ob_tenant_tde_kms_host_not_match Tenant TDE KMS service address does not match the current OCP service address|V4.4.2|OceanBase Cloud Platform|OCP docs|Distributed Database

ob_tenant_tde_kms_host_not_match Tenant TDE KMS service address does not match the current OCP service address

Last Updated：2026-06-12 02:01:01 Updated

Alert description

This alert detects whether the tenant's TDE KMS service address matches the current OCP service address. Specifically:

Tenant TDE KMS service address: Obtained from the kms_host field value in the external_kms_info parameter for the corresponding tenant in the GV$OB_PARAMETERS view.
Current OCP service address: the value of the ocp.site.url system parameter.

Parameter	Value
Monitoring Metrics	ob_tenant_tde_kms_host_match_status. This metric indicates the match status between the OceanBase tenant's KMS address and the current OCP address. The parameter value is`0`indicates that the service address matches. The parameter value is`1`indicates that the service address does not match and triggers an alert.
Monitoring Expression	`max(ob_tenant_tde_kms_host_match_status{@LABELS}) by (@GBLABELS)`
Metric Collection	ob_tenant_tde_kms_host_match_status
Data Source	Periodically queried by OCP-Server`kms_host`and`ocp.site.url`Whether the pattern is matched. If not, an alert is triggered.
Collection Cycle	5 Seconds

Monitoring Expression	Default Threshold	Duration	Detection Cycle	Elimination Cycle
ob_tenant_tde_kms_host_match_status	1	120 Seconds	60 Seconds	5 Minutes

Alert Trigger Method	Alert Level	Scope
Based on monitoring metric expressions	Critical	Tenant

Alert overview
- Template: ${alarm_target} ${alarm_name}
- Example: alarm_template_id=0:ob_cluster=xxx:tenant_name=xxx The tenant's TDE KMS service address does not match the current OCP service address.
Alert details
- Template: The KMS address of tenant ${tenant_name} in OceanBase cluster ${ob_cluster_name} does not match the OCP address.
- Example: The KMS endpoint of tenant xxx in the OceanBase cluster Test does not match the OCP endpoint.
Alert recovery
- Template: Alert: ${alarm_name}, Does the tenant's TDE KMS service address match the current OCP service address?: ${value}
- Example: Alert: Tenant TDE KMS service address does not match the current OCP service address, Tenant TDE KMS service address does not match the current OCP service address: 0

Features such as adding OBServer nodes, creating standby tenants, and creating encrypted tablespaces will be unavailable.

The current service address of OCP has changed, and the value of the system parameter ocp.site.url does not match the value of kms_host in the external_kms_info parameter of the GV$OB_PARAMETERS view before tenant TDE encryption.
The external_kms_info information of the tenant was modified via the command line, causing the value of ocp.site.url to be inconsistent with the value of kms_host.
Failure to promptly complete TDE configuration for the relevant tenant after migrating out and taking over the cluster.
In multi-cluster mode of OCP, after primary and standby tenants were decoupled, the TDE configuration for the new primary tenant was not updated promptly.

Method 1: Go to the cluster overview module corresponding to the alert, and click Modify Encryption as prompted. Then, navigate to Security Configuration > Transparent Data Encryption to modify the TDE encryption information for the corresponding tenant.
Method 2: In the cluster where the tenant is located, go to Security Configuration > Transparent Data Encryption to modify the TDE information for the corresponding tenant.