigned (mapped) dynamically from a predefined range of ports. The port assignments are made for each service or process during installation. If you want to modify port mapping, we recommend configuring this during installation, see [Controlling port remapping with initialize-tsm](https://help.tableau.com/v0.0/server-linux/en-us/ports.htm#PortsAtInitializeTSM). - Specifying non-default system user or group This configuration change can only be performed during initialization. See [System user and groups](https://help.tableau.com/v0.0/server-linux/en-us/plan_identity_store.htm#System). - Specifying a non-default data directory. This configuration change can only be performed during initialization. See [Data directory](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm#Data). - Configuring Tableau Server to run in FIPS mode. See [Optional: common initalize-tsm parameters](#optional_parameters), later in this topic, to configure Tableau Server during installation. You can only configure Tableau Server to run in FIPS mode on initialization. See [FIPS Compliance in Tableau Server on Linux](https://help.tableau.com/v0.0/server-linux/en-us/fips-compliance_tsm.htm#Configur3). As a security best practice, do not expose the TSM port (by default, `8850`) to the internet. ## Install Tableau Server Install Tableau Server with your distribution’s package manager, then run a script to initialize TSM. The script is included with the installed package. **Important**: The hostname of the server must not change after you start TSM. For example, this might happen if you use the cloud-init package to initialize a virtual machine, and you install Tableau Server on that virtual machine. ### Install the Tableau Server package By default, Tableau Server is installed in the `/opt` directory. On RHEL-like distributions you can specify a different install location. 1. Log on as a user with `sudo` access to the computer where you want to install Tableau Server. **Note:** To avoid possible complications, we recommend a user account that does not include any special characters (for example, non-ASCII, "+", "-"). These may cause problems, including a failure to fully install Tableau Server, depending on how your environment is configured. 2. Download the `.rpm` or `.deb` installer package from the [Tableau Server Downloads and Release Notes](https://www.tableau.com/support/releases/server/) page. 3. Navigate to the directory where you copied the `.rpm` or `.deb` package. 4. Use the package manager to install the Tableau Server package. You must install the new version to the same location as the existing version. The install location must be the same on all nodes. Do not install to a location using a symbolic link or to a directory on a Network File System (NFS) volume. - On RHEL-like distributions, including CentOS, you have the option to install Tableau to a non-default location. - **Default location**—To install to the default location (`/opt/tableau/tableau_server`), run the following commands, where `` is formatted as major-minor-maintenance (ex: `2025-3-5`): `sudo yum update` `sudo yum install tableau-server-.x86_64.rpm` - **Non-default location**—To install to a non-default location, you must use `rpm -i`. You will also need to install all dependent packages. See the note below. Run the following command: sudo rpm -i --prefix /preferred/install/path tableau-server.rpm **Note:** When you use `yum` to install Tableau Server, all dependent packages are automatically downloaded and installed. This is the preferred method for installing Tableau. If you want to install to a non-default location, or your organization does not allow you to use `yum` and you must install using `rpm -i`, you must also install all dependent packages separately. For information about installing dependent packages, see [Installing Tableau Server on an Air-Gapped Computer Running Linux](https://help.tableau.com/v0.0/server-linux/en-us/install_air_gapped.htm#InstallAirgap). - On Ubuntu, run the following commands, where `` is formatted as major-minor-maintenance (ex: `2019-2-5`): sudo apt-get update sudo apt-get upgrade sudo apt-get -y install gdebi-core sudo gdebi -n tableau-server-\_amd64.deb ### Initialize TSM You can specify a separate location for data (extracts and extract metadata) storage, whether or not you install Tableau to the default location. 1. Navigate to the `scripts` directory: cd /opt/tableau/tableau\_server/packages/scripts./ 2. Run the following script to start TSM: `sudo ./initialize-tsm --accepteula --activation-service --` The only required parameter for the `initialize-tsm` script is `--accepteula`. You must include this parameter to accept the Tableau Server End User License Agreement (EULA). The EULA is available in the following location: `/opt/tableau/tableau_server/packages/docs./Commercial_EULA.txt` However, review the following common parameters before running the script. Optional: common initalize-tsm parameters There are a number of parameters (also referred to as, _flags_) that you can set when you run `initialize-tsm`. Common flags are listed below. For a complete list, run the command, `sudo ./initialize-tsm -h`, or see [Help Output for initialize-tsm Script](https://help.tableau.com/v0.0/server-linux/en-us/initialize_tsm-h.htm). - Use the `--activation-service` option to activate Tableau Server using the Tableau authorization-to-run (ATR) service. As of Tableau Server 2021.4 and later, this option is the default for Tableau Server on Microsoft Windows, Tableau Server on LInux, and Tableau Server in containers. Server ATR is for new installs only, not upgrades. This option is ideal for cloud-based or virtual environments, but is available to anyone who can activate their copy of Tableau Server online. Selecting ATR for product activation is a permanent choice that cannot be undone later. For more information, see [Activate Tableau Server using the authorization-to-run (ATR) service](https://help.tableau.com/v0.0/server-linux/en-us/atr_service.htm). If you don't want to use Server ATR to activate Tableau Server, use the `--no-activation-service` option. - The `-a` flag to specify a user to be added to the tsmadmin and tableau groups instead of the user running this script. If you are installing with the root account, the you must specify the `-a` flag. - The `--unprivileged-user` flag to set a different service account. By default a new user called `tableau` will be created. This account is an unprivileged service account under which most Tableau process run. We recommend creating a different user only in the case where a `tableau` user account already exists on the computer. - The `-d` flag to specify a non-default location of the "data directory" where Tableau Server stores extracts, information about extracts, and more. By default, Tableau Server uses the following location for the directory: `/var/opt/tableau/tableau_server` When you set this flag, the `intialize-tsm` script will create and apply permissions to the directory that you specify. There are important restrictions that apply to changing the default directory path. See [Data directory](https://help.tableau.com/v0.0/server-linux/en-us/requ.htm#Data). - We recommend configuring Tableau Server for a forward proxy solution during installation. To do so, include the `--http_proxy` and/or `--https_proxy` flags to specify the forward proxy server. Specify the URL with the port, for example: `--http_proxy=http://proxy.exampe.lan:80/` `--https_proxy=http://1.2.3.4:443/` Take care to use `http` when you specify the URL for the `https_proxy` environmental variable. Do not specify the `https` protocol for the value of the `https_proxy` environmental variable. To configure Tableau Server to bypass the forward proxy, include the `--no_proxy` flag. You should also add exceptions to this proxy configuration to guarantee that all communications within a local Tableau Server cluster (if you have one now or will have one later) do not route to the proxy server. For example: `--no_proxy=localhost,127.0.0.1,localaddress,.localdomain.com`. - If you want to manually manage port assignment for TSM and Tableau Server processes, you may need to use one or more port-related switches with `initialize-tsm`. For more information, see [Controlling port remapping with initialize-tsm](https://help.tableau.com/v0.0/server-linux/en-us/ports.htm#PortsAtInitializeTSM). - The `--enable-fips` flag initializes Tableau Server in FIPS (Federal Information Processing Standard) mode. Once in FIPS mode, the server cannot be switched to non-FIPS mode. This selection must be made at install time and cannot be changed after install. In a multinode configuration, all nodes must all be FIPS enabled or not. Mixed environments are not supported. For more information, see [FIPS Compliance in Tableau Server on Linux](https://help.tableau.com/v0.0/server-linux/en-us/fips-compliance_tsm.htm). To migrate a non-FIPS Tableau Server to a FIPS-enabled Tableau Server follow the instructions on this page: **Note:** This option was added with version 2025.3.1. - The `--debug` flag for troubleshooting. This option displays each command in the script as it is run and can make it easier to troubleshoot issues. Use of this option results in extensive output to the screen. **Note:** Beginning in version 2021.3 this option has been removed and the script output that would have been displayed is logged to `/var/tmp/`. 3. Log off and log on again to the terminal before you configure Tableau Server. When you log on again, you create a new session in which group membership changes have taken effect. The new session also has access to the environment variables added by the `initialize-tsm` script. ## Next step - [Activate and Register Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/activate.htm) [Skip to main content](#main-content) # Install Switches and Properties for tabcmd (Windows) **Note:** The tabcmd command-line utility version 2.0 is available at [Tableau tabcmd](https://tableau.github.io/tabcmd). This new version allows you to run tabcmd commands on MacOS and Linux, and to authenticate using personal access tokens (PATs). Version 2.0 is built on public endpoints available in the Python-based Tableau Server Client (TSC). This latest version has limited support for Tableau Server. You can use the following switches when installing the Tableau Server Command Line Utility (tabcmd) version 2019.4.0 or later from the command line on Windows. **Note:** There are no equivalent switches for the Linux version of the tabcmd installer.

