tsm configuration set Options - Tableau

相关文章推荐

魁梧的眼镜 · 排查Always ...· 10 月前 ·

气宇轩昂的蜡烛 · Python自动扫码支付的实现示例_pyth ...· 10 月前 ·

耍酷的大象 · AIR学术｜南洋理工刘子纬：大模型时代下的3 ...· 1 年前 ·

爱喝酒的抽屉 · LRU -- ...· 1 年前 ·

痛苦的筷子 · selenium+python之异常Stal ...· 1 年前 ·

</noscript><div id="app" class="wrapper"><header id="tableau-help-article-header" class="container--full-width quick-help-header"><div class="container--centered"><div class="header__back-button"><back-button title="Go back"/></div><div class="header__mobile-menu quick-help-hidden"><menu-tree-toggle/></div><div class="header__logo quick-help-hidden"><a href="https://www.tableau.com/en-us/"><img src="./Resources/tableau-logo.png" class="header__logo__img" alt="Tableau"/></a></div><div class="header__search"><search-header-help placeholder="Search"/></div><div class="header__home-button"><home-button title="Go home"/></div></div></header><div class="container--navigation-top quick-help-hidden content-only-hidden"><div id="help-subheader" class="subheader print-hidden"><div class="container--centered"><h4 class="heading--subheader">Tableau Server on Windows Help</h4></div></div><div class="container--top-links"><div class="container--centered container--breadcrumbs"><div><breadcrumb-links-help/></div></div><div id="help-container-menu-headings" class="container--menu-headings"><nav class="nav-medium-screen"><menu-heading-links-static-help menu-title="In this article" :disabled="false" :headings="pageHeadings"/></nav></div></div></div><div class="section--main container--full-width"><div class="container--centered"><nav class="nav-side nav-side--left" role="navigation"><menu-tree-help menu-title="Contents"/></nav><article role="main"><h1 id="contentH1">tsm configuration set Options</h1><div class="caption article__tags content-only-hidden quick-help-hidden"><span class="article__tags--applies-to"> </span><br/><span class="article__tags--role"> </span></div><div xmlns:madcap="http://www.madcapsoftware.com/Schemas/MadCap.xsd" id="content-body">&#13; <p>Below is a list of configuration options or keys that you can set with the <code><a href="cli_configuration_tsm.htm#TSMSet" class="MCXref xref" xrefformat="{paratext}">tsm configuration set</a></code> command. In many cases you can find out the current value of a configuration key with the <code>tsm configuration get</code> command.</p>&#13; <p>This list is not intended to be an exhaustive list of Tableau Server configuration settings. It represents a subset of configuration keys that can be set by server administrators. Finally, some keys used internally by Tableau Server do not appear in this list.</p>&#13; <p class="note"><strong>Note:</strong> Configuration keys are case-sensitive.</p>&#13; <h2 is="heading-item" :level="2" id="using-the-tsm-cli">Using the tsm CLI</h2>&#13; <p>You can run tsm commands on the initial node (the node where TSM is installed), or on any additional node in the cluster. </p>&#13; <p data-mc-conditions="Product.serverwindows">To run tsm commands, you need to open Windows Command Prompt. Do not use PowerShell to run tsm commands. Using PowerShell can cause unexpected behavior.</p>&#13; Open Windows Command Prompt&#13; with an account that is a member of the Administrators group on a node in the cluster.&#13; <p>Run the command you want. If you are running the command from a node other than the initial node, include the <code>-s</code> option to specify the URL of the initial node by name (not IP address), and include the TSM port, 8850.</p>&#13; <p>To see the version of TSM and Tableau Server from the initial node:</p>&#13; <p><code>tsm version</code>&#13; <p>To see the version of TSM and Tableau Server from an additional node:</p>&#13; <p><code>tsm version -s https://&lt;inital_node_name&gt;:8850</code>&#13; <p>For example:</p>&#13; <p><code>tsm version -s https://myTableauHost:8850</code>&#13; <h2 is="heading-item" :level="2" id="basic-use-of-tsm-configuration-keys">Basic Use of tsm configuration keys</h2>&#13; <h3 is="heading-item" :level="3" id="setting-a-configuration-key">Setting a configuration key</h3>&#13; <p><code>tsm configuration set -k &lt;config.key&gt; -v &lt;config_value&gt;</code>&#13; <p>In some cases, you must include the <code>--force-keys</code> option to set a configuration value for a key that has not been set before. For more information, see <a href="cli_configuration_tsm.htm#configGetNote" class="MCXref xref" xrefformat="{paratext}">"Unknown key" responses</a>.</p>&#13; <p>After setting a configuration key value you must apply the pending configuration changes using <code><a href="cli_pending-changes.htm#pending-changes-apply" class="MCXref xref" xrefformat="{paratext}">tsm pending-changes apply</a></code>. Until you do, the new value will not be used by Tableau or show up in the results of a <code>tsm configuration get</code> command. You can view pending changes using <code>tsm pending-changes list</code>. For more information, see <a href="cli_pending-changes.htm" class="MCXref xref" xrefformat="{paratext}">tsm pending-changes</a>.</p>&#13; <h3 is="heading-item" :level="3" id="resetting-a-configuration-key-to-default"><a name="Reset2Default"/>Resetting a configuration key to default</h3>&#13; <p>To reset a configuration key back to its default value, use the <code>-d</code> option:</p>&#13; <p><code>tsm configuration set -k &lt;config.key&gt; -d</code>&#13; <h3 is="heading-item" :level="3" id="viewing-the-current-value-of-a-configuration-key">Viewing the current value of a configuration key</h3>&#13; <p>To see what a configuration key is currently set to, use the <code>configuration get</code> command:</p>&#13; <p><code><a href="cli_configuration_tsm.htm#TSMGet" class="MCXref xref" xrefformat="{paratext}">tsm configuration get</a> -k &lt;config.key&gt;</code>&#13; <p>There are two special cases that will not return a useful current value for a key:</p>&#13; <p>In certain cases you cannot get a configuration value for a key that has not been explicitly set. Instead the <code>tsm configuration get</code> command will return an "Unknown key" response. For more information, see <a href="cli_configuration_tsm.htm#configGetNote" class="MCXref xref" xrefformat="{paratext}">"Unknown key" responses</a>.</p>&#13; <p>For certain keys with predefined default values, the<code> tsm configuration get</code> command will return a "Null" response. For more information, see <a href="cli_configuration_tsm.htm#configGetNullDefault" class="MCXref xref" xrefformat="{paratext}">"Null" value responses</a>.</p>&#13; <h2 is="heading-item" :level="2" id="configuration-keys">Configuration Keys</h2>&#13; <h3 is="heading-item" :level="3" id="adminviewsdisabled">adminviews.disabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Disables access to the Tableau Administrative views. By default, access to views is enabled (this option is set to "false").</p>&#13; <h3 is="heading-item" :level="3" id="apiserverenabled"><a name="rest_api_enabled"/>api.server.enabled</h3>&#13; <p><strong>Version:</strong> Deprecated in version 2023.1. You cannot disable the REST API in version 2023.1 and later. </p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Allows access to the <a href="https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api.htm" target="_blank">Tableau Server REST API<span class="sr-only">(Link opens in a new window)</span></a>. </p>&#13; <p>By default, this functionality is enabled. We strongly recommend that you maintain this setting. Disabling the REST API will disrupt the functionality of a broad range of Tableau features. It will not improve performance or enhance security. If you choose to disable the REST API on your Tableau Server installation, test the functionality you require carefully.</p>&#13; <p>Functionality impacted by disabling the REST API includes:</p>&#13; <li value="1">Search</li>&#13; <li value="2">Favorites</li>&#13; <li value="3">Collections</li>&#13; <li value="4">Content Management Tool (CMT)</li>&#13; <li value="5">Resource Monitoring Tool (RMT)</li>&#13; <li value="6">Personal Spaces</li>&#13; <h3 is="heading-item" :level="3" id="auditingenabled"><a name="auditing"/>auditing.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Allows access to the PostgreSQL (Tableau Server's own database) historical auditing tables.</p>&#13; <h3 is="heading-item" :level="3" id="backgrounderdefaultrunnowpriority">backgrounder.default_run_now_priority</h3>&#13; <p>Default value (integer): 0</p>&#13; <p>This setting controls what priority is assigned to run now jobs, with 0 being the highest priority. Values should be specified should be in the range of 0 – 100.</p>&#13; <h3 is="heading-item" :level="3" id="backgrounderenableparalleladsync">backgrounder.enable_parallel_adsync</h3>&#13; <p><strong>Version:</strong> Added in version 2018.3.6</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether parallel processing of external directory group synchronization jobs is allowed when there are multiple backgrounders. By default a scheduled synchronization of external directory groups is handled serially, by a single backgrounder. Set this to <code>true </code>to enable parallel processing on multiple backgrounder instances.&#13; <h3 is="heading-item" :level="3" id="backgrounderexternalquerycachewarmupenabled">backgrounder.externalquerycachewarmup.enabled</h3>&#13; <p><strong>Version:</strong> Deprecated in version 2023.1. To improve view load times for workbooks, allow <a href="data_acceleration.htm" class="MCXref xref" xrefformat="{paratext}">View Acceleration</a> on your site instead.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls the caching of workbook query results after scheduled extract refresh tasks.</p>&#13; <h3 is="heading-item" :level="3" id="backgrounderexternalquerycachewarmupviewthreshold">backgrounder.externalquerycachewarmup.view_threshold </h3>&#13; <p><strong>Version:</strong> Deprecated in version 2023.1. To improve view load times for workbooks, allow <a href="data_acceleration.htm" class="MCXref xref" xrefformat="{paratext}">View Acceleration</a> on your site instead.</p>&#13; <p>Default vaule: <code>2.0</code></p>&#13; <p>The threshold for caching workbook query results after scheduled extract refresh tasks. The threshold is equal to the number of views that a workbook has received in the past seven days divided by the number of refreshes scheduled in the next seven days.</p>&#13; <p>The following two <i>backgrounder</i> command options determine how long a flow task can run before the flow background task is canceled. These two commands together determine the total timeout value for flow tasks.</p>&#13; <h3 is="heading-item" :level="3" id="backgrounderextratimeoutinseconds">backgrounder.extra_timeout_in_seconds</h3>&#13; <p>Default value: <code>1800</code></p>&#13; <p>The number of seconds beyond the setting in <code>backgrounder.querylimit</code> before a background job is canceled. This setting makes sure that a stalled job does not hold up subsequent jobs. The setting applies to processes listed in <code>backgrounder.timeout_tasks</code>. 