RMT Upgrade: Technical Reference
This section is a technical reference guide for the operational thresholds, system paths, and network ports checked during the upgrade process. Use these tables to quickly diagnose validation failures and align your environment with required RMT baselines.
Note: To align with our company values of Equality, we have updated RMT Master to RMT Server. In some cases, RMT Server installation paths and commands may use the term "master" instead of "server." So, you may continue to see the term in CLI commands and options, installation folders, configuration files. and other instances. For more information, see About Tableau Help(Link opens in a new window)..
Pre-upgrade health checks
The pre-upgrade health check inspects your RMT Server or Agent host while the existing installation is still intact like services running, database accessible and generates a detailed PASS / FAIL / WARN report. It runs over 80 individual checks across system resources, accounts, file permissions, PostgreSQL, RabbitMQ, networking, configuration files, and RMT services. The following table lists the checks performed before the upgrade. If any item returns a FAIL status (Exit Code 2), the upgrade is canceled.
System and hardware
| Check ID | Name | Platforms | Failure (FAIL) / Warning (WARN) Condition |
| #1 | Operating System | Linux, Windows | WARN OS version is not in the pre-check allow-list. The supported list is RHEL 8.x/9.x, Ubuntu 20.04/22.04/24.04, CentOS Stream 8/9, Oracle Linux 8.x/9.x, AlmaLinux 8.x/9.x, Rocky Linux 8.x/9.x, Amazon Linux 2023, Windows Server 2019/2022 |
| #2 | Disk Space | Linux, Windows | FAIL RMT Server < 20 GB or Agent < 5 GB free. WARN RMT Server < 50 GB or Agent < 10 GB free |
| #2a | Disk Type | Linux, Windows | INFO Reports if the drive is SSD or HDD |
| #3 |
RAM |
Linux, Windows | WARN RMT Server < 8 GB (minimum) or Agent < 4 GB (minimum) |
| #4 | CPU Cores | Linux, Windows | WARN RMT Server < 8 GB (minimum) or Agent < 4 GB (minimum) |
| #4a | CPU Instructions | Linux, Windows | FAIL (Linux): Missing sse4_2 or popcnt. WARN (Windows): Older CPU detected. |
| #4b | VC++ Redist | Windows | FAIL Visual Studio 2022 C++ Redistributable missing. |
| #4c | OpenSSL DLLs | Windows | INFO Checks for libcrypto-3-x64.dll and libssl-3-x64.dll |
| #5 | System uptime | Linux, Windows | INFO: Notes if < 10 minutes (very recent reboot) or > 90 days (pending patches) |
| #6 | Systemd running | Linux | FAIL systemd not running, PASS : Running or degraded |
| #7 | FIPS Mode | Linux, Windows | FAIL (Windows): Enabled in registry, PASS FIPS disabled . WARN (Linux) Mismatch with config.json. PASS OS and config match |
| #7a | PowerShell version | Windows | INFO PowerShell version |
| #7b | System locale | Windows | INFO System locale information |
| #7c | WMI Health | Windows | WARN WMI repository is inconsistent |
Accounts and permissions
| Check ID | Name | Platform | Failure (FAIL) / Warning (WARN) Condition |
| #8 | Service Account | Linux, Windows | FAIL RMT service account or Windows service not found |
| #9 | Group Membership | Linux | FAIL Required service groups (e.g., rmtmasterapp, rmtmasterconfig, and so on) missing |
| #10 | User Systemd | Linux | FAIL User systemd daemon/linger is not active |
| #44 | pamtester installed | Linux | WARN if not installed. To fix this, install yum install pamtester or apt install libpam-runtime |
Directory ownership and permissions for Linux
| Check ID | Directory | Expected Owner:Group | Expected Mode |
| #11 | Config dir | tabrmt-master:rmtmasterconfig | 2775 |
| #12 | Log dir | tabrmt-master:rmtmasterlogs | 2775 |
| #13 | Data dir (+ PG/RMQ subdirs) | Component-appropriate | 2775 |
| #14 | Prerequisites dirs | root or component user |
755 |
| #14a | rabbitmq-defaults file |
Group-writable required | g+w |
| #15 | SSL cert dir | tabrmt-master:rmtopenssl | 2775 |
| #15a | Home directory | Component user | 770 |
| #15b | /etc/profile.d/tabrmt-*.sh
|
root | default |
| #15c | Config dir setgid bit | -- | 2xxx required |
| #16 | environment.bash
|
Component user | group-writable |
Severity: FAIL on ownership only for the data-dir set (#13 and #15). All other Linux directory checks (#11, #12, #14, #14a, #15a–c, #16) emit WARN on ownership/mode mismatches because the installer's post install re-applies ownership during upgrade. WARN if permission mode is wrong but ownership is correct.