Switch	Description	Comments
`/install` \| `/repair` \| `/uninstall` \| `/layout` "`<directory>`"	Run Setup to either install, repair, or uninstall tabcmd, or with `/layout`, create a complete local copy of the installation bundle in the directory specified.	Default is to install, displaying UI and all prompts. If no directory is specified on a fresh install, `C:\Program Files\Tableau\Tableau Server\<version>\extras\Command Line Utility` is assumed.
`/passive`	Run Setup with minimal UI and no prompts.
`/quiet` \| `/silent`	Run Setup in unattended, fully silent mode. No UI or prompts are displayed.	Note: Use either `/silent` or `/quiet`, not both.
`/norestart`	Run Setup without restarting Windows, even if a restart is necessary.	Note: In certain rare cases, a restart cannot be suppressed, even when this option is used. This is most likely when an earlier system restart was skipped, for example, during installation of other software.
`/log "<log-file>"`	Log information to the specified file and path. By default log files are created in the user's `%TEMP%` folder with a naming convention of `Tableau_Server_Command_Line_utility_<version_code>.log`.	If no file location is specified, the log file is written to the user's TEMP folder (`C:\Users\<username>\AppData\Local\Temp`). Check this log file for errors after installation. Example: `<Setup file> /silent /log "C:\Tableau\Logs\tabcmd-Install" ACCEPTEULA=1`

Properties Description Comments

ACCEPTEULA=1|0

Accept the End User License Agreement (EULA). Required for quiet, silent, and passive install. 1 = accept the EULA, 0 = do not accept the EULA.

If not included when using /passive, /silent or /quiet, Setup fails silently.

If included but set to 0, Setup fails.

INSTALLDIR="<path\to\installation\directory>"

Install tabcmd to the specified non-default install location.

Specifies the location to install tabcmd. If not used, tabcmd is installed to C:\Program Files\Tableau\Tableau Server\<version_code>\extras\Command Line Utility

Example: <Setup file> /silent INSTALLDIR="C:\tabcmd"

[Skip to main content](#main-content) # Install Tableau Content Migration Tool Installing Tableau Content Migration Tool is straightforward and easy. ## Installation requirements The Content Migration Tool tool is run from a Windows computer and can connect to Tableau Cloud sites and Tableau Server 19.3 and later with a valid Advanced Management license. For more information about compatible versions, see [Getting Started with Tableau Content Migration Tool](https://help.tableau.com/v0.0/server-linux/en-us/cmt-getting-started.htm). The computer that you install Content Migration Tool on must meet the requirements below: - Microsoft Windows 10 or newer (x64) - Intel Core i3 or AMD Ryzen 3 (Dual Core) - 4 GB memory or larger - Can connect to the source and destination sites. Both sites must have a valid [Advanced Management](https://help.tableau.com/v0.0/server-linux/en-us/itm_intro.htm) license to migrate content. - 2 GB HDD or larger. The drive where the `\temp` folder resides must have enough disk space to hold a copy of all content being migrated in a single migration. All content is stored locally on the disk and deleted when the migration is complete. - Have enough free disk space to hold the application and its logs. In addition, confirm that the REST API is enabled on Tableau Server (this is the default). Use the `tsm configuration get -k api.server.enabled` command to confirm this. A return value of `true` means the REST API is enabled. To enable the REST API, use the `tsm configuration set` command. For more information, see [api.server.enabled](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm#rest_api_enabled). ## Install Content Migration Tool To install the Content Migration Tool: 1. Download the Content Migration Tool installer (`Tabcmt-64bit-.exe`) for your version of Tableau Server from the [Tableau Advanced Management](https://www.tableau.com/support/releases/server-management) downloads page. 2. Run the Content Migration Tool Setup program. **Note:** Running the Content Migration Tool Setup program overwrites the previous version. 3. After reading the EULA, select I agree to the license terms and conditions, and click Install. 4. If the User Account Control dialog opens, click Yes to allow the installer to make changes. ## Upgrade Content Migration Tool Upgrading to the latest version of Content Migration Tool ensures that you can take advantage of the latest features and fixes included with each new version. **Important:** - Running the Content Migration Tool Setup program overwrites the previous version. - Content Migration Tool doesn't support side-by-side installation of previous versions. To upgrade Content Migration Tool: 1. Log on to the machine where Content Migration Tool is installed. If there are instances of Content Migration Tool open, save your migration plan and exit the application. 2. Follow the steps listed in [Install Content Migration Tool](#install-cmt) to download the latest installer and complete the upgrade. ## Install Content Migration Tool from the command line You can install Content Migration Tool from the command line if you're a local administrator on the machine. ### Install switches Specify one or more switches in the command line for the installer. For example: `Tabcmt-64bit-2022-3-0.exe /quiet /norestart`

Switch	Description	Comments
`/install` \| `/repair` \| `/uninstall` \| `/layout` "`<directory>`"	Run Setup to either install, repair, or uninstall Content Migration Tool, or with `/layout`, create a complete local copy of the installation bundle in the directory specified.	Default is to install, displaying UI and all prompts. If no directory is specified on a fresh install, `C:\Program Files\Tableau\Tableau Content Migration Tool` is assumed. If Content Migration Tool is already installed, Setup assumes the same location as the current installation.
`/passive`	Run Setup with minimal UI and no prompts.	Content Migration Tool doesn't start automatically when installed in `/passive` mode. To start Content Migration Tool, open the application manually.
`/quiet` \| `/silent`	Run Setup in unattended, fully silent mode. No UI or prompts are displayed.	Content Migration Tool doesn't start automatically when installed in `/silent` or `/quiet` mode. To start Content Migration Tool, open the application manually. Note: Use either `/silent` or `/quiet`, not both.
`/norestart`	Run Setup without restarting Windows, even if a restart is necessary.	Note: In certain rare cases, a restart cannot be suppressed, even when this option is used. This is most likely when an earlier system restart was skipped, for example, during installation of other software.