1800 seconds is 30 minutes. </p>&#13; <h3 is="heading-item" :level="3" id="backgrounderdefaulttimeoutrunflow">backgrounder.default_timeout.run_flow</h3>&#13; <p>Default value: <code>14400 </code></p>&#13; <p>The number of seconds before a flow run task is canceled. 14,400 seconds is 4 hours.</p>&#13; <h3 is="heading-item" :level="3" id="backgrounderfailurethresholdforrunprevention">backgrounder.failure_threshold_for_run_prevention</h3>&#13; <p>Default value: <code>5</code></p>&#13; <p>The number of consecutive failures of a subscription, extract, or flow run job before that job is suspended. Suspending continuously failing jobs helps preserver backgrounder resources for other jobs. To disable suspension of failing background tasks, set this to <code>-1</code>.</p>&#13; <h3 is="heading-item" :level="3" id="backgrounderloglevel">backgrounder.log.level</h3>&#13; <p><strong>Version:</strong> Added in version 2020.3.0.</p>&#13; <p>Default value: <code>info</code></p>&#13; <p>The logging level for the backgrounder process. This is dynamically configurable, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="backgrounderquerylimit">backgrounder.querylimit</h3>&#13; <p>Default value: <code>7200</code></p>&#13; <p>Longest allowable time, in seconds, for completing a single extract refresh job. 7200 seconds = 2 hours. </p>&#13; <p class="note"><strong>Note:</strong> If a background job reaches this time limit, it may continue to run for an additional several minutes while being canceled. </p>&#13; <h3 is="heading-item" :level="3" id="backgrounderrestrictserialcollectionstositelevel">backgrounder.restrict_serial_collections_to_site_level</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>In Tableau Server, you can schedule extract refreshes, subscriptions, or flows to run periodically. These scheduled items are referred to as tasks. The Backgrounder process initiates unique instances of these tasks to run them at the scheduled time. The unique instances of the tasks that are initiated as a result are referred to as jobs.</p>&#13; <p>This setting affects schedules that are configured to run serially. By default, when a schedule is configured to run serially, all jobs using that schedule will run serially. When this setting is set to <code>true</code>, jobs running on different sites can run in parallel. Jobs for scheduled tasks on the same site will continue to run serially.</p>&#13; <p>The example below illustrate this scenario:</p>&#13; <p>Tableau Server includes a schedule named "Daily" to run jobs every day at 7 am. The "Daily" schedule is configured to run serially. Site "HR" and site "Payroll" each have multiple scheduled tasks that use the schedule, "Daily". When this setting is set to <code>true</code>, jobs for these scheduled tasks on Site "HR" can run in parallel with jobs on site "Payroll", whereas jobs on the same site will still only run serially. </p>&#13; <h3 is="heading-item" :level="3" id="backgroundernotificationsenabled">backgrounder.notifications_enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether extract refresh and flow run alerts are enabled for all sites on the server. By default alerts are enabled. To disable the alerts for all sites on a server, set this to <code>false</code>.</p>&#13; <p>Extract alerts can be enabled or disabled on a site basis by site administrators in site settings, or at the user level in user settings.</p>&#13; <h3 is="heading-item" :level="3" id="backgroundersortjobsbytypescheduleboundaryheuristicsmilliseconds">backgrounder.sort_jobs_by_type_schedule_boundary_heuristics_milliSeconds</h3>&#13; <p>Default value: <code>60000 </code></p>&#13; <p>Controls the time window that identifies backgrounder jobs which are determined to have the same scheduled start time.</p>&#13; <p>The backgrounder process orders work that is scheduled at the same time to be executed by job type, running the fastest category of jobs first: Subscriptions, then Incremental Extracts, then Full Extracts. </p>&#13; <p> Jobs are batched to determine which jobs are scheduled at the “same time”. A value 60,000 milliseconds (the default) indicates jobs for schedules starting within a 1 minute window should be classified in the same batch and so are ordered by type within that batch.</p>&#13; <h3 is="heading-item" :level="3" id="backgroundersubscriptionfailurethresholdforrunprevention">backgrounder.subscription_failure_threshold_for_run_prevention</h3>&#13; </p><p>Default value: <code>5</code></p>&#13; <p>Determines the number of consecutive subscription failures that must occur before alerting for a condition is suspended. When set to the default of <code>5</code>, alerting is suspended after 5 consecutive subscription failures. A value of <code>-1 </code>will allow notification email to continue indefinitely. This threshold is server-wide, so applies to all subscriptions defined on the server.</p>&#13; <h3 is="heading-item" :level="3" id="backgroundersubscriptionimagecaching">backgrounder.subscription_image_caching</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether backgrounder will cache images that are generated for subscriptions. Cached images do not have to be regenerated each time so caching improves subscription performance. By default image caching is enabled. To disable image caching for all sites on a server, set this to <code>false</code>. </p>&#13; <h3 is="heading-item" :level="3" id="backgroundertimeouttasks">backgrounder.timeout_tasks</h3>&#13; <p>Default value: The default value may be different, depending on your version of <span class="VariablesProductName">Tableau Server</span>. To see the default value list for your version of Tableau, run the <code>tsm configuration get</code> command: </p><pre>tsm configuration get -k backgrounder.timeout_tasks</pre>&#13; <p>The list of tasks that can be canceled if they run longer than the combined values in <code>backgrounder.querylimit</code> and <code>backgrounder.extra_timeout_in_seconds</code>. The list of tasks is delimited with commas. The default list represents all the possible values for this setting. </p>&#13; <h3 is="heading-item" :level="3" id="backgroundertimeoutsinglesubscriptionnotify"><a name="backgrounder_timeout_single_job"/>backgrounder.timeout.single_subscription_notify</h3>&#13; <p><strong>Version:</strong> Added in version 2021.2.</p>&#13; <p>Default Value: <code>1800</code> seconds (30 minutes)</p>&#13; <p>This is the maximum allowable time specified in seconds for completing a single subscription job.</p> </div>&#13; <h3 is="heading-item" :level="3" id="backgroundertimeoutsyncadgroup"><a name="backgrounder_timeout_ad_group_sync"/>backgrounder.timeout.sync_ad_group</h3>&#13; <p><strong>Version:</strong> Added in version 2021.1.23, 2021.2.21, 2021.3.20, 2021.4.15, 2022.1.11, 2022.3.3, 2023.1.</p>&#13; <p>Default Value: <code>14400</code> seconds (4 hours)</p>&#13; <p>This is the maximum allowable time, specified in seconds, for completing an Active Directory group sync. This applies to <em>scheduled </em>group synchonizations done by the backgrounder service and prevents long-running syncs from running indefinitely. This does not impact group synchronizations done using the Tableau Server UI or the REST API. </p>&#13; <h3 is="heading-item" :level="3" id="backgroundervinstancesmaxoverflowqueuesize"><a name="backgrounder-overflow-queue"/>backgrounder.vInstances_max_overflow_queue_size</h3>&#13; <p><strong>Version:</strong> Added in version 20221.2.</p>&#13; <p>Default Value: <code>1000</code> </p>&#13; <p>The maximum number of jobs that can be in the secondary queue. A secondary queue is created when the number of jobs running is at the set concurrency limit. The default maximum is set to 1000 jobs - meaning if there are more than 1000 jobs when the concurrency limit is hit, anything more than 1000 jobs will not be queued. Use the backgrounder.vInstance_max_overflow_queue_size tsm command to make changes to the overflow maximum queue size.</p>&#13; <p>The values should be specified in whole numbers.</p>&#13; <h3 is="heading-item" :level="3" id="backupzstdthreadcount"><a name="backup_threads"/>backup.zstd.thread_count</h3>&#13; <p><strong>Version:</strong> Added in version 2021.1.0. This key is dynamically configurable. For more information, see <a href="server_process_hot_topo.htm" class="MCXref xref" xrefformat="{paratext}">Tableau Server Dynamic Topology Changes</a></p>&#13; <p>Default value: 2</p>&#13; <p>The number of threads that should be used when creating a backup.</p>&#13; <p>Increasing this number can improve backup performance, but we recommend thread count not exceed the number of logical processors on the Tableau Server computer, up to four. </p>&#13; <h3 is="heading-item" :level="3" id="basefilepathbackuprestore">basefilepath.backuprestore</h3>&#13; <p>Default value: <code data-mc-conditions="Product.serverwindows"><code>C:\ProgramData\Tableau\Tableau Server\data\tabsvc\files\backups\</code></code></p>&#13; <p>The location in which the<code> tsm maintenance backup</code> command creates the backup. This is also the location where the backup file must be when restored using the <code>tsm maintenance restore</code> command or the<code> tsm maintenance send-logs</code> command. After setting this, you should run the <a href="cli_maintenance_tsm.htm#tsmValidateBackupBasefilepath" class="MCXref xref" xrefformat="{paratext}">tsm maintenance validate-backup-basefilepath</a> command (available in version 2022.1 and later) to verify that permissions are set properly for the location. For more information, see <a href="cli_default_filepaths_tsm.htm" class="MCXref xref" xrefformat="{paratext}">tsm File Paths</a>.</p>&#13; <h3 is="heading-item" :level="3" id="basefilepathlogarchive">basefilepath.log_archive</h3>&#13; <p>Default value: <code data-mc-conditions="Product.serverwindows">C:\ProgramData\Tableau\Tableau Server\data\tabsvc\files\log-archives\</code></p>&#13; <p>The location in which the<code> tsm maintenance ziplogs</code> command creates the zipped archive. For more information, see <a href="cli_default_filepaths_tsm.htm" class="MCXref xref" xrefformat="{paratext}">tsm File Paths</a>.</p>&#13; <h3 is="heading-item" :level="3" id="basefilepathsiteexportexports">basefilepath.site_export.exports</h3>&#13; <p>Default value: <code data-mc-conditions="Product.serverwindows">C:\ProgramData\Tableau\Tableau Server\data\tabsvc\files\siteexports\</code></p>&#13; <p>The location in which the<code> tsm sites export</code> command creates the export file. For more information, see <a href="cli_default_filepaths_tsm.htm" class="MCXref xref" xrefformat="{paratext}">tsm File Paths</a>.</p>&#13; <h3 is="heading-item" :level="3" id="basefilepathsiteimportexports">basefilepath.site_import.exports</h3>&#13; <p>Default value: <code data-mc-conditions="Product.serverwindows">C:\ProgramData\Tableau\Tableau Server\data\tabsvc\files\siteimports\</code></p>&#13; <p>The location in which the<code> tsm sites import</code> command expects the import file to be located. For more information, see <a href="cli_default_filepaths_tsm.htm" class="MCXref xref" xrefformat="{paratext}">tsm File Paths</a>.