Directory ownership and permissions for Windows
| Check | Name | Severity |
| #11 | Config dir ACLs | FAIL if service user lacks FullControl |
| #12 | Log dir ACLs | FAIL if service user lacks Modify |
| #13 | Data dir ACLs (RMT Server) | FAIL if service user lacks FullControl on PG/RMQ data dirs |
| #14 | Prereqs dir ACLs (RMT Server) | WARN if missing ReadAndExecute (advisory — every upgrade reinstalls the prereq MSIs and their post-install actions re-apply ACLs) |
| #15 | SSL cert dir ACLs (RMT Server) | FAIL if service user lacks FullControl |
| #16a | Service user identity | PASS (informational -- shows which user the service runs as) |
| #16b | SeServiceLogonRight privilege | INFO if found; WARN if not found or secedit fails |
| #16c | Service user ACLs on RMT dirs | FAIL if service user lacks required rights |
Database (PostgreSQL)
All PostgreSQL checks run only on the RMT Server.
| Check ID | Name | Requires --db-password option
|
Failure (FAIL) / Warning (WARN) Condition |
| #17 | PG Service | No | FAIL Local service Stopped AND Disabled |
| #18 | Port 5555 listening | No | WARN (security group / VPC / RDS hint) Not listening |
| #19 | DB Connection | Yes | WARN Unable to connect to internal DB (SSL, password, or network issue) |
Messaging (RabbitMQ)
The Messaging (RabbitMQ) checks run only on the RMT Server.
| Check ID | Name | Failure (FAIL) / Warning (WARN) Condition |
| #22 | RMQ Service | FAIL Local service Stopped AND Disabled |
| #24 | Queue Backlog | WARN Any queue that has > 10,000 messages |
| #25 | RabbitMQ users | WARN if default guest user still exists |
| #26 | Active connections | INFO only. Reports active connection count |
| #27 | Erlang cookie accessible | WARN if cookie file missing, if permissions wrong (should be mode 400 or 600) |
| #27a | ERLANG_HOME set | WARN (Windows only) if `ERLANG_HOME` not set or path does not exist. |
| #27b | SSL Validity | FAIL Certificates are expired |
| #27c | Disk Alarm | FAIL < 10 GB free on RMQ partition (Upgrade will hang) |
| #45 | Certificate directory populated | WARN if cert dir exists but is empty or missing expected certificate files (server cert, key, CA cert) |
Network and configuration
| Check ID | Name | Failure (FAIL) / Warning (WARN) Condition |
| #28a/b | Agent-Master Comms | WARN Agent cannot reach Master on 5671, 5672, 80, or 443 |
| #33-35 | JSON/Bash Config | FAIL Missing or invalid config.json, setup.json, or environment.bash |
| #36a | Known-Bad Version | FAIL Current version is 2025.3.0 (Regression blocks upgrade) |
Services and backup
| Check ID | Name | Failure (FAIL) / Warning (WARN) Condition |
| #38 | All RMT services running | WARN for each stopped service |
| #38a | Stranded Processes | FAIL Lingering tabrmt-* processes found after services stopped |
| #39 | Background processor running | WARN if the host process is not running |
| #40 | Pre-upgrade backup reminder | WARN as a reminder to back up configuration before upgrading |
| #41 | Topology | INFO only. Reports Master/Agent node type and (with DB) active agent count |
| #42 | Component version inventory | INFO only. Reports RMT, PostgreSQL, RabbitMQ, OpenSSL versions |
| #43 | Machine specs summary | INFO only. Reports OS, CPU cores, RAM, free disk space |
Post-upgrade health checks
These checks run after the upgrade. They are non-blocking and failures do not stop the upgrade but indicate post-install issues.