## Who can do this A user with Administrator access on the machine. [Skip to main content](#main-content) # Install Tableau Server in a Disconnected (Air-Gapped) Environment You can install Tableau Server in a disconnected environment that has no outside network access of any kind. Such disconnected environments, commonly referred to as air-gapped, are used when high security is needed to prevent data breaches or to guard against hacking. Air-gapped environments have no internet access, no outside network access, no outside wireless access, etc. The only means of getting software and data into or out of an air-gapped environment is by using removable media such as USB sticks or writable optical CDs or DVDs. Installing Tableau Server in an air-gapped environment is an advanced task for IT administrators who are familiar with the security considerations, best practices, and pitfalls of installing software in air-gapped environments. The following Tableau Server features will be unavailable or will have reduced functionality in an air-gapped environment: - **Maps** – Tableau Server uses externally hosted map data by default. Beginning with version 2020.4.0, you can configure Tableau Server to use offline maps. With earlier versions of Tableau, maps are unavailable in an air-gapped environment unless you also install a map server in your air-gapped environment. For more details, see [Displaying Maps in an Air-Gapped Environment](#Maps). - **Licensing** – Tableau Server needs to connect to the internet in order to activate product keys. However, you can [manually activate](#Activati) the product keys. - **External data** – Any data located outside your air-gapped environment is unavailable. ## Prerequisites In order to install Tableau Server in an air-gapped environment, you’ll need the following: - Trusted computer with limited access to the internet that you can use to download the installation packages and resources required by Tableau Server. A trusted computer has been scanned and cleared of any viruses and malware. - Trusted removable media that you can use to transfer the downloaded software to your air-gapped environment. Trusted removable media is removable media that is new and previously unused and comes from a reputable or known source. Trusted removable media has been scanned and verified that it does not contain any viruses or malware. - Air-gapped environment with computers and storage that meet the [requirements](https://help.tableau.com/v0.0/server-linux/en-us/server_hardware_min.htm) for installing Tableau Server. ## Installing Tableau Server on an Air-Gapped Computer Running Linux The easiest way to install Tableau Server on a computer in an air-gapped environment is to do so before the computer is placed into the air-gapped environment. If that’s not possible you’ll need to download the required packages to a trusted computer outside the air gap: 1. On a trusted computer outside the air gap with internet access, download the Tableau Server installation package. 2. Extract the list of dependent packages: **On Ubuntu:** `dpkg --field Depends` (where `` is the name of the .deb package you downloaded from Tableau). **Example command:** `dpkg --field tableau-server-linux-1.deb Depends` Example output: `ca-certificates, fontconfig, net-tools, bash-completion, ca-certificates-java, freeglut3, libegl1-mesa, libfreetype6, libgssapi-krb5-2, libxcomposite1, libxrender1, libxslt1.1, lsb-core` **On RHEL and RHEL-like Linux distributions:** `yum -q deplist ` (where `` is the .rpm package you downloaded from Tableau). **Example command:** `yum -q deplist tableau-server-linux_1.rpm` Example output: package: tableau-server-10400.17.0703.1600.x86\_64 10400-17.0703.1600 dependency: /bin/sh provider: bash.x86\_64 4.2.46-21.el7\_3 dependency: bash-completion provider: bash-completion.noarch 1:2.1-6.el7 dependency: ca-certificates provider: ca-certificates.noarch 2017.2.14-70.1.el7\_3 dependency: fontconfig provider: fontconfig.x86\_64 2.10.95-10.el7 provider: fontconfig.i686 2.10.95-10.el7 dependency: freeglut provider: freeglut.x86\_64 2.8.1-3.el7 provider: freeglut.i686 2.8.1-3.el7 dependency: freetype provider: freetype.x86\_64 2.4.11-12.el7 provider: freetype.i686 2.4.11-12.el7 dependency: krb5-libs provider: krb5-libs.x86\_64 1.14.1-27.el7\_3 provider: krb5-libs.i686 1.14.1-27.el7\_3 dependency: libXcomposite provider: libXcomposite.x86\_64 0.4.4-4.1.el7 provider: libXcomposite.i686 0.4.4-4.1.el7 dependency: libXrender provider: libXrender.x86\_64 0.9.8-2.1.el7 provider: libXrender.i686 0.9.8-2.1.el7 dependency: libxslt provider: libxslt.x86\_64 1.1.28-5.el7 provider: libxslt.i686 1.1.28-5.el7 dependency: mesa-libEGL provider: mesa-libEGL.x86\_64 11.2.2-2.20160614.el7 provider: mesa-libEGL.i686 11.2.2-2.20160614.el7 dependency: net-tools provider: net-tools.x86\_64 2.0-0.17.20131004git.el7 dependency: redhat-lsb-core provider: redhat-lsb-core.x86\_64 4.1-27.el7.centos.1 provider: redhat-lsb-core.i686 4.1-27.el7.centos.1 3. Download each of the dependent packages: **On Ubuntu:** `apt-get download …` **On RHEL and RHEL-like Linux distributions:** `yumdownloader …` 4. Transfer the packages to your removable media. 5. On your air-gapped computer, insert the removable media containing the Tableau Server installation package and dependent packages, and then [run the installer](https://help.tableau.com/v0.0/server-linux/en-us/setup.htm). 6. After installation is complete, you can activate the Tableau Server product keys. For more information, see [Activating Tableau Server in an Air-Gapped Environment](#Activati). ## Activating Tableau Server in an Air-Gapped Environment Because an air-gapped computer is not connected to the internet, you’ll need to perform the Tableau Server activation process manually. ## Offline activation overview Offline activation of Tableau Server depends on your method of activation (with or without the Authorization-to-Run service, ATR). **Note**: When using ATR and activating a USL license for Tableau Server, you can use either the Product **Key Name** or the **Offline Activation ID**. We recommend using the Key Name because you do not need to determine the Offline Activation ID. Offline activation _without_ ATR involves the following steps: 1. Generate an offline activation request file. 2. Copy the offline activation request file to a computer with internet access. 3. Upload the offline activation request file to the [Tableau activation website](https://www.tableau.com/support/activation). 4. Download the resulting offline activation response file from the website. You'll use this file to activate Tableau Server ### Offline activation file name changes Beginning in Tableau Server version 2023.1, the Tableau licensing system supports two underlying licensing technologies. From an administrative perspective, the only configuration difference between the two systems is the file types that are generated and consumed for offline activation. The licensing technology is determined during the initial installation of Tableau Server, and cannot be changed after install. We refer to the legacy (and still supported) version of licensing technology as FlexNet. The latest version of the technology is referred to as ATR. For more information, see [Activate Tableau Server Using the Authorization-To-Run (ATR) Service](https://help.tableau.com/v0.0/server-linux/en-us/atr_service.htm). The following table describes the file naming nomenclature for each technology. The table also includes the generic reference.

Generic file name	Server ATR file names	FlexNet file names
OfflineActivationRequest	OfflineActivationRequestFile_yyyyMMdd.hhmmss.json	TableauOfflineActivationRequest.tlq
OfflineActivationResponse	OfflineActivationLicensingAtrs.zip	activation.tlf

Visualize the Difference

Trusted Ticketer

Be sure to add your IP as a Trusted IP address to the server

Option	Required?	Default	Description
--bootstrap file	Yes	<none>	The location of the bootstrap file.
--username	Yes	<none>	This is typically the admin user you created during RMT Server installation.
--password	Yes	<none>	This is the password for the user account
--password-file	No Password can be supplied in the command line or a file that contains the password. If neither is provided, you will be prompted for the password.	<none>	Path including the file name where the password is stored.
-- server-name	No	Host name of machine	Name of the computer that has the Agent Installed. If no option is provided, this field will default to the host name of the machine.
--server-description	No	<none>	Description of the computer that has the Agent installed. If no option is provided, this field will remain blank.