</p>&#13; <h3 is="heading-item" :level="3" id="clustercontrollerloglevel">clustercontroller.log.level</h3>&#13; <p><strong>Version:</strong> Added in version 2020.3.0.</p>&#13; <p>Default value: <code>info</code></p>&#13; <p>The logging level for Cluster Controller. This is dynamically configurable, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="clustercontrollerzksessiontimeoutms">clustercontroller.zk_session_timeout_ms</h3>&#13; <p>Default value: <code>300000</code></p>&#13; <p>The length of time, in milliseconds, that Cluster Controller will wait for the Coordination Service (ZooKeeper), before determining that failover is required.</p>&#13; <h3 is="heading-item" :level="3" id="dataalertscheckintervalinminutes">dataAlerts.checkIntervalInMinutes</h3>&#13; <p>Default value: <code>60 </code></p>&#13; <p>The frequency, in minutes, at which <span class="VariablesProductName">Tableau Server</span> checks to determine if data-alert conditions are true.</p>&#13; <p>(The server also checks whenever extracts related to data alerts are refreshed.)</p>&#13; <h3 is="heading-item" :level="3" id="dataalertsretryfailedalertsaftercheckinterval">dataAlerts.retryFailedAlertsAfterCheckInterval</h3>&#13; <p>Default value: <code>true </code></p>&#13; <p>Determines how often <span class="VariablesProductName">Tableau Server</span> rechecks failing data alerts. When set to <code>true</code>, the server rechecks failing alerts at the frequency defined by <code>dataAlerts.checkIntervalInMinutes</code>. When set to <code>false</code>, the server rechecks failing alerts every five minutes, more quickly notifying alert recipients if data conditions have changed, but reducing server performance.</p>&#13; <p>(The server also checks whenever extracts related to data alerts are refreshed.)</p>&#13; <h3 is="heading-item" :level="3" id="dataalertssuspendfailurethreshold">dataAlerts.SuspendFailureThreshold</h3>&#13; <p>Default value: <code>350</code></p>&#13; <p>Determines the number of consecutive data alert failures that must occur before alerting for a condition is suspended. When set to the default of 350, alerting is suspended after roughly two weeks of alerts. This threshold is server-wide, so applies to any data alert defined on the server.</p>&#13; <h3 is="heading-item" :level="3" id="databaseservicemaxdatabasedeletesperrun"><a name="metadata_orphanembedded_maxnumber"/>databaseservice.max_database_deletes_per_run</h3>&#13; <p><strong>Version:</strong> Added in version 2021.2.</p>&#13; <p>Default value: null</p>&#13; <p>Use this option to adjust the maximum number of embedded external assets (databases and tables) that can be deleted each time the backgrounder process, controlled by <code>features.DeleteOrphanedEmbeddedDatabaseAsset</code>, runs. If this option is left empty, the default maximum number of embedded external assets that can be deleted is 100.</p>&#13; <p>For more information, see <a href="#metadata_orphanembedded" class="MCXref xref" xrefformat="{paratext}">features.DeleteOrphanedEmbeddedDatabaseAsset</a>.</p>&#13; <h3 is="heading-item" :level="3" id="dataserverloglevel">dataserver.log.level</h3>&#13; <p><strong>Version:</strong> Added in version 2020.3.0.</p>&#13; <p>Default value: <code>info</code></p>&#13; <p>The logging level for Data Server. This is dynamically configurable, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="dataservernport">dataserver_&lt;n&gt;.port</h3>&#13; <p>Port that the data server instance (specified by "&lt;n&gt;") runs on.</p>&#13; <h3 is="heading-item" :level="3" id="elasticservervmopts"><a name="elasticservervmopts"/>elasticserver.vmopts</h3>&#13; <p><strong>Version:</strong> Added in version: 2019.1. Removed: 2022.1</p>&#13; <p><b>This configuration option is not valid for Tableau Server versions 2022.1 and later.</b> For Tableau Server versions 2022.1 and later, use <code><a href="#indexsearchserver">indexandsearchserver.vmopts</a></code> configuration option </p>&#13; </p><p>Default value: "<code>-Xmx&lt;default_value&gt; -Xms&lt;default_value&gt;</code>" </p>&#13; <p>The default value varies based on the amount of system memory. The JVM maximum heap size is scaled to be 3.125% of the total system RAM. </p>&#13; <p>Controls the Elastic Server heap size. Because the default value scales automatically, use this option to override the default value only when absolutely necessary. Append the letter 'k' to the value to indicate kilobytes, 'm' for megabytes, or 'g' to indicate gigabytes. As a general rule, set initial heap size (<code>-Xms</code>) equal to the maximum heap size (<code>-Xmx</code>) to minimize garbage collections. </p>&#13; <h3 is="heading-item" :level="3" id="excelshadowcopyallremoteenabled">excel.shadow_copy_all_remote.enabled </h3>&#13; <p><strong>Version:</strong> Added in versions 2019.1.5, 2019.2.1.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether Tableau Server creates a "shadow copy" of a shared Excel spreadsheet (<code>.xlxs</code> or <code>.xlxm</code>) that is being used as a live data source. When enabled, this option prevents Excel users from seeing a "Sharing Violation Error" and a message that the file is "currently in use." This option can have a performance impact with large Excel files. If Excel users do not need to edit the shared file, you do not need to enable this option. </p>&#13; <p class="note"><strong>Note:</strong> Tableau Server always attempts to create a shadow copy of a <code>.xls</code> file. This option does not change that behavior.</p>&#13; <h3 is="heading-item" :level="3" id="extractservicecommandexecutiontimeout">extractservice.command.execution.timeout </h3>&#13; <p><strong>Version:</strong> Added in version 2021.4.</p>&#13; <p>Default value: <code>7200</code> seconds</p>&#13; <p>Sets the timeout value for VConn extract refresh run time. </p>&#13; <p>Example:<code> tsm configuration set -k extractservice.command.execution.timeout -v &lt;timeout_in_seconds&gt; --force-keys</code></p>&#13; <p class="note"><strong>Note:</strong> You must use the <code>--force-keys</code> option to change this value.</p>&#13; <h3 is="heading-item" :level="3" id="featuresactivemq">features.ActiveMQ</h3>&#13; <p><strong>Version:</strong> Added in version 2021.4.</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether Tableau Server uses the Apache ActiveMQ service (Tableau Server Messaging Service) for the internal messaging mechanism.</p>&#13; <h3 is="heading-item" :level="3" id="featuresdeleteorphanedembeddeddatabaseasset"><a name="metadata_orphanembedded"/>features.DeleteOrphanedEmbeddedDatabaseAsset</h3>&#13; <p><strong>Version:</strong> Added in version 2021.2.</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls a backgrounder process, for Tableau Catalog (or Tableau Metadata API), that deletes embedded external assets (databases and tables) that are no longer associated with downstream Tableau content. This process runs everyday at 22:00:00 UTC (coordinated universal time) and can delete a maximum of 100 external assets each day until there are no remaining external assets without connections to downstream Tableau content. You can set this option to <code>false</code> to stop this process from running. Alternatively, you can also adjust the maximum number of external embedded assets that can be deleted using <a href="#metadata_orphanembedded_maxnumber" class="MCXref xref" xrefformat="{paratext}">databaseservice.max_database_deletes_per_run</a>.</p>&#13; <p>For more information see, <a href="https://help.tableau.com/current/server/en-us/dm_catalog_enable.htm#troubleshoot_orphanembedded">Troubleshoot missing content</a>.</p>&#13; <h3 is="heading-item" :level="3" id="featuresdesktopreporting">features.DesktopReporting</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether Desktop License Reporting is enabled on the server. When set to <code>false</code> (the default), no Administrative Views related to desktop licenses are available. Set this to <code>true</code> to enable license reporting and to make license usage and expiration Administrative Views visible on the Server Status page. <strong>Note:</strong> Desktop License Reporting must be enabled on the client (Tableau Desktop) in order for information to be reported to Tableau Server. </p>&#13; <h3 is="heading-item" :level="3" id="featuresmessagebusenabled">features.MessageBusEnabled</h3>&#13; <p><strong>Version:</strong> Added in version 2019.4.</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether Tableau Server uses the new internal messaging mechanism. </p>&#13; <h3 is="heading-item" :level="3" id="featurespasswordlessbootstrapinit"><a name="pwdlessbootstrap"/>features.PasswordlessBootstrapInit</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether Tableau Server allows embedded credentials in bootstrap files. When enabled (the default), embedded credentials are included in the bootstrap file unless you specify that they should not be included. Set this to <code>false</code> if credentials should never be included in any bootstrap file you generate. For more information on generating bootstrap files, see <a href="cli_topology_tsm.htm#TSMGetBootstrap" class="MCXref xref" xrefformat="{paratext}">tsm topology nodes get-bootstrap-file</a>.</p>&#13; <p>This option was added beginning with Tableau Server version 2019.3.</p>&#13; <h3 is="heading-item" :level="3" id="featurespasswordreset">features.PasswordReset</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Applies only to servers that use local authentication. Set to <code>true</code>to let users reset their passwords with a "Forgot password" option on the sign-in page.</p>&#13; <h3 is="heading-item" :level="3" id="filestoreemptyfoldersreaperenabled">filestore.empty_folders_reaper.enabled</h3>&#13; <p><strong>Version:</strong> Added in 2020.x (2020.1.14, 2020.2.11, 2020.3.6, 2020.4.2) and 2021.1.x. The default value was changed to <code>true</code> in 2021.2.</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Enables the job that "reaps" (removes) empty Filestore folders.</p>&#13; <h3 is="heading-item" :level="3" id="filestoreemptyfoldersreapfrequencys">filestore_empty_folders_reap.frequency_s</h3>&#13; <p><strong>Version:</strong> Added in 2020.x (2020.1.14, 2020.2.11, 2020.3.6, 2020.4.2). </p>&#13; <p>Default value: <code>86400</code> (24 hours)</p>&#13; <p>Specifies in minutes, how often to run the job that removes empty Filestore folders.</p>&#13; <h3 is="heading-item" :level="3" id="featureshyperdisallowtdepublishing"><a name="DisallowTDEPublishing"/>features.Hyper_DisallowTDEPublishing</h3>&#13; <p><strong>Version:</strong> Defaults to <code>true </code>beginning in version 2023.1.0</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Specifies if users can upload .tde format files. This format was replaced by .hyper format beginning in version of 10.5 of Tableau Server but were not blocked from upload. The files were automatically converted to .hyper format if one of several actions were performed. For more information, see <a href="extracting_upgrade.htm" class="MCXref xref" xrefformat="{paratext}">Extract Upgrade to .hyper Format</a>.