| Check ID | Name | Component | Failure (FAIL) / Warning (WARN) Condition |
| #1a-d | Services and processes | RMT Server, Agent | FAIL Main, PG, or RMQ services are not running |
| #2 | Host process Supervisor | RMT Server, Agent | WARN Host supervisor process missing (No auto-recovery) |
| #3a-b | Configuration file integrity | RMT Server, Agent | FAIL if missing or invalid JSON |
| #4a-b | File Permissions | RMT Server, Agent | FAIL Config/Log dirs not readable/writable by service account |
| #5a-d | Port Listening | RMT Server | FAIL Web (443), AMQP (5672), or DB (5555) not listening |
| #6 | PostgreSQL Connectivity | RMT Server | FAIL PostgreSQL not accepting connections |
| #7 | RabbitMQ status | RMT Server | SKIP if external. FAIL after all retries exhausted. |
| #8a | Queue Consumers | RMT Server | WARN Backlog exists but no active consumers (Master workers disconnected) |
| #9 | RMQ Alarms | RMT Server | FAIL Active Memory or Disk resource alarms detected |
| #10 | RabbitMQ SSL certificate | RMT Server | FAIL if certificate expired. WARN if certificates expires within 30 days |
| #11 | FIPS Match | RMT Server, Agent | FAIL OS FIPS state mismatches isFIPSEnabled config |
| #12 | Web server HTTP response | RMT Server | Makes HTTP GET to `https://localhost:<port>/authentication/login`. PASS on 200 or 302. FAIL on connection refused/timeout. WARN on other errors. |
| #13 | HTTPS certificate validity | RMT Server | FAIL Web server TLS certificate is expired |
| #14a-d | Disk Space | RMT Server, Agent | FAIL < 1 GB free. WARN: < 5 GB free |
| #15 | Recent Log Errors | RMT Server, Agent | FAIL FATAL errors in logs. WARN: CRITICAL errors |
| #16 | RMT Status | RMT Server, Agent | FAIL rmtadmin status returns failure patterns |
| #17 | Agent log history | Agent | Checks log tracking files (.history, .json) in the agent data directory. WARN if files are unreadable or corrupt |
| #18a-f | Inventory Version | RMT Server, Agent | INFO about RMT version, PostgreSQL version, RabbitMQ version, Erlang/OTP version, .NET Runtime (Windows) / OS (Linux), OS version (Windows) / Kernel (Linux) |
Health check exit codes
Use the following exit codes to interpret the results of both the pre-upgrade and post-upgrade health check scripts.
Pre-upgrade scripts
| Exit Code | Status | Upgrade Behavior |
| 0 | READY TO UPGRADE | Upgrade proceeds |
| 1 | UPGRADE WITH CAUTION | Upgrade proceeds; review warnings |
| 2 | Do not upgrade | Upgrade canceled |
| 3 | Script Error | Check execution environment |
Post-upgrade scripts
| Exit Code | Status |
| 0 | ALL PASSED |
| 1 | WARNINGS PRESENT |
| 2 | CRITICAL FAILURES |
InstallerContext severity changes
When run with -InstallerContext during automatic Windows MSI upgrades, the following checks behave differently from the manual default. The default (non-InstallerContext) behavior is *already* WARN for "stopped but not Disabled" / "port not listening" states; FAIL is reserved for `Stopped+Disabled`. Under `-InstallerContext`, even the `Disabled` branch is reported as WARN so an in-flight installer-driven upgrade is never vetoed by a transient state the installer is about to fix.