Option	Required?	Default	Description
admin-password	Yes Password can be supplied in the command line or provide a file with the password to use. If neither is provided, you will be prompted for the password.	n/a	The password for the administrator user.
admin-password-file	No Password can be supplied in the command line or provide a file with the password to use. If neither is provided, you will be prompted for the password.	n/a	The file where the password for the administrator user is stored. Note: `tabrmt-master` user must have access to this file.
admin-username	No	admin	The username for the administrator user.
http-port	No	80
require-https	No	True	Redirect http traffic to HTTPS.
https-certificate-mode	No	"Default" Available options: Default Local	The type of certificate search to perform for the HTTPS certificate. Default: This mode uses the default self-signed certificate supplied by the installer. Local: Allows you to specify a file-based certificate in the /var/opt/tableau/tabrmt/master/config folder.
https-certificate-local-name	No Note: If not specified, the Resource Monitoring Tool is installed with a self-signed certificate and will use that certificate for HTTPS communications.	Null	The name of the HTTPS certificate file without the file extension.
https-certificate-local-password	No	Null	The password to use for the HTTPS certificate.
https-certificate-local-password-file	No	Null	The path to the file containing the password to use for the HTTPS certificate.

Option	Required?	Default	Description
--name	Yes	n/a	The name of the environment.
--gateway-url	Yes	n/a	URL used to access the Tableau Server gateway.
--version	Yes	n/a	Tableau Server version that this environment will be monitoring.
--api-username	No	Null	User name of the account used to connect to Tableau Server APIs. The user account should be a Tableau Server administrator with access to all Tableau Server sites.
--api-password	No (If you specify the Tableau API user name, you will either provide the password, or specify the file path and file that has the password)	Null	Password of the Tableau Server API user account used to connect to Tableau Server APIs.
--api-password-file	No	Null	The path to the file and the name of the file containing the password of the Tableau Server API user account.
--repository-server	Yes	Null	This is the server name for the PostgreSQL database that in installed with Tableau Server
--repository-port	Yes	Null	The port number of the Tableau Server Repository database.
--repository-username	Yes	Null	Username used to connect to PostgreSQL database installed with the Tableau Server Repository. Resource Monitoring Tool accesses the Tableau Server Repository database directly for performance reasons. For this to work, access to the repository must be enabled, with a password set for the readonly database user. For details, see Enable access to the Tableau Server repository.
--repository-password	Yes	Null	Password for the user account used to connect to the PostgreSQL database that is installed with the Tableau Server . Resource Monitoring Tool accesses the Tableau Server Repository database directly for performance reasons. For this to work, access to the repository must be enabled, with a password set for the readonly database user. For details, see Enable access to the Tableau Server repository.
--repository-password-file	No	Null	The path including the file name where the password for the user account used to connect to the PostgreSQL database that is installed with Tableau Server.
--repository-ssl-mode	No	Prefer	Tableau Server Repository SSL Mode: Prefer SSL or Require SSL to configure SSL connections to Tableau Repository. Disable to never use SSL to make Tableau Server Repository connections.
--repository-ssl-thumbprint	No	Null	You can choose to either supply the thumbprint that was generated by Tableau Server, or copy the server.crt file to the Resource Monitoring Tool Server(RMT Server) machine. If you choose to copy the certificate file, you don't have to supply the thumbprint. For more information, see Configure Postgres SSL to Allow Direct Connections from Clients.

Switch	Description	Comments
`/install \| /uninstall`	Run Setup to either install or uninstall Resource Monitoring Tool.	Default is to install, displaying UI and all prompts. If no directory is specified using the InstallFolder property on a fresh install, C:\Program Files\Tableau\Tableau Resource Monitoring Tool\master is assumed. If Resource Monitoring Tool is already installed, Setup will assume the same location as the current installation. To completely remove Resource Monitoring Tool including the data directory, use, `/uninstall DELTEDATADIR=1`
`/passive`	Run Setup with minimal UI and no prompts.
`/quiet \| /silent`	Run Setup in unattended, fully silent mode. No web interface or prompts are displayed.	Use either /quiet or /silent, not both.
`/norestart`	Run Setup without restarting Windows, even if a restart is necessary.	In certain rare cases, a restart cannot be suppressed, even when this option is used. This is most likely when an earlier system restart was skipped. For example, if restart was skipped during installation of other software.
`/log <log-file>`	Log information to the specified file and path. By default log files are created in %TEMP% with a naming convention of Tableau_Resource_Monitoring_Tool_<version_code>.	If no file location is specified, the log file is written to the TEMP folder - C:\Users\<username>\AppData\Local\Temp. Check this log file for errors after installation. For example: `<Setup file> /quiet /log="C:\Tableau\Logs\RmtInstall`

	User logs into their Active Directory domain.		The Kerberos KDC authenticates the user and sends a Ticket Granting Ticket (TGT) to the user's computer.
	The user connects to Tableau Server in Tableau Desktop or in a web browser.		Tableau Server authenticates the user.

Setting	Value	Description
`LBLM`	enabled, disabled, or required	Set to `enabled` (the default), the licensing screens will present the two options for activation (product key, or credentials). Set to `disabled`, login-based license management will not appear on the licensing screens. Set to `required`, login-based license management is the only way to activate the Tableau Desktop (when the licensing screen appears, it will offer only the credentials option for activation). Note: When `LBLM` is set to enabled or required, reporting is also enabled.
`ATRREQUESTEDDURATIONSECONDS`	1209600	Sets the authorization to run (ATR) duration (in seconds), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorized to run. The default is 1209600 seconds (14 days). Do not use commas as separators in the value.
`ACTIVATIONSERVER`	http://<tableau_server_url>	For first time activation, sets the default URL for the Tableau Server you want users to use for activation.
`WorkGroupServer` (Windows) `WorkgroupServer` (macOS)	http://<tableau_server_url>	For updates to the Windows registry or macOS plist, sets the default URL for the Tableau Server you want users to use for activation. Note: On Tableau Desktop on macOS, you would use the WorkgroupServer option. On macOS, this option is case sensitive and uses a lowercase "g".
`REPORTINGFREQUENCYSECONDS`	3600	Sets the default (in seconds) for how often the login-based license management report is sent to Tableau Server or Tableau Cloud. The minimum setting is 60 seconds, and the default is 3600 seconds (one hour). Change this setting to reduce the load on Tableau Server or to reduce network traffic. No matter what the authorization-to-run (ATR) lease duration is set to, `REPORTINGFREQUENCYSECONDS` sets the time interval that the Tableau Desktop or Tableau Prep Builder client report login-based license management activations back to Tableau Server or Tableau Cloud.