</p>&#13; <h3 is="heading-item" :level="3" id="filestoreloglevel">filestore.log.level</h3>&#13; <p>features.Hyper_DisallowTDEPublishing</p>&#13; <p><strong>Version:</strong> Added in version 2020.3.0</p>&#13; <p>Default value: <code>info</code></p>&#13; <p>The logging level for File Store. This is dynamically configurable, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="filestorereapemptyfoldersholdoffms">filestore.reapemptyfoldersholdoffms</h3>&#13; <p><strong>Version:</strong> Added in 2020.x (2020.1.14, 2020.2.11, 2020.3.6, 2020.4.2). This is not yet available in 2021.1.</p>&#13; <p>Default value: <code>300000</code> (5 minutes)</p>&#13; <p>Specifies in milliseconds, the amount of time to wait before removing empty Filestore folders.</p>&#13; <h3 is="heading-item" :level="3" id="floweditormaxdatafileuploadsizeinkb">floweditor.max_datafile_upload_size_in_kb</h3>&#13; <p><strong>Version:</strong> Added in version 2020.4</p>&#13; <p>Default value: <code>1048576</code></p>&#13; <p>For Tableau Prep flow web authoring, the maximum size of delimited text files (for example, CSV or TXT) that can be uploaded to Tableau Server.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayexternalurl"><a name="gateway_external_url"/>gateway.external_url</h3>&#13; <p><b>Version:</b> Added in version 2023.1</p>&#13; <p>Default value: Null</p>&#13; <p>Required when OpenID Connect (OIDC) authentication is configured in TSM during Tableau Server setup or with identity pools. Specifies the Tableau Server URL used by the identity provider (IdP) to redirect users who authenticate into Tableau. The gateway external URL is the same URL that you specified as the redirect URL with your IdP, which is used for matching purposes.</p>&#13; <p>For example, to redirect the IdP associated with OIDC authentication configuration to your Tableau Server, http://myco, run the following command:</p>&#13; <p><code>tsm configuration set -k gateway.external_url -v http://myco</code>&#13; <h3 is="heading-item" :level="3" id="gatewayhttpcachecontrolupdated">gateway.http.cachecontrol.updated</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>The Cache-Control HTTP header specifies whether the client browser should cache content sent from Tableau Server. To disable caching of Tableau Server data on the client, set this option to <code>true</code>.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayhttphsts">gateway.http.hsts</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>The HTTP Strict Transport Security (HSTS) header forces browsers to use HTTPS on the domain where it is enabled.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayhttphstsoptions">gateway.http.hsts_options</h3>&#13; <p>Default value: <code>"max-age=31536000"</code></p>&#13; <p>By default, HSTS policy is set for one year (31536000 seconds). This time period specifies the amount of time in which the browser will access the server over HTTPS.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayhttpdloglevel"><a name="gatewayHttpdLoglevel"/>gateway.httpd.loglevel</h3>&#13; <p><strong>Version:</strong> Added in 2021.3.0.</p>&#13; <p>Default value: <code>notice</code></p>&#13; <p>Specifies the logging level for the Gateway (Apache HTTPD server). By default this is set to <code>notice</code>. Other options include <code>debug</code>, <code>info</code>, <code>warning</code>, <code>error</code>. If you change the logging level, be aware of potential impact to disk space usage and performance. As a best practice, return the logging level to the default after you have gathered the information you need. For detailed information on Apache logging, see the <a href="https://httpd.apache.org/docs/2.4/mod/core.html#loglevel" target="_blank">Apache HTTP documentation<span class="sr-only">(Link opens in a new window)</span></a>.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayhttpdshmcbsize"><a name="gateway-httpd-shmcb-size"/>gateway.httpd.shmcb.size</h3>&#13; <p><b>Version:</b> Added in 2021.4</p>&#13; <p>Default value: <code>2048000</code></p>&#13; <p>Specifies the amount of memory in bytes for the circular buffer when using the <code>shmcb</code> storage type. This configuration key doesn’t apply when using the <code>dbm</code> storage type.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayhttpdsocache"><a name="gateway-httpd-socache"/>gateway.httpd.socache</h3>&#13; <p><b>Version:</b> Added in 2021.4</p>&#13; <p>Default value: <code>shmcb</code></p>&#13; <p>Specifies the storage type of the global/inter-process SSL Session Cache. By default, this is set to <code>shmcb</code>, with another configurable option <code>dbm</code>. For more information about <code>shmcb</code> and <code>dbm</code> storage types, see <a href="https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslsessioncache" target="_blank">SSLSessionCache Directive<span class="sr-only">(Link opens in a new window)</span></a> on the Apache website.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayhttprequestsizelimit">gateway.http.request_size_limit</h3>&#13; <p>Default value: <code>16380 </code></p>&#13; <p>The maximum size (bytes) of header content that is allowed to pass through the Apache gateway on HTTP requests. Headers that exceed the value set on this option will result in browser errors, such as HTTP Error 413 (Request Entity Too Large) or authentication failures.</p>&#13; <p> A low value for <code>gateway.http.request_size_limit</code> can result in authentication errors. Single sign-on solutions that integrate with Active Directory (SAML and Kerberos) often require large authentication tokens in HTTP headers. Be sure to test HTTP authentication scenarios before deploying into production. </p>&#13; <p>We recommend setting <code>tomcat.http.maxrequestsize</code> option to the same value that you set for this option. </p>&#13; <h3 is="heading-item" :level="3" id="gatewayhttpxcontenttypenosniff">gateway.http.x_content_type_nosniff</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>The X-Content-Type-Options response HTTP header specifies that the MIME type in the Content-Type header should not be changed by the browser. In some cases, where MIME type is not specified, a browser may attempt to determine the MIME type by evaluating the characteristics of the payload. The browser will then display the content accordingly. This process is referred to as "sniffing." Misinterpreting the MIME type can lead to security vulnerabilities. The X-Content-Type-Options HTTP header is set to 'nosniff' by default with this option.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayhttpxxssprotection">gateway.http.x_xss_protection</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>The HTTP X-XSS-Protection response header is sent to the browser to enable cross-site scripting (XSS) protection. The X-XSS-Protection response header overrides configurations in cases where users have disabled XXS protection in the browser. The X-XSS-Protection response header is enabled by default with this option.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayloglevel">gateway.log.level</h3>&#13; <p><strong>Version:</strong> Added in version 2020.3.0.</p>&#13; <p>Default value: <code>info</code></p>&#13; <p>The logging level for Gateway. This is dynamically configurable, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="gatewaypublichost">gateway.public.host</h3>&#13; <p>Default value: &lt;hostname&gt;</p>&#13; <p>The name (URL) of the server, used for external access to Tableau Server. If Tableau Server is configured to work with a proxy server or external load balancer, it is the name entered in a browser address bar to reach Tableau Server. For example, if Tableau Server is reached by entering <code>tableau.example.com</code>, the name for gateway.public.host is <code>tableau.example.com</code>.</p>&#13; <h3 is="heading-item" :level="3" id="gatewaypublicport">gateway.public.port</h3>&#13; <p>Default value: <code>80 </code>(<code>443 </code>if SSL)</p>&#13; <p>Applies to proxy server environments only. The external port the proxy server listens on.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayslowpostprotectionenabled">gateway.slow_post_protection.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>When enabled, this can provide some help in protecting against slow POST (Denial-of-Service) attacks by timing out POST requests that transfer data at extremely slow rates.</p>&#13; <p class="note"><strong>Note:</strong> This will not eliminate the threat of such attacks, and could have the unintended impact of terminating slow connections.</p>&#13; <h3 is="heading-item" :level="3" id="gatewayslowpostprotectionrequestreadtimeout">gateway.slow_post_protection.request_read_timeout</h3>&#13; <p>Default value: <code>header=10-30,MinRate=500 body=30,MinRate=500</code></p>&#13; <p>When enabled by the preceding option, <code>gateway.slow_post_protection.enabled</code>, this option sets the Apache httpd ReadRequestTimeout. The httpd directive is documented at <a href="https://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html" target="_blank">Apache Module mod_reqtimeout<span class="sr-only">(Link opens in a new window)</span></a>. The primary use of this option is as a defense the Slowloris attack. See the Wikipedia entry, <a href="https://en.wikipedia.org/wiki/Slowloris_(computer_security)" target="_blank">Slowloris (computer security)<span class="sr-only">(Link opens in a new window)</span></a>.</p>&#13; <p><strong>Note:</strong> Older versions use a default value: <code>header=15-20,MinRate=500 body=10,MinRate=500</code></p>&#13; <h3 is="heading-item" :level="3" id="gatewaytimeout">gateway.timeout</h3>&#13; <p>Default value: <code>7200</code></p>&#13; <p>Longest amount of time, in seconds, that the gateway will wait for certain events before failing a request (7200 seconds = 2 hours).</p>&#13; <h3 is="heading-item" :level="3" id="gatewaytrusted">gateway.trusted</h3>&#13; <p>Default value: IP address of proxy server machine</p>&#13; <p>Applies to proxy server environments only. The IP address(es) or host name(s) of the proxy server.</p>&#13; <h3 is="heading-item" :level="3" id="gatewaytrustedhosts">gateway.trusted_hosts</h3>&#13; <p>Default value: Alternate names of proxy server</p>&#13; <p>Applies to proxy server environments only. Any alternate host name(s) for the proxy server.</p>&#13; <h3 is="heading-item" :level="3" id="hyperfilepartitionsizelimit">hyper.file_partition_size_limit</h3>&#13; <p>Default value: <code>0</code></p>&#13; <p>When set to 0, the size is set to unlimited and will use all the disk space that is available.</p>&#13; <p>This option is used to set the disk space limit for a query that spools to disk. If your disk space usage by the spool.&lt;id&gt;.tmp file is higher than where you need it to be for your environment, it means that queries are spooling and taking up disk space. Use this option to limit the amount of disk space that any one query can use. The spool.&lt;id&gt;.tmp file can be found in the temp folder of the user account running Tableau Server. You can specify this value in K(KB), M(MB), G(GB), or T(TB) units. For example, you can specify the size limit as 100G when you want to limit the disk space usage to 100 GB.