--- schema_version: "1" id: a16fba3c2b33d44f38c9d72d0e6a0c5c3982e882184057cced26f957ad4bb612 title: "RMT Upgrade: Technical Reference" collection: tableau version: next locale: en-us portal_url: https://docs.salesforce.com/tableau/next/en-us/server/rmt-admin-upgrade-reference.md canonical_url: https://help.tableau.com/v0.0/server/en-us/rmt-admin-upgrade-reference.htm source_site: help.tableau.com content_type: documentation content_hash: c98ca181132c2a754a2b0947a620aa9c31de2c373992738b1c21e1124b089b41 description: Technical reference of operational thresholds and checks during RMT upgrade. --- [Skip to main content](#main-content) # RMT Upgrade: Technical Reference This section is a technical reference guide for the operational thresholds, system paths, and network ports checked during the upgrade process. Use these tables to quickly diagnose validation failures and align your environment with required RMT baselines. **Note**: To align with our company values of Equality, we have updated RMT Master to RMT Server. In some cases, RMT Server installation paths and commands may use the term "master" instead of "server." So, you may continue to see the term in CLI commands and options, installation folders, configuration files. and other instances. For more information, see [About Tableau Help](https://help.tableau.com/current/tableau/en-us/about-tableau-help.htm).. ## Pre-upgrade health checks The pre-upgrade health check inspects your RMT Server or Agent host while the existing installation is still intact like services running, database accessible and generates a detailed PASS / FAIL / WARN report. It runs over 80 individual checks across system resources, accounts, file permissions, PostgreSQL, RabbitMQ, networking, configuration files, and RMT services. The following table lists the checks performed before the upgrade. If any item returns a **FAIL** status (Exit Code 2), the upgrade is canceled. ### System and hardware

Check ID	Name	Platforms	Failure (FAIL) / Warning (WARN) Condition
#1	Operating System	Linux, Windows	WARN OS version is not in the pre-check allow-list. The supported list is RHEL 8.x/9.x, Ubuntu 20.04/22.04/24.04, CentOS Stream 8/9, Oracle Linux 8.x/9.x, AlmaLinux 8.x/9.x, Rocky Linux 8.x/9.x, Amazon Linux 2023, Windows Server 2019/2022
#2	Disk Space	Linux, Windows	FAIL RMT Server < 20 GB or Agent < 5 GB free. WARN RMT Server < 50 GB or Agent < 10 GB free
#2a	Disk Type	Linux, Windows	INFO Reports if the drive is SSD or HDD
#3	RAM	Linux, Windows	WARN RMT Server < 8 GB (minimum) or Agent < 4 GB (minimum)
#4	CPU Cores	Linux, Windows	WARN RMT Server < 8 GB (minimum) or Agent < 4 GB (minimum)
#4a	CPU Instructions	Linux, Windows	FAIL (Linux): Missing sse4_2 or popcnt. WARN (Windows): Older CPU detected.
#4b	VC++ Redist	Windows	FAIL Visual Studio 2022 C++ Redistributable missing.
#4c	OpenSSL DLLs	Windows	INFO Checks for libcrypto-3-x64.dll and libssl-3-x64.dll
#5	System uptime	Linux, Windows	INFO: Notes if < 10 minutes (very recent reboot) or > 90 days (pending patches)
#6	Systemd running	Linux	FAIL systemd not running, PASS : Running or degraded
#7	FIPS Mode	Linux, Windows	FAIL (Windows): Enabled in registry, PASS FIPS disabled . WARN (Linux) Mismatch with config.json. PASS OS and config match
#7a	PowerShell version	Windows	INFO PowerShell version
#7b	System locale	Windows	INFO System locale information
#7c	WMI Health	Windows	WARN WMI repository is inconsistent

### Accounts and permissions

Check ID	Name	Platform	Failure (FAIL) / Warning (WARN) Condition
#8	Service Account	Linux, Windows	FAIL RMT service account or Windows service not found
#9	Group Membership	Linux	FAIL Required service groups (e.g., rmtmasterapp, rmtmasterconfig, and so on) missing
#10	User Systemd	Linux	FAIL User systemd daemon/linger is not active
#44	pamtester installed	Linux	WARN if not installed. To fix this, install `yum install pamtester` or `apt install libpam-runtime`

