Set up Redis

Verbiqo needs one user that can run a few server-level read commands, and nothing that reads keys or writes. Redis 6 and later, Valkey and KeyDB are supported, standalone, with replicas, or as Redis Cluster. Dragonfly is supported from Verbiqo 0.1.26.

At a glance

Supported tasks	Ask about latency, memory and eviction, the slow log, clients, persistence, replication, Redis Cluster and security. Questions: Ask Redis. Every check: Redis checks.
Limitations	Verbiqo reads the server’s own counters and logs, never your keys or values. Redis does not let a user see its own rights. So a user that may write but not administer looks read-only to Verbiqo, and is accepted (details).
Supported versions	Redis 6 and later, and Valkey: standalone, with replicas, or as Redis Cluster. KeyDB, tested on 6.3. Dragonfly from Verbiqo 0.1.26, tested on 2.0, with the differences in Dragonfly.
Authentication	An ACL user and password (ACL is Redis’s per-user access control), or the password alone, which signs in as `default`. On a TLS port, a client certificate and key. The password is kept in the Keychain or Windows Credential Manager.
Minimum permissions	An ACL user with no keys and no channels, starting from no commands, plus `+info +ping +role +dbsize +time +lastsave`. The slow log, latency, memory and client rules are recommended. Create it on every server: ACL users are not copied. Commands: Create the monitoring user. What each part allows: What each part allows.
Connection test	Extensions… › Redis › Test Connection, or `verbiqo redis test <name>`. A good test starts with Connected. and shows the product, version, role, clients, keys and the TLS in use. On a version older than Redis 6, it says so.
First useful question	Redis is slow right now, why? Verbiqo samples the counters for 10 seconds: commands a second, how busy the main thread is, evictions and refused connections. Then it reads the slow log, latency events and clients with large buffers.
Safety controls	A user that can run `ACL GETUSER`, such as `default` or any administrator, is refused. Its reply, which holds password hashes, is dropped unread. Only commands on a read-only list are sent, such as `INFO`, `SLOWLOG GET`, `LATENCY`, `MEMORY STATS`, `CLIENT LIST` and `CONFIG GET`. Every other command is refused before sending. Keys and values are never read. Slow-log entries show only a key’s shape, such as `user:#:cart`, never values or scripts. Password settings such as `requirepass` are withheld from `CONFIG GET` results. A 10-second command timeout. The slow log is read 128 entries at most. No Prefer TLS mode, so the password never quietly falls back to plain text. Every command is on the access record.
Operational limits	The model may add up to 6 commands per question, after Verbiqo’s own checks. Redis has no per-user limit, so cap load with your organization’s settings: Limits you can add.

1. Create the monitoring user

As an administrator, on every server: primary, each replica, each cluster node. ACL users are not copied between servers.

ACL SETUSER verbiqo_monitor on >choose-a-password resetkeys resetchannels -@all +info +ping +role +dbsize +time +lastsave +slowlog|get +slowlog|len +latency|latest +latency|history +latency|doctor +latency|histogram +memory|stats +memory|doctor +client|list +client|info +config|get +cluster|info +cluster|nodes +cluster|shards +cluster|myid +command|count +acl|whoami

Keep it across restarts. If the server keeps users in an aclfile:

ACL SAVE

Otherwise:

CONFIG REWRITE

What each part allows

Part	Allows
`resetkeys resetchannels`	No keys and no Pub/Sub channels: the server refuses any read or write of data.	Required
`-@all`	Starts from no commands at all. Only what follows is allowed.	Required
`+info +ping +role +dbsize +time +lastsave`	The server’s counters, role and size. Every diagnosis starts from `INFO`.	Required
`+slowlog\|get +slowlog\|len`	The slow log. Not `SLOWLOG RESET`.	Recommended
`+latency\|latest +latency\|history +latency\|doctor +latency\|histogram`	Latency events. Not `LATENCY RESET`.	Recommended
`+memory\|stats +memory\|doctor`	Memory breakdown. Not `MEMORY USAGE`, which reads a key.	Recommended
`+client\|list +client\|info`	Connected clients. Not `CLIENT KILL`.	Recommended
`+config\|get`	Settings such as `save`, `bind` and the slow log threshold. Not `CONFIG SET`.	Optional
`+cluster\|info +cluster\|nodes +cluster\|shards +cluster\|myid`	Redis Cluster state and nodes.	Cluster only
`+command\|count +acl\|whoami`	Who Verbiqo signed in as.	Recommended

+config|get also lets the user read password settings (requirepass, masterauth). Verbiqo withholds them from everything it shows and sends. Leave the rule out if that is not acceptable, and Verbiqo says which settings it could not read.

Dragonfly

Available from Verbiqo 0.1.26. Verbiqo 0.1.25 connects to Dragonfly, but its review reads almost nothing there.

Dragonfly takes ACL rules for whole commands only, so the user above is refused. Create this one instead:

ACL SETUSER verbiqo_monitor on >choose-a-password resetkeys resetchannels -@all +info +ping +role +dbsize +time +lastsave +slowlog +latency +memory +cluster +command

The user cannot read or write keys, or read or change users. Dragonfly 2.0 still lets it change settings with CONFIG SET, close clients and reset the slow log, whatever the rules say. Verbiqo never sends those: it sends only commands on its read-only list.
memory-doctor and latency-doctor are not available, because Dragonfly does not have them. Everything else in the review works.