</p>&#13; <p>For more information about spooling see the Memory and CPU Usage section in <a href="data_engine2_intro.htm" class="MCXref xref" xrefformat="{paratext}">Tableau Server Data Engine</a>.</p>&#13; <h3 is="heading-item" :level="3" id="hyperglobalfilepartitionsizelimit">hyper.global_file_partition_size_limit</h3>&#13; <p>Default value: <code>0</code></p>&#13; <p>When set to 0, the size is set to unlimited and will use all the disk space that is available.</p>&#13; <p>This option is used to set the disk space limit for all queries that spool to disk. If your disk space usage by the spool.&lt;id&gt;.tmp file is higher than where you need it to be for your environment, it means that queries are spooling and taking up disk space. The spool.&lt;id&gt;.tmp file can be found in the temp folder of the user account running Tableau Server. Use this option to limit the amount of disk space in sum total that all queries use when spooling to disk . You can specify this value in K(KB), M(MB), G(GB), or T(TB) units. For example, you can specify the size limit as 100G when you want to limit the disk space usage to 100 GB. Tableau recommends that you start with this configuration when fine tuning your spooling limits.</p>&#13; <p>For more information about spooling see the Memory and CPU Usage section in <a href="data_engine2_intro.htm" class="MCXref xref" xrefformat="{paratext}">Tableau Server Data Engine</a>.</p>&#13; <h3 is="heading-item" :level="3" id="hyperenableaccesspathssymboliccanonicalization">hyper.enable_accesspaths_symbolic_canonicalization</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>On Windows OS systems, in order to resolve symlinks, Hyper needs to have access to the directory where extracts are stored and all its parent directories. If this is not the case, you may see an error message in the Hyper log that says: <b>Unable to obtain canonical path for</b> <code>//dirA/subdir/myextract.hyper ... Access is denied</code>.</p>&#13; <p>In such cases, you can set this to <code>true</code> so Data Engine (Hyper) will not try to resolve symlinks when using canonical paths.</p>&#13; <p class="note"><b>Note:</b> Setting the value to <code>true</code> also implies that Hyper can no longer guarantee to guard against a potential attacker who manages to place a symlink to escape the allowed set of directories which Hyper is configured to allow access to.</p>&#13; <h3 is="heading-item" :level="3" id="hyperlogqueries">hyper.log_queries</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>When set to true, query information is logged.</p>&#13; <p>By default query information is logged. If however you find that the log files are too large for the amount of disk space available, you can set it to <code>false</code> to disable logging query information. Tableau recommends leaving this configuration set to <code>true</code>.</p>&#13; <h3 is="heading-item" :level="3" id="hyperlogquerycpu">hyper.log_query_cpu</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Use this setting to log how much time each query takes and the CPU usage.</p>&#13; <h3 is="heading-item" :level="3" id="hyperlogtiming">hyper.log_timing</h3>&#13; <p>Default value: <code>false</code></p>&#13; </p><p>This setting is useful to find out more information about the queries, like compilation and parsing times. By default this setting is disabled. You can turn this by setting the value to <code>true</code> to collect more details about your queries. Note, however that this will increase the size of your data engine log files (\logs\hyper).</p>&#13; <h3 is="heading-item" :level="3" id="hyperlogtroublesomequeryplans">hyper.log_troublesome_query_plans</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>When set to <code>true</code>, logs query plans of query that are identified as problematic. Queries that are either canceled, running slower than 10 seconds, or if the queries are spooling to disk fall into this category. The information in the logs can be useful to troubleshoot problematic queries. You can change the setting to <code>false</code> if you are concerned about the size of the logs.</p>&#13; <h3 is="heading-item" :level="3" id="hypermemorylimit">hyper.memory_limit</h3>&#13; <p>Default value: <code>80%</code></p>&#13; <p>Controls the maximum amount of memory used by Hyper. Specify the number of bytes. Append the letter 'k' to the value to indicate kilobytes, 'm' to indicate megabytes, 'g' to indicate gigabytes, or 't' to indicate terabytes. For example, <code>hyper.memory_limit="7g"</code>. Alternatively, specify the memory limit as a percentage of the overall available system memory. For example, <code>hyper.memory_limit="90%"</code>.</p>&#13; <h3 is="heading-item" :level="3" id="hypermemtrackerhardreclaimthreshold">hyper.memtracker_hard_reclaim_threshold</h3>&#13; <p>Default value: <code>80%</code></p>&#13; <p>This setting only applies to Windows. Hyper keeps decompressed and decrypted parts of the extract in memory to make subsequent accesses faster. This setting controls when worker threads will start writing this data out to a disk cache to reduce memory pressure. If given as a percentage, the value is interpreted as a percentage of the overall <code>hyper.memory_limit</code> setting. For example, <code>hyper.memtracker_hard_reclaim_threshold="60%"</code>. Absolute values can be specified as 'k' (kilobytes), 'm' (megabytes), 'g' (gigabytes), or ‘t’ (terabytes). For example, <code>hyper.memtracker_hard_reclaim_threshold="10g"</code>. The value should be larger than the <code>hyper.memtracker_soft_reclaim</code> threshold. </p>&#13; <h3 is="heading-item" :level="3" id="hypermemtrackersoftreclaimthreshold">hyper.memtracker_soft_reclaim_threshold</h3>&#13; <p>Default value: <code>50%</code></p>&#13; <p>This setting only applies to Windows. When interacting with a Hyper file, Hyper will write out some data for caching or persisting the data. Windows has the special behavior that it locks freshly written data into memory. To avoid swapping, we force out the data when Hyper reaches the configured limit for the reclaim threshold. When the soft reclaim threshold is reached, Hyper will try to reclaim cached data in the background to attempt to stay below the reclaim threshold. In situations where swapping would happen otherwise, triggering reclamation in Hyper can lead to a better outcome. Therefore, if your Tableau Server installation experiences a lot of swapping, this setting can be used to attempt to reduce the memory pressure.</p>&#13; <p>Specify the number of bytes. Append the letter 'k' to the value to indicate kilobytes, 'm' to indicate megabytes, 'g' to indicate gigabytes, or 't' to indicate terabytes. Alternatively, specify the value as a percentage of the overall configured memory for Hyper. For example, <code>hyper.memtracker_soft_reclaim_threshold="20%"</code>.&#13; <h3 is="heading-item" :level="3" id="hypernetworkthreads">hyper.network_threads</h3>&#13; <p>Default value: <code>150%</code></p>&#13; <p>Controls the number of network threads used by Hyper. Specify either the number of network threads (for example, <code>hyper.network_threads=4</code>) or specify the percentage of threads in relation to the logical core count (for example, <code>hyper.network_threads="300%"</code>).</p>&#13; <p>Network threads are used for accepting new connections and sending or receiving data and queries. Hyper uses asynchronous networking, so many connections can be served by a single thread. Normally, the amount of work that is done on network threads is very low. The one exception is opening databases on slow file systems, which can take a long time and block the network thread. If connection times are slow when you try to view or edit dashboards that use extracts and have not been used in a while and you frequently see “asio-continuation-slow” messages in the Hyper log and long “construct-protocol” times to Hyper in the Tableau log, try to increase this value.</p>&#13; <h3 is="heading-item" :level="3" id="hyperobjectstorevalidatechecksums">hyper.objectstore_validate_checksums</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>A boolean setting that controls file integrity checks in Hyper. When set to <code>true</code>, Hyper will check the data in an extract file when it is first accessed. This allows silent corruption and corruption that would crash Hyper to be detected. In general, it is advisable to turn this setting on except for installations with very slow disks where it could cause performance regressions.</p>&#13; <h3 is="heading-item" :level="3" id="hyperquerytotaltimelimit">hyper.query_total_time_limit</h3>&#13; <p>Default value: <code>0</code> (which means unlimited)</p>&#13; <p>Sets an upper bound on the total thread time that can be used by individual queries in Hyper. Append 's' to the value to indicate seconds, 'min' to indicate minutes, or 'h' to indicate hours. </p>&#13; <p>For example to restrict all queries to a total time usage of 1500 seconds of total thread time, run the following command:</p>&#13; <p><code>tsm configuration set -k hyper.query_total_time_limit -v 1500s</code>&#13; <p>If a query runs longer then the specified limit, the query will fail and an error will be returned. This setting allows you to automatically control runaway queries that would otherwise use too many resources. </p>&#13; <p>Hyper executes queries in parallel. For example, if a query executes for 100 seconds and during this time is running on 30 threads, the total thread time would be 3000 seconds. The thread time of each query is reported in the Hyper log in the “query-end” log entries in the “total-time” field.</p>&#13; <h3 is="heading-item" :level="3" id="hypersessionmemorylimit">hyper.session_memory_limit</h3>&#13; <p>Default value: <code>0</code> (which means unlimited)</p>&#13; <p>Controls the maximum memory consumption that an individual query can have. Specify the number of bytes. Append the letter 'k' to the value to indicate kilobytes, 'm' to indicate megabytes, 'g' to indicate gigabytes, or 't' to indicate terabytes. </p>&#13; <p>For example, to set the memory limit to 900 megabytes, run the following command:</p>&#13; <p><code>tsm configuration set -k hyper.session_memory_limit -v 900m</code>. </p>&#13; <p>Alternatively, to specify the session memory limit as a percentage of the overall available system memory run the following command:</p>&#13; <p><code>tsm configuration set -k hyper.session_memory_limit -v 90%</code>.</p>&#13; <p>Lowering this value can help when a query is using excessive amounts of memory and making other queries fail over a long period of time. By lowering the limit, the single big query would fail (or resort to spooling if spooling isn’t turned off) and not have a negative impact on other queries.