Configure Grafana¶
With Grafana bound to MOI, an agent can inspect Grafana health, read data-source information, and query Prometheus metrics or Loki logs through authorized data sources.
Prerequisites¶
An available Grafana instance and permission to create a service account and token. Contact its administrator if needed.
Permission to configure MOI tools.
Network access from the MOI server to Grafana. Browser access does not establish server-side reachability.
1. Create a service account¶
In the target Grafana, open Administration → Users and access → Service accounts.
Select Add service account, enter a name such as
moi-monitoring, and choose Create.Assign the read permissions needed. Evaluate Viewer for read-only use instead of using a personal administrator account or granting Admin.
A service account belongs to the organization where it was created. Use separate accounts and tokens for multiple organizations. See Grafana service accounts.
2. Generate a token¶
Open the account, select Add service account token, enter a token name and an expiry consistent with team requirements, and choose Generate token. Copy the token for the MOI form. It is not a Grafana login password.
3. Create the MOI instance¶
Open Resource Center → Tools → Grafana and create an instance.
Field |
Requirement |
Value |
|---|---|---|
Tool instance name |
Required |
A name such as “Test monitoring” |
Grafana URL |
Required |
For example, |
Service Account Token |
Required |
Raw token without a Bearer prefix |
Description |
Optional |
Environment or purpose, such as test metrics and logs |
Connection timeout (seconds) |
Optional |
Default 30, maximum 300 |
4. Save and test¶
Save, return to the list, and test the target instance. Use the returned error to correct the address, token, or network if needed, then test again.
5. Bind and validate¶
Bind the tool and select the intended connection. Ask: “Check the test Grafana instance’s health and list the names and types of accessible data sources.” Compare the call record with Grafana’s data-source list. For metrics or logs, run a separate test specifying the data source and time range.
Verify a saved configuration, successful connection test, and actual correct tool result separately.
Troubleshoot¶
Symptom |
Check |
|---|---|
401 |
Expired, revoked, or incorrect token, including an accidental Bearer prefix |
403 or empty resources |
Service-account organization, resource scope, and data-source permissions |
TLS error or timeout |
URL, certificate chain, and MOI server network; do not disable certificate verification |