#### Directory ownership and permissions for Linux

Check ID	Directory	Expected Owner:Group	Expected Mode
#11	Config dir	tabrmt-master:rmtmasterconfig	2775
#12	Log dir	tabrmt-master:rmtmasterlogs	2775
#13	Data dir (+ PG/RMQ subdirs)	Component-appropriate	2775
#14	Prerequisites dirs	`root` or component user	755
#14a	`rabbitmq-defaults` file	Group-writable required	g+w
#15	SSL cert dir	tabrmt-master:rmtopenssl	2775
#15a	Home directory	Component user	770
#15b	`/etc/profile.d/tabrmt-*.sh`	root	default
#15c	Config dir setgid bit	--	2xxx required
#16	`environment.bash`	Component user	group-writable

Severity: **FAIL** on ownership only for the data-dir set (#13 and #15). All other Linux directory checks (#11, #12, #14, #14a, #15a–c, #16) emit **WARN** on ownership/mode mismatches because the installer's post install re-applies ownership during upgrade. **WARN** if permission mode is wrong but ownership is correct. #### Directory ownership and permissions for Windows

Check	Name	Severity
#11	Config dir ACLs	FAIL if service user lacks FullControl
#12	Log dir ACLs	FAIL if service user lacks Modify
#13	Data dir ACLs (RMT Server)	FAIL if service user lacks FullControl on PG/RMQ data dirs
#14	Prereqs dir ACLs (RMT Server)	WARN if missing ReadAndExecute (advisory — every upgrade reinstalls the prereq MSIs and their post-install actions re-apply ACLs)
#15	SSL cert dir ACLs (RMT Server)	FAIL if service user lacks FullControl
#16a	Service user identity	PASS (informational -- shows which user the service runs as)
#16b	SeServiceLogonRight privilege	INFO if found; WARN if not found or secedit fails
#16c	Service user ACLs on RMT dirs	FAIL if service user lacks required rights

### Database (PostgreSQL) All PostgreSQL checks run only on the RMT Server.

Check ID	Name	Requires --`db-password` option	Failure (FAIL) / Warning (WARN) Condition
#17	PG Service	No	FAIL Local service Stopped AND Disabled
#18	Port 5555 listening	No	WARN (security group / VPC / RDS hint) Not listening
#19	DB Connection	Yes	WARN Unable to connect to internal DB (SSL, password, or network issue)

### Messaging (RabbitMQ) The Messaging (RabbitMQ) checks run only on the RMT Server.

Check ID	Name	Failure (FAIL) / Warning (WARN) Condition
#22	RMQ Service	FAIL Local service Stopped AND Disabled
#24	Queue Backlog	WARN Any queue that has > 10,000 messages
#25	RabbitMQ users	WARN if default `guest` user still exists
#26	Active connections	INFO only. Reports active connection count
#27	Erlang cookie accessible	WARN if cookie file missing, if permissions wrong (should be mode 400 or 600)
#27a	ERLANG_HOME set	WARN (Windows only) if `ERLANG_HOME` not set or path does not exist.
#27b	SSL Validity	FAIL Certificates are expired
#27c	Disk Alarm	FAIL < 10 GB free on RMQ partition (Upgrade will hang)
#45	Certificate directory populated	WARN if cert dir exists but is empty or missing expected certificate files (server cert, key, CA cert)

### Network and configuration

Check ID	Name	Failure (FAIL) / Warning (WARN) Condition
#28a/b	Agent-Master Comms	WARN Agent cannot reach Master on 5671, 5672, 80, or 443
#33-35	JSON/Bash Config	FAIL Missing or invalid config.json, setup.json, or environment.bash
#36a	Known-Bad Version	FAIL Current version is 2025.3.0 (Regression blocks upgrade)

### Services and backup

Check ID	Name	Failure (FAIL) / Warning (WARN) Condition
#38	All RMT services running	WARN for each stopped service
#38a	Stranded Processes	FAIL Lingering tabrmt-* processes found after services stopped
#39	Background processor running	WARN if the host process is not running
#40	Pre-upgrade backup reminder	WARN as a reminder to back up configuration before upgrading
#41	Topology	INFO only. Reports Master/Agent node type and (with DB) active agent count
#42	Component version inventory	INFO only. Reports RMT, PostgreSQL, RabbitMQ, OpenSSL versions
#43	Machine specs summary	INFO only. Reports OS, CPU cores, RAM, free disk space

## Post-upgrade health checks These checks run after the upgrade. They are non-blocking and failures do not stop the upgrade but indicate post-install issues.