</p>&#13; <h3 is="heading-item" :level="3" id="hypersrmcpulimitpercentage"><a name="hyper_cpu_limit_percent"/>hyper.srm_cpu_limit_percentage</h3>&#13; <p>Default value (in percent): <code>75</code></p>&#13; <p>Specifies the maximum hourly average CPU usage permitted by Hyper. If exceeded, Data Engine will restart itself to minimize impact to other processes on the computer. </p>&#13; <p>By default Data Engine will restart itself if it averages more than 75% usage of CPU over an hour. This value should not be changed except when working with Tableau Support, or if you are running Data Engine on a dedicated server node. If Data Engine is running on a dedicated node, you can safely increase this value to 95 percent to take full advantage of available computer hardware. For details on running Data Engine on a dedicated node, see <a href="perf_tuning_long_queries_for_extracts.htm" class="MCXref xref" xrefformat="{paratext}">Optimize for Extract Query-Heavy Environments</a>.</p>&#13; <p>To increase this to 95%:</p>&#13; <p><code>tsm configuration set -k hyper.srm_cpu_limit_percentage -v 95 --force-keys</code>&#13; <p><code>tsm pending-changes apply</code>&#13; <p>To reset this to the default of 75%:</p>&#13; <p><code>tsm configuration set -k hyper.srm_cpu_limit_percentage -v 75 --force-keys</code>&#13; <p><code>tsm pending-changes apply</code>&#13; <h3 is="heading-item" :level="3" id="hyperstandaloneconsistenthashingenabled">hyper_standalone.consistent_hashing.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Improves the chance that the extract for a query is already cached. If the node with the extract cached cannot support additional load, you will be routed to a new node and the extract will be loaded into cache on the new node. This results in better system utilization because extracts are only loaded into memory if there is load that justifies the need.</p>&#13; <h3 is="heading-item" :level="3" id="hyperstandalonehealthenabled">hyper_standalone.health.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Switches the load balancing metric from random selection to picking the Data Engine (Hyper) node based on a health score that is made of up of a combination of current Hyper activity and system resource usage. Based on these values, the load balancer will pick the node that is most capable of handling an extract query.</p>&#13; <h3 is="heading-item" :level="3" id="hypertempdiskspacelimit">hyper.temp_disk_space_limit</h3>&#13; <p>Default value: <code>100%</code></p>&#13; <p>Sets the upper limit of disk space at which Hyper will stop allocating space for temporary files. This setting can help to stop the hard disk from filling up with temporary files from Hyper and running out of disk space. If disk space reaches this threshold, Hyper will attempt to recover automatically without administrator intervention. </p>&#13; <p>Specify it as percentage of the overall available disk space to be used. For example, <code>hyper.temp_disk_space_limit="96%"</code>. When set to 100%, all of the disk space that is available can be used.&#13; <p>For Data Engine to start, the configured amount of disk space must be available. If not enough disk space is available, you will see a Data Engine log entry that says, “Disk limit for temporary files has been reached. Please free up disk space on the device. See the Hyper log for more information: No space left on device”.&#13; <h3 is="heading-item" :level="3" id="hyperhardconcurrentquerythreadlimit">hyper.hard_concurrent_query_thread_limit</h3>&#13; <p>Default value: 150%</p>&#13; <p>Use this option to set the maximum number of threads Hyper should use for running queries. Use this when you want to set a hard limit on the CPU usage. Specify either the number of threads or specify the percentage of threads in relation to the logical core count. Hyper will most likely not use more resources than are configured by this setting but Hyper background and network threads are not affected by this setting (though they tend to not be CPU intensive).</p>&#13; <p>It is important to consider that this setting controls the number of concurrent queries that can be executed. So, if you decrease this setting, the chance of queries needing to wait for currently running queries to complete increases, which may affect workbook load times.</p>&#13; <h3 is="heading-item" :level="3" id="hypersoftconcurrentquerythreadlimit">hyper.soft_concurrent_query_thread_limit</h3>&#13; <p>Default value: 100%</p>&#13; <p>Use this option to specify the number of threads that a single query can be parallelized across if sufficiently many threads are available given the <code>hard_concurrent_query_thread_limit</code> setting. Specify either the number of threads or specify the percentage of threads in relation to the logical core count.</p>&#13; <p>To illustrate this, here is a simplified example:</p>&#13; <p>Let's say you set this value to 10 threads, this means queries can be parallelized up to 10 threads. If only 2 queries are running, the remaining 8 threads are used to parallelize the 2 queries.</p>&#13; <p class="note"> The <i>hyper. hard_concurrent_query_thread_limit</i>, and <i>hyper.soft_concurrent_query_thread_limit</i> options work together to give you some options to manage your CPU usage while maximizing available CPU resources to complete queries faster. If you don't want the Data Engine to use all the available CPU on the machine, change it to less than 100% to a percentage that is optimal for your environment. The soft limit is a way for you to limit CPU usage but allow it to go beyond the soft limit up to the hard limit if necessary.</p>&#13; <p class="note"><b>Note:</b> The <i>hyper.hard_concurrent_query_thread_limit</i> and <i>hyper.soft_concurrent_query_thread_limit</i> options replace hyper.num_job_worker_threads and hyper.num_task_worker_threads options available in Tableau Server versions 2018.3 and earlier, and are deprecated in the current version. <conditionaltext data-mc-conditions="Product.serverwindows">For information on the hyper.num_job_worker_threads and hyper.num_task_worker_threads, see <a href="https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm" target="_blank">tsm configuration set Options.<span class="sr-only">(Link opens in a new window)</span></a></conditionaltext></p>&#13; <h3 is="heading-item" :level="3" id="hyperusespoolingfallback">hyper.use_spooling_fallback</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>When set to <code>true</code>, it allows spooling to disk when querying extracts exceeds set RAM usage (80% of installed RAM). In other words, it allows Hyper to execute a query using the disk if it exceeds RAM usage.</p>&#13; <p>Tableau recommends that you use the default setting. You can turn this off by setting the value to <code>false</code> if you are concerned about disk usage. If you turn this setting off, queries that use more than 80% of installed RAM will be canceled. Spooling queries usually take substantially longer to finish.</p>&#13; <p>For more information about spooling see the Memory and CPU Usage section in <a href="data_engine2_intro.htm" class="MCXref xref" xrefformat="{paratext}">Tableau Server Data Engine</a>.</p>&#13; <h3 is="heading-item" :level="3" id="indexandsearchservervmopts"><a name="indexandsearchserver"/>indexandsearchserver.vmopts</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.1.</p>&#13; </p><p>Default value: "<code>-Xmx&lt;default_value&gt; -Xms&lt;default_value&gt;</code>" </p>&#13; <p>The default value is based on the amount of system memory and is 3.125% of the total system RAM. </p>&#13; <p>Controls the Index and Search Server heap size. Because the default value scales automatically, use this option to override the default value only when absolutely necessary. Append the letter 'k' to the value to indicate kilobytes, 'm' for megabytes, or 'g' to indicate gigabytes. As a general rule, set initial heap size (<code>-Xms</code>) equal to the maximum heap size (<code>-Xmx</code>) to minimize garbage collections. </p>&#13; <h3 is="heading-item" :level="3" id="jmxsecurityenabled">jmx.security.enabled</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.1.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>JMX is disabled by default, so secure JMX is also disabled. If you are enabling JMX we strongly recommend you enable secure JMX. </p>&#13; <p>This is set to <code>true</code> and turns secure JMX on with SSL and basic username/password authentication for readonly access when you run the <code>tsm maintenance jmx enable</code> command and answer <code>y</code> when prompted to enable security features for JMX:</p><pre xml:space="preserve">tsm maintenance jmx enable&#13; We do not recommend you enable JMX unsecured on a production environment. Would you like to enable security features for JMX?&#13; (y/n): y</pre>&#13; <h3 is="heading-item" :level="3" id="jmxsslenabled">jmx.ssl.enabled</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.1.</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Enforces SSL for JMX. This option defaults to <code>true</code> but has no effect unless <code>jmx.security.enabled</code> is also set to <code>true</code>. To enable JMX security, run the <code>tsm maintenance jmx enable</code> command. Answer <code>y</code> when prompted to leave SSL enabled, or <code>n</code> to disable SSL:</p><pre xml:space="preserve">tsm maintenance jmx enable&#13; Would you like to enable SSL?&#13; (y/n): n</pre>&#13; <h3 is="heading-item" :level="3" id="jmxsslrequireclientauth">jmx.ssl.require_client_auth</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.1.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>This is set to <code>true</code> when you run the <code>tsm maintenance jmx enable</code> command and answer <code>y</code> when prompted to require client authentication (mTLS):</p><pre xml:space="preserve">tsm maintenance jmx enable&#13; Would you like to require client authentication (mTLS)?&#13; (y/n): y</pre>&#13; <p>To complete configuration you must have a client cert and place this in the correct location on your client computer. </p>&#13; <h3 is="heading-item" :level="3" id="jmxsslusername">jmx.ssl.user.name</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.1.</p>&#13; <p>Default value: <code>tsmjmxuser</code> </p>&#13; <p>This is set when you install or upgrade <span class="VariablesProductName">Tableau Server</span>. </p>&#13; <h3 is="heading-item" :level="3" id="jmxssluserpassword">jmx.ssl.user.password</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.1.</p>&#13; <p>Default value: <code>&lt;generated&gt;</code> </p>&#13; <p>This is set when you install or upgrade <span class="VariablesProductName">Tableau Server</span>. </p>&#13; <h3 is="heading-item" :level="3" id="jmxuseraccess">jmx.user.access</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.1.</p>&#13; <p>Default value: <code>readonly</code> </p>&#13; <p>You can change this to <code>readwrite</code> when you run the <code>tsm maintenance jmx enable</code> command and answer <code>y</code> when prompted to add <code>readwrite </code>access:</p><pre xml:space="preserve">tsm maintenance jmx enable&#13; JMX access is readonly by default. Would you like to add readwrite access?