| Check | Name | Default | InstallerContext |
| #17 | PG Service | WARN if Stopped, FAIL if Stopped and Disabled, INFO if all stopped | WARN |
| #18 | PG Port | WARN if not listening, INFO if all services stopped | WARN |
| #22 | RabbitMQ Service | WARN if Stopped, FAIL if Stopped+Disabled, INFO if all stopped | WARN |
| #23 | Port 5672 (AMQP) | WARN if not listening, INFO if all services stopped | WARN |
| #38a | Stranded RMT Processes | (see check description) | SKIP (installer manages process lifecycle) |
Pre-upgrade thresholds
| Threshold | RMT Server | Agent | Unit |
| Disk space FAIL | 20 | 5 | GB free |
| Disk space WARN | 50 | 10 | GB free |
| Temp dir FAIL | 5 | 5 | GB free |
| Temp dir WARN | 10 | 10 | GB free |
| RAM FAIL | 8 | 4 | GB |
| RAM WARN | 16 | 8 | GB |
| CPU FAIL | 4 | 2 | cores |
| CPU WARN | 8 | 4 | cores |
| Database size FAIL | 500 | - | GB |
| Database size WARN | 200 | - | GB |
| Hangfire schema FAIL | 10 | - | GB |
| Hangfire schema WARN | 1 | - | GB |
| WAL dir FAIL (Windows) | 10 | - | GB |
| WAL dir FAIL (Windows) | 2 | - | GB |
| WAL dir FAIL (Linux) | 10 | - | GB |
| Mnesia dir WARN | 5 | - | GB |
| RabbitMQ disk alarm FAIL | 10 | - | GB free |
| Queue backlog WARN | 10,000 | - | messages |
| Certificate expiry WARN | 30 | 30 | days |
| Cleanup retention WARN | 180 | - | days |
| Dead tuple ratio WARN | 20 | - | percent |
| Agent heartbeat stale | 15 | - | minutes |
| Network driver age WARN | 3 | - | years |
| Log dir size WARN | 5 | 5 | GB |
| Log dir size WARN (severe) | 20 | 20 | GB |
Post-upgrade thresholds
| Threshold | Value | Unit |
| Disk space FAIL | 1 | GB free |
| Disk space WARN | 5 | GB free |
| Certificate expiry WARN | 30 | days |
| Queue backlog WARN | 10,000 | messages |
| Log scan window | 60 | minutes |
| RabbitMQ startup retry | 6 attempts x 5 sec | 30 seconds total |
Minimum supported component versions
| Component | Minimum Version |
| RabbitMQ | >= 3.10.10 |
| Agent version | >= 2023.1.0 |
Automation and CI/CD Integration
For Linux:
```base
# Linux
sudo bash rmt-pre-upgrade-check.sh --component master --db-password "$DB_PASSWORD"
EXIT_CODE=$?
if [ $EXIT_CODE -eq 2 ]; then
echo "BLOCKED: Fix critical issues before upgrading"
exit 1
fi
```
For Windows:
```powershell
# Windows
.\rmt-pre-upgrade-check.ps1 -Component master
if ($LASTEXITCODE -eq 2) {
Write-Error "BLOCKED: Fix critical issues before upgrading"
exit 1
}
```
Installation directory reference
To manually invoke the underlying diagnostic utilities or verify your installation structure, refer to the platform-specific directory paths:
Linux directory structure
```
/opt/tableau/tabrmt/ # Install root
+-- master/ # Master application binaries
+-- agent/ # Agent application binaries
+-- prerequisites/ # Bundled dependencies
/var/opt/tableau/tabrmt/ # Data root
+-- master/config/ # config.json, setup.json
+-- master/logs/ # Application logs
+-- data/postgresql15/ # PostgreSQL data files
+-- data/rabbitmq313/ # RabbitMQ data/mnesia
+-- data/ssl/ # TLS certificates
/etc/opt/tableau/tabrmt/
+-- master/environment.bash # Master environment variables
+-- agent/environment.bash # Agent environment variables
```
Windows directory structure
```
C:\Program Files\Tableau\Tableau Resource Monitoring Tool\ # Install root
C:\ProgramData\Tableau\Tableau Resource Monitoring Tool\ # Data root
```
Required network ports
| Port | Service | Direction |
| 80 | RMT Web UI (HTTP) | Inbound |
| 443 | RMT Web UI (HTTPS) | Inbound |
| 5672 | RabbitMQ AMQP | Inbound on RMT Server |
| 5671 | RabbitMQ AMQP over TLS | Inbound on RMT Server |
| 15672 | RabbitMQ Management UI | Local |
| 25672 | RabbitMQ inter-node | Local |
| 5555 | Internal PostgreSQL | Local |