Check ID	Name	Component	Failure (FAIL) / Warning (WARN) Condition
#1a-d	Services and processes	RMT Server, Agent	FAIL Main, PG, or RMQ services are not running
#2	Host process Supervisor	RMT Server, Agent	WARN Host supervisor process missing (No auto-recovery)
#3a-b	Configuration file integrity	RMT Server, Agent	FAIL if missing or invalid JSON
#4a-b	File Permissions	RMT Server, Agent	FAIL Config/Log dirs not readable/writable by service account
#5a-d	Port Listening	RMT Server	FAIL Web (443), AMQP (5672), or DB (5555) not listening
#6	PostgreSQL Connectivity	RMT Server	FAIL PostgreSQL not accepting connections
#7	RabbitMQ status	RMT Server	SKIP if external. FAIL after all retries exhausted.
#8a	Queue Consumers	RMT Server	WARN Backlog exists but no active consumers (Master workers disconnected)
#9	RMQ Alarms	RMT Server	FAIL Active Memory or Disk resource alarms detected
#10	RabbitMQ SSL certificate	RMT Server	FAIL if certificate expired. WARN if certificates expires within 30 days
#11	FIPS Match	RMT Server, Agent	FAIL OS FIPS state mismatches isFIPSEnabled config
#12	Web server HTTP response	RMT Server	Makes HTTP GET to `https://localhost:<port>/authentication/login`. PASS on 200 or 302. FAIL on connection refused/timeout. WARN on other errors.
#13	HTTPS certificate validity	RMT Server	FAIL Web server TLS certificate is expired
#14a-d	Disk Space	RMT Server, Agent	FAIL < 1 GB free. WARN: < 5 GB free
#15	Recent Log Errors	RMT Server, Agent	FAIL FATAL errors in logs. WARN: CRITICAL errors
#16	RMT Status	RMT Server, Agent	FAIL `rmtadmin` status returns failure patterns
#17	Agent log history	Agent	Checks log tracking files (`.history, .json`) in the agent data directory. WARN if files are unreadable or corrupt
#18a-f	Inventory Version	RMT Server, Agent	INFO about RMT version, PostgreSQL version, RabbitMQ version, Erlang/OTP version, .NET Runtime (Windows) / OS (Linux), OS version (Windows) / Kernel (Linux)

## Health check exit codes Use the following exit codes to interpret the results of both the pre-upgrade and post-upgrade health check scripts. ### Pre-upgrade scripts

Exit Code	Status	Upgrade Behavior
0	READY TO UPGRADE	Upgrade proceeds
1	UPGRADE WITH CAUTION	Upgrade proceeds; review warnings
2	Do not upgrade	Upgrade canceled
3	Script Error	Check execution environment

### Post-upgrade scripts

Exit Code	Status
0	ALL PASSED
1	WARNINGS PRESENT
2	CRITICAL FAILURES

## InstallerContext severity changes When run with `-InstallerContext` during automatic Windows MSI upgrades, the following checks behave differently from the manual default. The default (non-InstallerContext) behavior is \*already\* WARN for "stopped but not Disabled" / "port not listening" states; FAIL is reserved for \`Stopped+Disabled\`. Under \`-`InstallerContext`\`, even the \`Disabled\` branch is reported as WARN so an in-flight installer-driven upgrade is never vetoed by a transient state the installer is about to fix.