Content asset type	Who can change ownership	Who can be given ownership
Top-level projects	Server administrator¹ Site administrator	Server administrator Site administrator Creator Explorer (can publish)
Child (nested) projects	Server administrator Site administrator Project owner	Any administrator or owner, excluding Explorer and Viewer.
Workbooks and data sources	Server administrator Site administrator Workbook or data source owner Project leader or owner of the project that contains the item	Server administrator Site administrator Creator Explorer (can publish)
Metrics (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see Create and Troubleshoot Metrics (Retired).)	Server administrator Site administrator Metric owner Project leader or owner of the project that contains the item	Any administrator or user of the site, excluding Explorer and Viewer.
Flows	Server administrator Site administrator Flow owner (2025.2 and later)	Server administrator Site administrator Creator Note: In versions 2025.1 and earlier, Server and site administrators can only change the owner to themselves.
Data Roles	Server administrator Site administrator Data role owner Project leader or owner of the project that contains the item	Any administrator or user of the site, excluding Explorer and Viewer.
Collections	Server administrator Site administrator Collection owner	Server administrator Site administrator Creator Explorer Viewer
Virtual Connections²	Server administrator Site administrator Virtual connection owner	Server administrator Site administrator Creator

Regular expression	Description
`.`	A period (.) is a wildcard you can use to match any character. If you need to specify a period (.) in the URL instead of a wildcard, you can escape the character with a backslash (`\.`).
`*`	An asterisk (*) is a quantifier that specifies one or more instances of the previous character.

To specify...	Example	Specifies
Range of domains	.*\.example.com	All subdomains under example.com.
All ports	example.com:.*	Extensions are allowed access from all ports on example.com.
All extensions under domain, port, and path	example.com:8080/xyz/.*	All extensions under the domain example.com that use port 8080 and are located in zyz, are allowed access.
All ports for a range of domains	.\.example.com:.	Allows access to extensions on all ports on all subdomains under example.com.
All extensions under a domain and path that match the pattern	example.com/t.c/.*	Allows access to extensions running on example.com under folders that match the pattern t.c. For example, tic, tac, toc.

Label category	Can edit label category	Can edit label names	Can edit label descriptions	Can edit label visibility
Certification	No	No	Yes	N/A
Quality Warning	No	Yes¹	Yes	Yes²
Sensitivity	No	Yes	Yes	Yes
Custom	No	Yes	Yes	N/A

Capability	Description	Template
View	See the database or table asset.	View
Overwrite	Add or edit data quality warnings and descriptions of the database or table asset. Prior to version 2020.1, the Overwrite capability was called Save.	Publish
Move	Move the database or table asset.	Administer
Set Permissions	Grant or deny permissions for the database or table asset.	Administer

Data Management	Capability	Requirements
Licensed	See assets and their metadata	None
	Edit assets and their metadata	None
	Change permission on assets and their metadata	None
	Grant users ability to see assets and their metadata	Default: When "derived permissions" is on, your users can see metadata on external assets for the content that they own, or for the content that is published to a project that they are a project leader or project owner of. Ad-hoc: You can configure explicit View permissions on a specified external asset.
	Grant users ability to edit assets and their metadata	You can configure explicit "write" or Overwrite permissions on a specified external asset (if not automatically granted because the user is a flow owner).
	Grant users ability to change permissions on assets and their metadata	You can configure explicit "edit" or Set Permissions on a specified external asset (if not automatically granted because the user is a flow owner).
Not licensed	See all assets and their metadata	Only by using the Metadata API. If "derived permissions" is enabled by your Tableau Server admin, you can see metadata on external assets for the content that you own, or for the content that is published to a project that you are a project leader or project owner of.
	Edit assets and their metadata	Requires Data Management
	Change permission on assets and their metadata
	Grant users ability to see assets and their metadata
	Grant users ability to edit assets and their metadata
	Grant users ability to change permissions on assets and their metadata

Changing from	Changing to	Outcome
Locked (including nested projects)	Locked	Doesn’t modify existing permission rules. Any nested projects become customizable.
Locked (including nested projects)	Customizable	Doesn’t modify existing permission rules, though they become customizable. Any nested projects become customizable.
Locked	Locked (including nested projects)	Overwrites existing custom permission rules for all nested projects and their content. This can’t be undone.
Locked	Customizable	Doesn’t modify existing permission rules, though they become customizable. Any nested projects retain their content permission settings and permission rules.
Customizable	Locked (including nested projects)	Overwrites existing custom permission rules for content in the project, and all nested projects and their content. This can’t be undone.
Customizable	Locked	Overwrites existing custom permission rules for content in the project. This can’t be undone. Any nested projects retain their permission rules and remain customizable.

Configuration Parameter	Description
clustercontroller.zookeeper.password	Password for cluster controller to connect to zookeeper.
indexandsearchserver.client.password	Password for logging into Index and Search Server.
indexandsearchserver.ssl.admin.cert.bytes	Admin certificate that is used for administrative access to the Index and Search Server. The admin certificate is used to generate the node certificate.
indexandsearchserver.ssl.admin.key.file_bytes	Certificate key for administrative access to the Index and Search Server.
indexandsearchserver.ssl.node.cert.bytes	Certificate that is used for Index and Search Server node-to-node communication.
indexandsearchserver.ssl.node.key.file_bytes	Certificate key that is used for Index and Search Server node-to-node communication.
indexandsearchserver.ssl.root.cert.bytes	Certificate that is used to sign the admin and node certificates . This certificate is used by TSM for health check and by NLP to connect to Index and Search Server.
indexandsearchserver.ssl.root.key.file_bytes	Certificate key for root certificate.
filestore.zookeeper.password	Password for filestore to connect to zookeeper.
hyper.connection.init_password	Password used to initialize the Hyper database for user `tableau_internal_user` and is then used for connecting to Hyper.
jdbc.password	Password for the rails Postgres user.
kms.persistent_store	A collection of master encryption keys (MEKs) used by the Key Management System.
maestro.rserve.password	Password for connecting to an external Rserve instance used by Tableau Prep Conductor for running flows that have nodes with R scripts.
maestro.tabpy.password	Password for connecting to an external TabPy (Python server) instance used by Tableau Prep Conductor for running flows that have nodes with Python scripts.
oauth.google.client_secret	Client secret of the Google Cloud Platform account.
oauth.quickbooks.consumer_secret	Consumer secret of the Intuit developer account.
oauth.salesforce.client_secret	Client secret of the Salesforce developer account.
pgsql.adminpassword	Password for the tblwgadmin Postgres user. Note: Although the configuration parameter is encrypted in Tableau's configuration files (tabsvc.yml, workgroup.yml), this password is stored in plain text in files used by SAML.
pgsql.readonly_password	Password for the readonly Postgres user.
pgsql.remote_password	Password for the tableau Postgres user.
redis.password	Password for Redis. Note: Although the configuration parameter is encrypted in Tableau's configuration files (tabsvc.yml, workgroup.yml), the configuration will still be in plain text in the redis.conf file that is consumed by the Redis application. Redis does not support encrypted/secured passwords.
servercrashupload.proxy_server_password	Password for custom proxy server used to upload crash reports.
service.runas.password	Password of the Run As users. Stored temporarily.
ssl.cert.file_bytes	The content of one of the three SSL certificate files uploaded by the administrator. The certificate files are required to enable secure external connections to Tableau Server.
ssl.chain.file_bytes	The chain file(s) for the certificates uploaded by the administrator for external SSL.
ssl.key.file_bytes	Key file(s) for the certificates uploaded by the administrator for external SSL.
ssl.key.passphrase	Optional passphrase used to protect the external SSL key.
svcmonitor.notification.smtp.password	SMTP Server password supplied by the administrator through TabConfig.exe.
tabadminservice.password	Password for the service that allows server admins to download log files through the web interface.
vizportal.openid.client_secret	This is the password ("provider client secret") used for OpenID Connect SSO.
vizqlserver.external_proxy_password	Password used to authenticate to an external proxy.
wgserver.domain.password	Password used to bind to Active Directory.
wgserver.saml.key.passphrase	Passphrase used to access the PKCS#8 SAML key file.
zookeeper.tsm.password	Password that TSM uses to connect to Zookeeper coordination service