&#13; (y/n): y</pre>&#13; <h3 is="heading-item" :level="3" id="licensingloginbasedlicensemanagementdefaultrequesteddurationseconds">licensing.login_based_license_management.default_requested_duration_seconds</h3>&#13; <p>Default value: <code>0</code></p>&#13; <p>Set to the duration (in seconds) that a user's login-based license can be offline with no connection to <span class="VariablesTabsProductServer">Tableau Server</span> before they are prompted to activate again. This duration is always refreshed when <span class="VariablesTabsProductDesktop">Tableau Desktop</span> is in use and can connect to <span class="VariablesTabsProductServer">Tableau Server</span>.</p>&#13; <h3 is="heading-item" :level="3" id="licensingloginbasedlicensemanagementenabled">licensing.login_based_license_management.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Set to true to enable <span class="VariablesIBA_lowercase">login-based license management</span>. Set to false to disable <span class="VariablesIBA_lowercase">login-based license management</span>.</p>&#13; <p class="note"><b>Note:</b> In order to use <span class="VariablesIBA_lowercase">login-based license management</span>, you must activate a product key that is enabled for <span class="VariablesIBA_lowercase">login-based license management</span>. You can use the <code><a href="cli_licenses_tsm.htm#TSMLicenseList">tsm licenses list</a></code> to see which product keys have <span class="VariablesIBA_lowercase">login-based license management</span> enabled.</p>&#13; <h3 is="heading-item" :level="3" id="licensingloginbasedlicensemanagementmaxrequesteddurationseconds">licensing.login_based_license_management.max_requested_duration_seconds</h3>&#13; <p>Default value: <code>7776000</code></p>&#13; <p>Set to the maximum duration (in seconds) that a user’s login-based license can be offline with no connection to <span class="VariablesTabsProductServer">Tableau Server</span> before they are prompted to activate Tableau again. The maximum value is 7776000 seconds (90 days). This duration is always refreshed when <span class="VariablesTabsProductDesktop">Tableau Desktop</span> is in use and can connect to <span class="VariablesTabsProductServer">Tableau Server</span>.</p>&#13; <h3 is="heading-item" :level="3" id="maestroappsettingssamplingmaxrowlimit">maestro.app_settings.sampling_max_row_limit</h3>&#13; <p>Default value: <code>1000000</code></p>&#13; <p>Sets the maximum number of rows for sampling data from large data sets with Tableau Prep on the web.</p>&#13; <h3 is="heading-item" :level="3" id="maestroinputallowedpaths">maestro.input.allowed_paths</h3>&#13; <p>Default value: ""</p>&#13; <p>By default, access to any directory will be denied, and only publishing to Tableau Server with content that is included in the tflx file is allowed.</p>&#13; <p>A list of allowed network directories for flow input connections. You must enable Tableau Prep Conductor to schedule flows on your Tableau Server. For more information, see <a href="prep_publishserver_overview.htm" class="MCXref xref" xrefformat="{paratext}">Tableau Prep Conductor</a>.</p>&#13; <p>The following rules apply and must be considered when configuring this setting:</p>&#13; <p>Paths should be accessible by Tableau Server. These paths are verified during server startup and at flow run time.</p>&#13; <p>Network directory paths have to be absolute and cannot contain wildcards or other path traversing symbols. For example <code>\\myhost\myShare\*</code> or <code>\\myhost\myShare*</code> are invalid paths and would result in all the paths as disallowed. The correct way to safelist any folder under <i>myShare</i> would be <code>\\myhost\myShare or \\myhost\\myShare\</code>.</p>&#13; <p class="note"><b>Note:</b> The <code>\\myhost\myShare</code> configuration will not allow <code>\\myhost\myShare1</code>. In order to safe list both of these folders one would have safe list them as \\myhost\myShare; \\myhost\myShare1.</p>&#13; <p>The value can be either <code>*</code>, to allow any network directory, or a list of network directory paths, delimited by “;”.</p>&#13; <p>No local directory paths are allowed even when the value is set to <code>*</code>.</p>&#13; <p class="note--important">Important:<br/>This command overwrites existing information and replaces it with the new information you provided. If you want to add a new location to an existing list, you must provide a list of all the locations, existing and the new one you want to add. Use the following commands to see the current list of input and output locations:<br/><br/><code>tsm configuration get -k maestro.input.allowed_paths<br/>tsm configuration get -k maestro.output.allowed_paths</code><br/></p>&#13; <p>For more information and details about configuring allowed directories for flow input and output connections, see <a href="prep_conductor_configure_network_shares.htm" target="_blank" class="MCXref xref" xrefformat="{paratext}">Step 4: Safe list Input and Output locations<span class="sr-only">(Link opens in a new window)</span></a>.</p>&#13; <h3 is="heading-item" :level="3" id="maestrooutputallowedpaths">maestro.output.allowed_paths</h3>&#13; <p>Default value: ""</p>&#13; <p>By default, access to any directories will be denied.</p>&#13; <p>A list of allowed network directories for flow output connections. You must enable Tableau Prep Conductor to schedule flows on your Tableau Server. For more information, see <a href="prep_publishserver_overview.htm" class="MCXref xref" xrefformat="{paratext}">Tableau Prep Conductor</a>.</p>&#13; <p>The following rules apply and must be considered when configuring this setting:</p>&#13; <p>Paths should be accessible by Tableau Server. These paths are verified during server startup and at flow run time.</p>&#13; <p>Network directory paths have to be absolute and cannot contain wildcards or other path traversing symbols. For example <code>\\myhost\myShare\*</code> or <code>\\myhost\myShare*</code> are invalid paths and would result in all the paths as disallowed. The correct way to safelist any folder under <i>myShare</i> would be <code>\\myhost\myShare or \\myhost\\myShare\</code>.</p>&#13; <p class="note"><b>Note:</b> The <code>\\myhost\myShare</code> configuration will not allow <code>\\myhost\myShare1</code>. In order to safe list both of these folders one would have safe list them as \\myhost\myShare; \\myhost\myShare1.</p>&#13; <p>The value can be either <code>*</code>, to allow any network directory, or a list of network directory paths, delimited by “;”.</p>&#13; <p>No local directory paths are allowed even when the value is set to <code>*</code>.</p>&#13; <p class="note"><b>Note:</b> If a path is both on the flows allowed list and internal_disasslowed list, internal_disallowed takes precedence.</p>&#13; <p>For more information and details about configuring allowed directories for flow input and output connections, see <a href="prep_conductor_configure_network_shares.htm" target="_blank" class="MCXref xref" xrefformat="{paratext}">Step 4: Safe list Input and Output locations<span class="sr-only">(Link opens in a new window)</span></a>.</p>&#13; <h3 is="heading-item" :level="3" id="maestrooutputwritetomssqlusingrunas">maestro.output.write_to_mssql_using_runas</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.3.1</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>When enabled, flow outputs published to Tableau Server are allowed write access to a Microsoft SQL Server database using Run As credentials. The credentials used by the Run As service account must have write permission to the database. Evaluate your security and deployment requirements before enabling the <code>maestro.output.write_to_mssql_using_runas</code> setting. For more information, see <a href="https://help.tableau.com/current/server/en-us/runas.htm">Run As Service Account</a>.</p>&#13; <p class="note"><b>Note</b>: This command requires the <code>--force-keys</code> option. For example:<code> tsm configuration set -k maestro.output.write_to_mssql_using_runas -v true --force-keys</code>.</p>&#13; <h3 is="heading-item" :level="3" id="maestrosessionmanagementmaxconcurrentsessionperuser">maestro.sessionmanagement.maxConcurrentSessionPerUser</h3>&#13; <p>Default value: <code>4</code></p>&#13; <p>Sets the maximum number of flow web editing sessions that a user can have open at one time.</p>&#13; <h3 is="heading-item" :level="3" id="metadataingestorblocklist"><a name="metadata_blocklist"/>metadata.ingestor.blocklist</h3>&#13; <p>Default value: null</p>&#13; <p>When configured, Tableau Catalog blocks specified content from being ingested. To specify which content to block, you must identify the blocklist values, which is a combination of both the site ID, content type, and content ID of the content you want to block, from the server “noninteractive” log files. Blocklist values must be separated by a comma.</p>&#13; <p><b>Important:</b> You should only use this option when directed to do so by Tableau Support.</p>&#13; <p>For example, you can use the <code>tsm configuration set --force-keys -k metadata.ingestor.blocklist</code> to block ingestion of a combination of data sources, workbooks, and flows using the following command:</p>&#13; <p><code>tsm configuration set --force-keys -k metadata.ingestor.blocklist -v "sites/1/datasources/289, sites/2/datasources/111, sites/1/workbooks/32, sites/3/workbooks/15, sites/1/flows/13, sites/1/flows/18”</code>&#13; <p>To validate blocked content, review the server “noninteractive” log files for the following events: </p>&#13; <li value="1"><code>Skipping ingestion for</code>&#13; <li value="2"><code>Successfully updated blocklist to</code>&#13; <p>For example:</p>&#13; <p><code>Skipping ingestion for contentType [Workbook], contentId [sites/1/datasources/289], siteDisabled [false], swallowEvent [false], contentBlocked [true]</code>&#13; <p><code>Skipping ingestion for contentType [Workbook], contentId [sites/3/workbooks/15], siteDisabled [false], swallowEvent [false], contentBlocked [true]</code>&#13; <p><code>Successfully updated blocklist to: [sites/1/datasources/289, sites/1/workbooks/32, sites/2/datasources/111]</code>&#13; <h3 is="heading-item" :level="3" id="metadataingestorpipelinethrottleeventsenable"><a name="metadata_eventthrottle_enable"/>metadata.ingestor.pipeline.throttleEventsEnable</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether indexing of new and updated content, also called eventing, is regulated across all sites on the server. By default, event throttling is turned off. To turn on event throttling, change this setting to <code>true</code> using the following command: </p>&#13; <p><code>tsm configuration set -k metadata.ingestor.pipeline.throttleEventsEnable -v true --force-keys</code>&#13; <p>For more information about event throttling, see <a href="dm_catalog_enable.htm#troubleshoot_eventing_delay" class="MCXref xref" xrefformat="{paratext}">Enable Tableau Catalog</a>.