Check the user

As an administrator, on Redis 7 and later. Each line should answer as shown:

ACL DRYRUN verbiqo_monitor INFO
ACL DRYRUN verbiqo_monitor SET x y
ACL DRYRUN verbiqo_monitor CONFIG SET maxmemory 1

OK
User verbiqo_monitor has no permissions to run the 'set' command
User verbiqo_monitor has no permissions to run the 'config|set' command

What Verbiqo checks when it connects

The user	Verbiqo
Can run `ACL GETUSER`, so can read and change users: the `default` user and any administrator	Refuses it, and says to create a monitoring user. The answer to `ACL GETUSER` holds password hashes and is dropped unread.
Cannot run `ACL GETUSER`, such as the user above	Connects. The server enforces the user’s rules, and Verbiqo’s own list besides.
On a server that hides `ACL` (managed services such as Amazon ElastiCache, or Redis before 6)	Connects, and says in each answer that the user’s rights could not be checked.
Missing an optional rule	Connects, and says what it could not read. Ask what should I enable? for the rule to add.
Wrong password, or disabled	Refuses the sign-in, without showing the password.

What Verbiqo cannot check

Redis does not let a user see its own rights. A user that may write but not administer (for example +@all -@admin -@dangerous) looks the same to Verbiqo as the user above, and is accepted.

Verbiqo still sends only the commands on its list: INFO, SLOWLOG GET, LATENCY, MEMORY STATS, CLIENT LIST, CONFIG GET, CLUSTER INFO and the like. GET, SCAN, KEYS, MONITOR, CONFIG SET, CLIENT KILL, FLUSHALL and every other command are refused before anything is sent, whoever asks. But with such a user, only Verbiqo stands between the model and your data. With the user above, the server does too. Use the user above.

Commands in the slow log are shown with their key’s shape (user:#:cart), never values or scripts.

2. Add the connection

Open the form
Extensions… › Redis.
Fill it in
Name, host, port (6379), user verbiqo_monitor, password. Leave User empty to sign in with the password alone (requirepass).
Choose TLS
Redis serves TLS on its own port (tls-port), so the default is Disable. For the TLS port, Require, or Verify full with the CA. Redis asks every TLS client for a certificate unless the server sets tls-auth-clients no: give the client certificate and key.
Test, then save
The test shows the product, version, role, clients, keys and TLS in use.

verbiqo redis add cache --host redis1 --port 6379 --user verbiqo_monitor --password-stdin
verbiqo redis test cache

Save a connection to each server you want to ask about: a replica answers for itself, and each Redis Cluster node for its own slots and its view of the cluster.

TLS

Your server	Choose
The plain port (6379)	Disable.
The TLS port, a self-signed certificate	Require, with the client certificate and key.
The TLS port, a certificate from your CA	Verify full, with the CA, the client certificate and key.

There is no Prefer for Redis: it cannot negotiate TLS, so trying TLS and falling back would quietly send the password in plain text.

Settings that help

Ask what should I enable? to see each item as ready or not.

Item	Lets Verbiqo see
A monitoring user that can read server state and nothing else	Clients, the slow log, latency events and settings.
Latency monitoring on	Forks, slow disk writes and expiry pauses, each with when and how long.
The slow log keeping enough entries	The slowest commands of the last hours, not only the last minutes.

CONFIG SET latency-monitor-threshold 100
CONFIG SET slowlog-log-slower-than 10000
CONFIG SET slowlog-max-len 1024
CONFIG REWRITE

Logs and metrics

Splunk: send the Redis log (and Sentinel’s), with its host. What Verbiqo finds: Log findings.
Prometheus: redis_exporter for memory and client history, and node_exporter on the machine. A target scraped as redis://host:port is found by the connection’s host and port.

Next: Ask Redis.

Common errors

The connection test and the answer say what went wrong. Find the message below, then follow the fix.

Message or symptom	Likely cause	What to do	Needs an administrator?
User … can administer this server (it may read and change users with ACL), so Verbiqo will not use it.	The connection signs in as `default` or another user that can manage users. This includes the password alone, which signs in as `default`.	Create a monitoring user on every server (step 1). Then set it as the connection’s user.	Yes, to create the user.
Redis refused the sign-in …: the user or password is wrong, or the user is disabled.	The user name or password is wrong, or the user is switched off.	Type the password again and press Test Connection.	Only if the user is disabled or the password must be reset.
The user may not run INFO, which every diagnosis starts from. Give it +info (see the set-up page).	The user’s rules leave out `+info`.	Add the rule with `ACL SETUSER`, then save it (step 1).	Yes.
The connection was closed during the handshake: the port may expect TLS (choose Require) or plain text (choose Disable).	The TLS mode does not match the port. Redis serves TLS on its own port.	Choose Disable for the plain port, or Require for the TLS port (TLS).	No.
The server asks for a client certificate: give the connection a client certificate and key.	Redis asks every TLS client for a certificate unless the server sets `tls-auth-clients no`.	Add the client certificate and key to the connection. The key must not have a passphrase.	Only to issue the certificate.
Nothing is listening on <host>:<port>. or … did not answer in time.	The host or port is wrong, the server is down, or a firewall blocks this computer.	Check the host and port (6379 by default) in the connection.	Only if a firewall must be opened.
The server does not show users’ rights, so Verbiqo could not check that this user is read-only …	The server hides `ACL`, as managed services such as Amazon ElastiCache do, or it is older than Redis 6.	Nothing to fix in Verbiqo. Its own command list still keeps it to reads.	No.
… is not on Verbiqo’s list of read-only server commands.	A command off the read list was asked for, such as `GET`, `KEYS` or `CONFIG SET`.	Nothing to fix: this is by design. The message lists the commands Verbiqo does run.	No.