Type	tsm command	Default	Procedure
Jobs schedule	N/A	3:00 AM, daily until complete	Configurable from the Identity Migration page, see Change daily migration job schedule above.
User identity requests per second (rate)	`tsm authentication identity-migration configure -–rate`	Up to 5	If needed, you can use the `tsm authentication identity-migration` command to change the migration settings listed above using the steps below. Open a command prompt as an admin on the initial node (where TSM is installed) in the cluster. Run one or both of the commands described in `tsm authentication identity-migration`. For example, to change the individual job runtime and rate from their default values, you can run the following command: `tsm authentication identity-migration configure --job-run-time 180 --rate 3`
Individual job runtime	`tsm authentication identity-migration configure -–job-run-time`	120 minutes
Enable identity migration	`tsm configuration set -k features.IdentityMigrationBackgroundJob`	`false`	By enabling the identity migration, Tableau Server can use the Identity Service to store and manage user identity information. Open a command prompt as admin on the initial node (where TSM is installed) in the cluster. Run the command the following command: `tsm configuration set -k features.IdentityMigrationBackgroundJob -v true` Note: The identity migration and the Identity Service is a prerequisite for certain capabilities like identity pools. For more information about the tsm command, see features.IdentityMigrationBackgroundJob.

Area	Impact
Search	User information not displayed
Content owners	User information not displayed (Explorers and Viewers can't see themselves, but can see their content in My Content)
Profile pictures	User information not displayed
Subscriptions	User information not displayed
Recommendations	Similar users not displayed (all users)
Add/Edit Tags	Explorers and Viewers can see tags but cannot delete or modify them
"Who has seen this view?"	Disabled
Ask Data usage analytics	Disabled
Permissions dialogs	Disabled
Named sharing	Disabled (all users)
Alerts	Disabled (all users) Existing alerts paused
Comments	Disabled (all users)
Public Custom Views	Disabled (all users) Existing public custom views appear as private
Request Access	Disabled (all users)
Tableau Desktop	Publishing workbooks disabled from Desktop User information not displayed on user filters
Tableau Pulse	The button to see and manage followers doesn't appear on metrics
Tableau Catalog (with Data Management)	User information not displayed

Content	Action required
Ask Data lenses	Users must recreate Ask Data lenses on the destination site. For more information, see Create Lenses that Focus Ask Data for Specific Audiences.
Collections	Users must recreate collections on the destination site. For more information, see Collections in Tableau Desktop help.
Comments	Users must re-add comments to views on the destination site. For more information, see Comment on Views in Tableau Desktop help.
Custom views	Users must recreate custom views on the destination site. For more information, see Use Custom Views in Tableau Desktop help.
Data freshness policy	Defaults to the site default upon publishing. Users must manually set it up if a specific freshness policy is needed. For more information, see Set a Data Freshness Policy in Tableau Cloud or Set a Data Freshness Policy in Tableau Server help.
Data roles	Users must recreate data roles on the destination site. For more information see Use Data Roles to Validate your Data in Tableau Prep Builder help.
Data source certifications	If you have the following site roles and capabilities, you can certify data sources on the destination site. Site Administrator Creator Creator or Explorer (can publish) with Project Leader capability on the project containing the data source For more information, see Use Certification to Help Users Find Trusted Data.
Data-driven alerts	Users must recreate data-driven alerts for dashboards and views on the destination site. After data-driven alerts are created, anyone with access to the view can add themselves to existing alerts. For more information, see Send Data-Driven Alerts from Tableau Cloud or Tableau Server in Tableau Desktop help.
Descriptions for workbooks and data sources	If you own the content item or have the appropriate permissions, you can edit the item's description on the destination site. For more information, see Add or edit descriptions in Tableau Desktop help.
Embedded credentials	For security purposes, Tableau Server removes embedded credentials from data sources during the download process. To include embedded credentials when migrating from Tableau Server to Tableau Cloud, use the Migrate Embedded Credentials for Workbooks and Migrate Embedded Credentials for Data Source publish options. For more information, see Migrate Workbooks and Data Sources with Embedded Credentials. To include embedded credentials when publishing to Tableau Server sites, use the Set Connection Info data source transformation. For more information, see Migration Plans: Published Data Sources. Note: CMT does not support embedded credential migration for OAuth connections. To migrate OAuth credentials, use the Set Connection Info data source transformation.
External assets	Customized attributes for external assets are not migrated to the destination site. For example, tags, certifications, data quality warnings, descriptions, permissions, user contacts, tables, and columns must be recreated. For more information, see Manage Permissions for External Assets.
Extract refresh schedules	Extract refresh schedules cannot be migrated to Tableau Cloud destination sites. To refresh data on Tableau Cloud, you can run extract refreshes manually or create new extract refresh schedules. For more information, see Schedule Refreshes on Tableau Cloud.
Favorites	Users must reselect their favorite content on the destination site. For more information, see Mark Favorites in Tableau Desktop help.
Flows	To run flows on a schedule, users must republish flows to the destination site with Tableau Prep. For more information, see Publish a Flow to Tableau Server or Tableau Cloud in Tableau Prep help.
Incremental extract refreshes	Incremental extract refreshes are changed to full extract refreshes on the destination site. Users must reconfigure incremental refreshes in Tableau Desktop and publish extracts to the destination site after migration. For more information, see Refresh Extracts in Tableau Desktop help.
Metrics	The historical values for metrics are removed from views, and users must recreate metrics on the destination site. For more information, see Create and Troubleshoot Metrics (Retired). The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see Create and Troubleshoot Metrics (Retired).
Revision history	To migrate previous versions of workbooks to the destination site, users must download the versions they wish to keep and republish the workbook to the destination site. For more information see Work with Content Revisions in Tableau Desktop help.
Subscriptions	Users must resubscribe to views and workbooks on the destination site. For more information, see Create a Subscription to a View or Workbook.
Thumbnails for workbooks and views	Workbooks and views that are migrated using the Content Migration Tool will retain their original thumbnails, even if the migration plan includes transformations that result in the views being rendered differently (for example, if data connections change). To update thumbnails, edit the workbook or view on the destination site and re-save it. For more information, see Edit Tableau Views on the Web in Tableau Desktop help.
Virtual connections	Users must recreate virtual connections on the destination site. For more information, see Create a Virtual Connection.

