Skip to main content

Open the MongoDB shell

Use the s1 db command to open a shell on the database that Netwrix Privilege Secure for Discovery uses. The command selects the active database service and the correct shell binary for you, so it works on MongoDB 4.0, during a migration, and on MongoDB 8.0.

Open the shell with s1 db​

  1. Sign in to a swarm manager node. For a cluster, use a node that hosts a MongoDB member.

  2. Run the following command:

    s1 db

    The s1 tool detects a single-node deployment or a cluster from the number of nodes in the swarm. To select the topology yourself, add --single-node or --multi-node before db, as in s1 --multi-node db. For a custom stack name, place --stack <stack-name> before db.

Run s1 without sudo. The launcher calls sudo itself, and a sudo s1 command reads the registry credentials of the root user instead of yours. See Install the s1 CLI helper utility.

The shell opens on the SecureONE database. To run a JavaScript file, add --file <filename>. Mount the file in the container under /data/db.

To check the database state without opening a shell, run s1 database-status. The output shows the active database service and the live MongoDB version. For a cluster, it also lists the replica-set members.

On a three-node cluster after retire, s1 db and s1 database-status can't reach the replica set, because they look for secureone and the set is named secureone8. Use Open a shell manually on that cluster.

Choose the shell for the MongoDB version​

The shell binary depends on the MongoDB version, not on the product version.

MongoDB versionShellNotes
4.0mongoThe MongoDB 4.0 image includes only the legacy shell.
8.0mongoshThe MongoDB 8.0 image includes only mongosh.

The s1 db, s1 set-password, and s1 database-status commands choose the correct binary for each container. Use them instead of typing mongo or mongosh yourself.

Some legacy shell commands differ in mongosh. For example, rs.printSlaveReplicationInfo() returns an error in mongosh. Use rs.printSecondaryReplicationInfo() on MongoDB 8.0.

Identify the service names​

The names of the MongoDB services depend on the migration state.

StateSingle-node serviceCluster servicesCluster replica set
MongoDB 4.0, or a new MongoDB 8.0 installation<stack>_db<stack>_mongo1, <stack>_mongo2, <stack>_mongo3secureone
During a migration, before cutover<stack>_db is active. <stack>_db8 is the target.<stack>_mongoN is active. <stack>_mongoN-8 is the target.secureone is active. secureone8 is the target.
After cutover, before retire<stack>_db8 is active. <stack>_db has zero replicas.<stack>_mongoN-8 is active. <stack>_mongoN has zero replicas.secureone8
After retire<stack>_db<stack>_mongo1, <stack>_mongo2, <stack>_mongo3secureone8

The default stack name is s1. See Verify and maintain the deployment after cutover for how to recognize each state.

Open a shell manually​

Use this method only when s1 db isn't available. Take care with the container filter, because a plain name=s1_db also matches s1_db8, and name=s1_mongo1 also matches s1_mongo1-8.

  1. Run s1 database-status or docker service ls | grep -i mongo to find the active service.

  2. Find the container for the active service on the local node. The trailing \. keeps the filter from matching the -8 and 8 services:

    docker ps --filter 'name=<service>\.' --quiet

    For example, use s1_db\. for the MongoDB 4.0 single-node service. Use s1_db8 for the single-node target, because that name doesn't collide with another.

  3. Open the shell with the binary for the MongoDB version. For a single node on MongoDB 4.0:

    docker exec -it <container-id> mongo mongodb://db:27017/SecureONE

    For a single node on MongoDB 8.0 in a new installation, or after retire:

    docker exec -it <container-id> mongosh mongodb://db:27017/SecureONE

    For a single node on MongoDB 8.0 after cutover and before retire:

    docker exec -it <container-id> mongosh mongodb://db8:27017/SecureONE

    For a cluster, use the replica-set connection string that matches the state:

    mongodb://mongo1,mongo2,mongo3/SecureONE?replicaSet=secureone
    mongodb://mongo1-8,mongo2-8,mongo3-8/SecureONE?replicaSet=secureone8
    mongodb://mongo1,mongo2,mongo3/SecureONE?replicaSet=secureone8

    Use the first string while the application uses MongoDB 4.0 and on a new MongoDB 8.0 installation, the second string after cutover and before retire, and the third string after retire. Run the first string with mongo on MongoDB 4.0 and with mongosh on MongoDB 8.0. Run the second and third strings with mongosh.