Check	Name	Default	InstallerContext
#17	PG Service	WARN if Stopped, FAIL if Stopped and Disabled, INFO if all stopped	WARN
#18	PG Port	WARN if not listening, INFO if all services stopped	WARN
#22	RabbitMQ Service	WARN if Stopped, FAIL if Stopped+Disabled, INFO if all stopped	WARN
#23	Port 5672 (AMQP)	WARN if not listening, INFO if all services stopped	WARN
#38a	Stranded RMT Processes	(see check description)	SKIP (installer manages process lifecycle)

### Pre-upgrade thresholds

Threshold	RMT Server	Agent	Unit
Disk space FAIL	20	5	GB free
Disk space WARN	50	10	GB free
Temp dir FAIL	5	5	GB free
Temp dir WARN	10	10	GB free
RAM FAIL	8	4	GB
RAM WARN	16	8	GB
CPU FAIL	4	2	cores
CPU WARN	8	4	cores
Database size FAIL	500	-	GB
Database size WARN	200	-	GB
Hangfire schema FAIL	10	-	GB
Hangfire schema WARN	1	-	GB
WAL dir FAIL (Windows)	10	-	GB
WAL dir FAIL (Windows)	2	-	GB
WAL dir FAIL (Linux)	10	-	GB
Mnesia dir WARN	5	-	GB
RabbitMQ disk alarm FAIL	10	-	GB free
Queue backlog WARN	10,000	-	messages
Certificate expiry WARN	30	30	days
Cleanup retention WARN	180	-	days
Dead tuple ratio WARN	20	-	percent
Agent heartbeat stale	15	-	minutes
Network driver age WARN	3	-	years
Log dir size WARN	5	5	GB
Log dir size WARN (severe)	20	20	GB

### Post-upgrade thresholds

Threshold	Value	Unit
Disk space FAIL	1	GB free
Disk space WARN	5	GB free
Certificate expiry WARN	30	days
Queue backlog WARN	10,000	messages
Log scan window	60	minutes
RabbitMQ startup retry	6 attempts x 5 sec	30 seconds total

## Minimum supported component versions

Component	Minimum Version
RabbitMQ	>= 3.10.10
Agent version	>= 2023.1.0

### Automation and CI/CD Integration **For Linux:** \`\`\`base \# Linux sudo bash rmt-pre-upgrade-check.sh --component master --db-password "$DB\_PASSWORD" EXIT\_CODE=$? if \[ $EXIT\_CODE -eq 2 \]; then echo "BLOCKED: Fix critical issues before upgrading" exit 1 fi \`\`\` **For Windows:** \`\`\`powershell \# Windows .\\rmt-pre-upgrade-check.ps1 -Component master if ($LASTEXITCODE -eq 2) { Write-Error "BLOCKED: Fix critical issues before upgrading" exit 1 } \`\`\` ## Installation directory reference To manually invoke the underlying diagnostic utilities or verify your installation structure, refer to the platform-specific directory paths: ### Linux directory structure \`\`\` `/opt/tableau/tabrmt/ # Install root` +`-- master/ # Master application binaries` `+-- agent/ # Agent application binaries` `+-- prerequisites/ # Bundled dependencies` `/var/opt/tableau/tabrmt/ # Data root` `+-- master/config/ # config.json, setup.json` `+-- master/logs/ # Application logs` `+-- data/postgresql15/ # PostgreSQL data files` `+-- data/rabbitmq313/ # RabbitMQ data/mnesia` `+-- data/ssl/ # TLS certificates` `/etc/opt/tableau/tabrmt/` `+-- master/environment.bash # Master environment variables` `+-- agent/environment.bash # Agent environment variables` \`\`\` ### Windows directory structure \`\`\` `C:\Program Files\Tableau\Tableau Resource Monitoring Tool\ # Install root` `C:\ProgramData\Tableau\Tableau Resource Monitoring Tool\ # Data root` \`\`\` ### Required network ports

Port	Service	Direction
80	RMT Web UI (HTTP)	Inbound
443	RMT Web UI (HTTPS)	Inbound
5672	RabbitMQ AMQP	Inbound on RMT Server
5671	RabbitMQ AMQP over TLS	Inbound on RMT Server
15672	RabbitMQ Management UI	Local
25672	RabbitMQ inter-node	Local
5555	Internal PostgreSQL	Local