Mapping Type	Source	Destination
domain	`<domain>`	`<domain>`
user	`<domain>`\`<user name>` local\`<user name>`	`<domain>`\`<user name>` local\`<user name`>
group	`<domain>`\`<group name>` local\`<group name>`	`<domain>`\`<group name>` local\`<group name>`

RLS option	Useful when	Pros	Cons
Manual user filter	You are doing a proof of concept or testing user filtering functionality You are creating a static workbook to use with an unchanging group of users You understand the data security risk of having the permissions set incorrectly	Simple at small scales Easy to understand mapping Good for testing	High-maintenance Need to update filter and republish as user base changes Permissions must be secured to prevent users from seeing unfiltered data Must be replicated in every workbook
Dynamic user filter	You don't have a Data Management license The data contains information you can use to filter it You understand the data security risk of having the permissions set incorrectly	Relatively easy to set up	Permissions must be secured to prevent users from seeing unfiltered data Must be replicated in every workbook or data source
Data policy	You have a Data Management license The data contains information you can use to filter it Ease of data security is a significant concern	Centralized Secure Low-maintenance Responsibilities for security and analytics can be separated	Data Management license required
RLS in the database	Your database has an existing RLS security built into the database You aren’t using extracts	Might already be built into your organization’s database Policies can be applied to database clients other than Tableau	Must use live queries Might have limitations or requirements. Your IT team can identify them

Does your organization have a preferred RLS solution in the database that works for this project?	→ Yes →	See Row-Level Security in the Database
↓ No ↓
Do you have a Data Management license?	→ Yes →	See About Virtual Connections and Data Policies
↓ No ↓
Is this a proof of concept, a basic user filter test, or a static workbook with unchanging users?	→ Yes →	See Use a manual user filter
↓ No ↓
See Use a dynamic user filter

	View template	Explore template	Publish template	Administer template
Flows	View lets a user view the flow.	Download flow lets a user download the flow (as a TFLX).	Run lets a user run the flow. Overwrite lets a user publish a flow and overwrite the published flow.	Move lets a user move assets between projects. For more information, see Move content. Delete lets a user delete the asset. Set Permissions lets a user create permission rules for the asset.
Data Roles	View lets a user view data roles.	n/a	Overwrite lets a user publish data roles, overwrite published data roles, and edit published data roles' synonyms.
Metrics (retired)	View lets a user view metrics.	n/a	Overwrite lets a user overwrite a metric and edit a metric's details.
Ask Data Lenses	View lets a user see the lens.	n/a	Overwrite lets a user edit the lens.
Virtual Connections	View lets a user see the virtual connection. Connect* lets a user connect to data using a virtual connection.	n/a	Overwrite lets a user edit the virtual connection.
Databases	View lets a user see the database.	n/a	Overwrite lets a user edit the metadata for the database.
Tables	View lets a user see the table.	n/a	Overwrite lets a user edit the metadata for the table.
Collections	View lets a user view collections.	n/a	n/a	n/a

Desired functionality	Minimum Site Role	Web Edit	Download/ Save a Copy	Overwrite (workbook)	Publish (project)	Connect (data source)
Web author without being able to save	Explorer	Allow	Deny	Deny	Optional	Allow
Web author and save as new content	Explorer (can publish)	Allow	Allow	Deny	Allow	Allow
Web author and save (overwrite) content	Explorer (can publish)	Allow	Allow	Allow	Allow	Allow
Web author with new data and save new content	Creator	Allow	Optional	Optional	Allow	Optional

Workbook authentication to the data source	Data source authentication to the data	How data access is evaluated for someone consuming the workbook
Embed password	Embed password	User sees the data as if they were the workbook author
Embed password	Prompt user	User sees the data as if they were the workbook author. (The author is prompted for data source authentication, not the user.)
Prompt user	Embed password	User must have their own Connect capability to the published data source
Prompt user	Prompt user	User must have their own Connect capability to the published data source and are prompted for their credentials to the underlying data

Explain Data can't be run in views that use:	Map coordinate filters Blended data sources Data sources with parameters Data sources that don't support COUNTD or COUNT(DISTINCT ...) syntax, such as Access. Filters on aggregate measures Disaggregated measures
Explain Data can't be run if you select:	Multiple marks Axis Legend Grand total Trend line or reference line A mark in a view that contains a very low number of marks
Explain Data can't be run when the measure to be used for an explanation:	Isn't aggregated using SUM, AVG, COUNT, COUNTD Is a table calculation Is used in measure values
Explain Data can't offer explanations for a dimension when it is:	A calculated field A parameter Used in Measure Names and Measure Values A field with more than 500 unique values. Dimensions with more than 500 unique values will not be considered for analysis.

Conflict type	Applies to configuration	Conflict reason	Action
All failures	All	This tab captures all identity conflicts categorized in the No matches, Ambiguous, Duplicate, Not local, and Unknown tabs.	Retry Migration or Acknowledge
No matches	AD, LDAP	The users identities have no matching users in the external identity store.	Retry Migration or Acknowledge
Ambiguous	AD, LDAP	For the specified user identities, there is more than one possible match in the external identity store.	Retry Migration, Acknowledge, or select one of the suggested user identities
Duplicate	AD	Two user identities were created using one AD account. This is an artifact of legacy functionality that is not supported in the Identity Service.	Retry Migration or Acknowledge
Not local	Local	User identities that are associated with an identity store that is not local. This conflict occurs because manual changes were made that are not supported.	Retry Migration or Acknowledge
Unknown	All	This conflict might indicate an internal Tableau Server error or an identity conflict caused by a reason not listed in this table.	Retry Migration or Acknowledge
Acknowledged	All	This tab captures all user identities that will not be migrated. Those users will not be able to sign in to Tableau Server after Tableau Server is configured to use the Identity Service.	Retry Migration or Acknowledge

RMT Server services
Name	Purpose	Log file location Windows: `C:\Program Files\Tableau\Tableau Resource Monitoring Tool\master\logs\` Linux: `/var/opt/tableau/tabrmt/master/logs` Note: For additional information about log files, see: Tableau Resource Monitoring Tool Log Files.	Notes
Host	Used during installation and also to ensure the other processes are running.	Windows: `host\YYYYMMDD.log` Linux: `host/YYYMMDD.log`	Responsibilities: Process watcher: Makes sure other processes are running. Config File Watcher: Detects and responds to changes in configuration files.
Backgrounder	Processes the information sent from the agents and maintains the postgres data RMT collects. Also provides admin command line utility. Generates incidents and notifications based on information processed.	Windows: `background\YYYYMMDD-pts.log` Linux: `background/YYYYMMDD-pts.log`	Responsibilities: rmtadmin: command line utility that exposes command line functionality for administrator. Agent Data Processing: Handles data collection and processing from various agents TS Status Polling: Periodically polls Tableau Server (TS) status, ensuring the system is active and healthy. Incident Analysis: Analyzes incidents, like errors, failures, reaching thresholds for different measures. Data Cleanup: Responsible for cleaning up old data. Ad Hoc Graph Info Collection: Collects data for on-demand for monitoring. Notifications: Manages sending notifications for alerts and incidents. Data Archiving (Disabled): involve archiving old data to free up resources or for compliance. This is currently disabled.
Director	Kind of a coordination process, and one of it's primary responsibilities is to query the Tableau Server for licenses status, and sets the system wide status.	Windows: `director\YYYYMMDD-pts.log` Linux: `director/YYYYMMDD-pts.log`	Responsibilities: Cluster Status: Monitors the health and status of the server cluster and sets the system wide status. Licensing: query the Tableau Server for licenses status. Graph Scraping: Extracts data for monitoring and reporting. Likely has access to server database. Database Upgrade: Handles updates to the database schema or version Daily Aggregate Processing: Executes daily processing tasks, like aggregating data for reports or analysis.
Web	Runs the web server. Provides user interface. Registers Agents for information gathering	Windows: `web\YYYYMMDD-pts.log` Linux: `web/YYYYMMDD-pts.log`	Responsibilities: Agent Registration: Manages the registration of agents that monitor or collect data on Tableau server. Config UI: Provides a user interface for configuring various system settings and parameters. Performance / Activity / Content UI: Offers a UI for users to view performance metrics, activity logs, and content-related data in the system.
PostgreSQL	Local data repository	Windows: `pgsql\.log and .csv` Linux: `pgsql/.log and .csv`
RabbitMQ	Message broker	Windows: `\master\logs\rabbitmq\.log` Linux: `master/logs/.log`

RMT Agent services
Name	Purpose	Log file location Windows: `C:\Program Files\Tableau\Tableau Resource Monitoring Tool\master\logs\` Linux: `/var/opt/tableau/tabrmt/master/logs` Note: For additional information about log files, see: Tableau Resource Monitoring Tool Log Files.	Notes
Host	Used during installation and also to ensure the other processes are running.	Windows:`host\YYYYMMDD.log` Linux: `host/YYYYMMDD.log`	Responsibilities: Process watcher: Makes sure other processes are running. Config File Watcher: Detects and responds to changes in configuration files.
Backgrounder	Processes the information sent from the agents and maintains the postgres data RMT collects. Also provides admin commandline utility. Generates incidents and notifications based on information processed.	Windows: `background\YYYYMMDD-pts.log` Linux: `background/YYYMMDD-pts.log`	Responsibilities: rmtadmin: command line utility that exposes command line functionality for administrator. Log watcher: Processes the information sent by Tableau server from logs.
Web	Runs the web server. Performs agent registration to master for data publishing.	Windows: `web\YYYYMMDD-pts.log` Linux: `web/YYYMMDD-pts.log`

Service Account	Resource	Default permissions	Required minimum permissions
Tableau Resource Monitoring Tool Master
	Application files `Tableau Resource Monitoring Tool\master`	Full control: read, write, execute, modify	Full control
	Log directories and files `Tableau Resource Monitoring Tool\master\logs`	Full control: read, write, execute, modify	Read, write
	Configuration directory `Tableau Resource Monitoring Tool\master\config`	Full control: read, write, execute, modify	Full control

Tableau Resource Monitoring Tool PostgreSQL
	Application directory `Tableau Resource Monitoring Tool\prerequisites\postgresql<nn>`	Full control: read, write, execute, modify	Full control
	Data directory `Tableau Resource Monitoring Tool\data\postgresql<nn>`	Full control: read, write, execute, modify	Full control
	Logs directory `Tableau\Tableau Resource Monitoring Tool\master\logs\pgsql`	Full control: read, write, execute, modify	Read, write .

Tableau Resource Monitoring Tool RabbitMQ
	Data directory `Tableau Resource Monitoring Tool\data\rabbitmq`	Full control: read, write, execute, modify	Full control
	Application files `Tableau Resource Monitoring Tool\prerequisites\rabbitmq` `Tableau Resource Monitoring Tool\prerequisites\erlang`	Full control: read, write, execute, modify	Full control
	Log files `Tableau Resource Monitoring Tool\master\logs\rabbitmq`	Full control: read, write, execute, modify	Read, write

Tableau Resource Monitoring Tool Agent
	Application files `Tableau Resource Monitoring Tool\agent`	Full control: read, write, execute, modify	Full control
	Log directory and files `Tableau Resource Monitoring Tool\agent\logs`	Full control: read, write, execute, modify	Read
	Configuration directory `Tableau Resource Monitoring Tool\agent\config`	Full control: read, write, execute, modify	Full control

Service Account	Resource	permissions
Tableau Resource Monitoring Tool Master
	Application files `/var/opt/tableau/tabrmt/master`	Owner - Full permissions (read, write, execute) Group - read, write, execute Others - read, execute
	Log directories and files `/var/opt/tableau/tabrmt/master/logs`	Owner - Full permissions (read, write, execute) Group - read, write, execute Others - read, execute
	Configuration directory `/var/opt/tableau/tabrmt/master/config`	Owner - Full permissions (read, write, execute) Group - read, write, execute Others - read, execute

Tableau Resource Monitoring Tool PostgreSQL
	Application directory `/opt/tableau/tabrmt/prerequisites/postgresql13`	Owner - Full permissions (read, write, execute) Group - read, execute Others - read, execute
	Service directory `/var/opt/tableau/tabrmt/data/postgresql13/pg_*`	Owner - Full permissions (read, write, execute) Group - none Others - none
	Data directory `/var/opt/tableau/tabrmt/data/postgresql13/`	Owner - Full permissions (read, write, execute) Group - read, write, execute Others - read, execute
	Logs directory `/var/opt/tableau/tabrmt/master/logs/pgsql`	Owner - Full permissions (read, write, execute) Group - read, write, execute Others - execute
	Other directories under the PostgreSQL directory not mentioned above `/var/opt/tableau/tabrmt/data/postgresql13/<not mentioned above>`	Owner - read, write Group - none Others - none
	`/var/opt/tableau/tabrmt/data/postgresql13/base` `/var/opt/tableau/tabrmt/data/postgresql13/global`	Owner - Full permissions (read, write, execute) Group - none Others - none
	`/var/opt/tableau/tabrmt/data/postgresql13/certificates`	Owner - Full permissions (read, write, execute) Group - Full permissions (read, write, execute) Others - execute

Tableau Resource Monitoring Tool RabbitMQ
	Data directory `/var/opt/tableau/tabrmt/data/rabbitmq`	Owner - Full permissions (read, write, execute) Group - read, write, and execute Others - read, execute
	Application files `/var/opt/tableau/tabrmt/rabbitmq/prerequisites/rabbitmq` `/var/opt/tableau/tabrmt/rabbitmq/prerequisites/erlang`	Owner - Full permissions (read, write, execute) Group - read,execute Others - read, execute
	Log files `/var/opt/tableau/tabrmt/master/logs/rabbitmq`	Owner - Full permissions (read, write, execute) Group - read, write, and execute Others - execute
	Other directories (under `/rabbitmq` directory) `/var/opt/tableau/tabrmt/data/rabbitmq/certificates` `/var/opt/tableau/tabrmt/data/rabbitmq/mnesia`	Owner - Full permissions (read, write, execute) Group - read, write, and execute Others - execute
	`/var/opt/tableau/tabrmt/data/rabbitmq/<other than mentioned>`	Owner - read, execute Group - read, execute Others - none

Tableau Resource Monitoring Tool Agent
	Application files `/var/opt/tableau/tabrmt/agent`	Owner - Full permissions (read, write, execute) Group - read, write, and execute Others - read, execute
	Log directory and files `/var/opt/tableau/tabrmt/agent/logs`	Owner - Full permissions (read, write, execute) Group - read, write, and execute Others - read, execute
	Configuration directory `/var/opt/tableau/tabrmt/agent/config`	Owner - Full permissions (read, write, execute) Group - read, write, and execute Others - read, execute

Result	Status	Action
PASS	EXIT CODE 0	No issues found. The upgrade proceeds.
WARN	EXIT CODE 1	The upgrade proceeds, but you must review the report for non-critical risks.
FAIL	EXIT CODE 2	Upgrade Aborted. You must resolve these issues before re-running the upgrade.