</p>&#13; <h3 is="heading-item" :level="3" id="metadataingestorpipelinethrottlelimit"><a name="metadata_eventthrottle_limit"/>metadata.ingestor.pipeline.throttleLimit</h3>&#13; <p>Default value: <code>20</code></p>&#13; <p>When event throttling is enabled, this is the maximum number of new and updated content items that can be indexed during a specified period of time. Once the specified limit is reached for a specific item, indexing is deferred. </p>&#13; <p>By default, the limit is set to <code>20</code> and can't be set to lower than <code>2</code>. You can use the following command to change the limit: </p>&#13; <p><code>tsm configuration set -k metadata.ingestor.pipeline.throttleLimit -v 25 --force-keys</code>&#13; <p>Throttled events can be identified in the server "noninteractive" log files as <code>ingestor event flagged for removal by throttle filter</code>.</p>&#13; <h3 is="heading-item" :level="3" id="metadataingestorpipelinethrottleperiodlength"><a name="metadata_eventthrottle_time"/>metadata.ingestor.pipeline.throttlePeriodLength</h3>&#13; <p>Default value: <code>20</code></p>&#13; <p>When event throttling is enabled, this is the period of time, in minutes, a specified maximum number of new and updated content items can be indexed. Once the specified time is reached, indexing of any additional new and updated content is deferred.</p>&#13; <p>By default, the time is set to 30 minutes. You can use the following command to change the time:</p>&#13; <p><code>tsm configuration set -k metadata.ingestor.pipeline.throttlePeriodLength -v PT45M --force-keys</code>&#13; <h3 is="heading-item" :level="3" id="metadataquerylimitstime"><a name="metadata_timeout"/>metadata.query.limits.time&#13; <p>Default value: <code>20</code></p>&#13; <p>This is the longest allowable time, in seconds, for a Catalog or Metadata API query to run before a timeout occurs and the query is canceled. Tableau recommends incrementally increasing the timeout limit to <i>no more than</i> 60 seconds using the following command:</p>&#13; <p><code>tsm configuration set -k metadata.query.limits.time –v PT30S --force-keys</code>&#13; <p><b>Important:</b> This option should be changed only if you see the error described here, <a href="dm_catalog_enable.htm#timeoutnodelimit" class="MCXref xref" xrefformat="{paratext}">Timeout limit and node limit exceeded messages</a>. Increasing the timeout limit can utilize more CPU for longer, which can impact the performance of tasks across Tableau Server. Increasing the timeout limit can also cause higher memory usage, which can cause issues with the interactive microservices container when queries run in parallel.</p>&#13; <h3 is="heading-item" :level="3" id="metadataquerylimitscount"><a name="metadata_nodelimit"/>metadata.query.limits.count</h3>&#13; <p>Default value: <code>20000</code></p>&#13; <p>This is the number of objects (which can loosely map to the number of query results) that Catalog can return before the node limit is exceeded and the query is canceled. Tableau recommends incrementally increasing the timeout limit, to <i>no more than</i> 100,000 using the following command:</p>&#13; <p><code>tsm configuration set -k metadata.query.limits.count –v 3000 --force-keys</code>&#13; <p><b>Important:</b> This option should be changed only if you see the error described here, <a href="dm_catalog_enable.htm#timeoutnodelimit" class="MCXref xref" xrefformat="{paratext}">Timeout limit and node limit exceeded messages</a>. Increasing the node limit can cause higher memory usage, which can cause issues with the interactive microservices container when queries run in parallel.</p>&#13; <h3 is="heading-item" :level="3" id="metricsservicescheckintervalinminutes"><a name="metrics-interval"/>metricsservices.checkIntervalInMinutes</h3>&#13; <p>Default value: <code>60</code></p>&#13; <p>Controls the interval, in minutes, between refreshes for metrics that rely on live data sources. A metric refreshes when the server checks for new data via the metric’s connected view.</p>&#13; <h3 is="heading-item" :level="3" id="metricsservicesenabled"><a name="metrics-enable"/>metricsservices.enabled</h3>&#13; <p><strong>Version:</strong> Added in version: 2022.3</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>When set to <code>false</code>, the metrics content type is disabled for all sites on a server. For more information, see <a href="metrics_admin.htm#disable-server" class="MCXref xref" xrefformat="{paratext}">Disable metrics for a server</a>. </p>&#13; <h3 is="heading-item" :level="3" id="metricsservicesfailurecounttowarnuser"><a name="metrics-warn"/>metricsservices.failureCountToWarnUser</h3>&#13; <p>Default value: <code>10</code></p>&#13; <p>Controls the number of consecutive refresh failures that must occur before the metric owner is warned. When set to the default of 10, a metric refresh must fail 10 times in a row before the owner is sent a notification about the failure. </p>&#13; <h3 is="heading-item" :level="3" id="metricsservicesmaxfailedrefreshattempts"><a name="metrics-suspend"/>metricsservices.maxFailedRefreshAttempts</h3>&#13; <p>Default value: <code>175</code></p>&#13; <p>Controls the number of consecutive refresh failures that must occur before a metric refresh is suspended.</p>&#13; <h3 is="heading-item" :level="3" id="mobiledeeplinkingonpremenabled"><a name="mobile_link"/>mobile.deep_linking.on_prem.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether links to Tableau Server are treated as deep links by the Tableau Mobile app. When set to <code>true</code>, links to supported content types open in the app. When set to <code>false</code>, links open in the mobile browser. For more information see, <a href="https://help.tableau.com/current/mobile/mobile-admin/en-us/admin_mobile_links.htm">Control deep linking for Tableau Mobile</a>.</p>&#13; <h3 is="heading-item" :level="3" id="monitoringdataengineconnectiontimeout">monitoring.dataengine.connection_timeout</h3>&#13; <p>Default value: <code>30000</code></p>&#13; <p>The length of time, in milliseconds, that Cluster Controller will wait for the data engine, before determining that a connection timeout occurred. The default is 30,000 milliseconds (30 seconds).</p>&#13; <h3 is="heading-item" :level="3" id="nativeapiconnectionlimitconnection-class">native_api.connection.limit.&lt;connection class&gt;</h3>&#13; <p>Set parallel query limit for the specified data source (connection class). This overrides the global limit for the data source.</p>&#13; <h3 is="heading-item" :level="3" id="nativeapiconnectiongloballimit">native_api.connection.globallimit</h3>&#13; <p>Default value: <code>16</code></p>&#13; <p>Global limit for parallel queries. Default is 16 except for Amazon Redshift which has a default of 8.</p>&#13; <h3 is="heading-item" :level="3" id="nativeapiexplaindataenabled">native_api.ExplainDataEnabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>This option controls whether Explain Data is enabled or disabled for the server. For more information about Explain Data, see <a href="https://help.tableau.com/current/pro/desktop/en-us/explain_data_basics.htm" target="_blank">Get Started with Explain Data<span class="sr-only">(Link opens in a new window)</span></a> in the Tableau Help. </p>&#13; <p>This option was added beginning with Tableau Server version: 2019.3.</p>&#13; <h3 is="heading-item" :level="3" id="nativeapiforcealternativefederationengine">native_api.force_alternative_federation_engine</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Override the operation restrictions when joining data from a single file connection and a single SQL database connection. Set this option to <code>True</code> to force Tableau to process the join using the live database connection. </p>&#13; <h3 is="heading-item" :level="3" id="nativeapiprotocoltransitionlegacyformat">native_api.ProtocolTransitionLegacyFormat</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Use the legacy name format for constrained delegation.</p>&#13; <p>The name format was changed in version 10.1 to allow cross-domain protocol transition (S4U). If this causes problems with existing configurations and you don't need cross-domain protocol transition, configure <span class="VariablesProductName">Tableau Server</span> to use the old behavior by setting this to <code>true</code>.</p>&#13; <h3 is="heading-item" :level="3" id="nativeapiinitializequerycachesizebasedonweights"><a name="querycachesizeadaptiveinit"/>native_api.InitializeQueryCacheSizeBasedOnWeights</h3>&#13; <p>Default value: <code>True</code></p>&#13; <p>Controls whether the query cache size is initialized automatically based on the amount of available system memory. The query cache consists of the logical query cache, metadata cache, and native query cache. By default, this functionality is enabled.</p>&#13; <h3 is="heading-item" :level="3" id="nativeapiquerycachemaxallowedmb">native_api.QueryCacheMaxAllowedMB</h3>&#13; <p>The maximum size of the query cache in megabytes. This value varies based on the amount of system memory. The query cache consists of the logical query cache, metadata cache, and native query cache. Use the table below to determine your default value:</p>&#13; <h3 is="heading-item" :level="3" id="nativeapilogicalquerycachemaxallowedweight">native_api.LogicalQueryCacheMaxAllowedWeight</h3>&#13; <p>Default value: <code>70</code></p>&#13; <p>The weight of logical query cache size limit in the total query cache size.</p>&#13; <h3 is="heading-item" :level="3" id="nativeapimetadataquerycachmaxallowedweight">native_api.MetadataQueryCachMaxAllowedWeight</h3>&#13; <p>Default value: <code>4</code></p>&#13; <p>The weight of metadata query cache size limit in the total query cache size.</p>&#13; <h3 is="heading-item" :level="3" id="nativeapinativequerycachemaxallowedweight">native_api.NativeQueryCacheMaxAllowedWeight</h3>&#13; <p>Default value: <code>26</code></p>&#13; <p>The weight of native query cache size limit in the total query cache size.</p>&#13; <h3 is="heading-item" :level="3" id="nativeapiquerycacheentrymaxallowedinpercent">native_api.QueryCacheEntryMaxAllowedInPercent</h3>&#13; <p>Default value: <code>60</code></p>&#13; <p> Specifies the maximum size of query results that can be put into the query cache. It is set as the percentage of the total query cache size. For example, if the logical query cache size is 100 MB and <code>native_api.QueryCacheEntryMaxAllowedInPercent</code> is set to 60 percent, then only query results that are smaller than 60 MB can be put into the logical query cache.</p>&#13; <h3 is="heading-item" :level="3" id="nlpconceptsshardscount"><a name="nlpconcepts_shards"/>nlp.concepts_shards_count</h3>&#13; <p>Default value: 1</p>&#13; <p class="note"><strong>Note:</strong> The default shard count value is sufficient for most Tableau Server installations.</p>&#13; <p> Controls the number of data shards for the Concepts index of Ask Data, field names, field synonyms, and analytical terms stored in shards in:</p>&#13; <li value="1">The Index and Search Server for 2022.1 and later versions.</li>&#13; <li value="2">Elastic Server for 2019.1 - 2021. 4</li>&#13; <p>The shard count partitions the search index to reduce total index size, which may improve the performance of Ask Data's semantic parser. Adjusting the shard count is another performance enhancement measure that you can take along with increasing the heap size through <code>elasticserver.vmopts</code> or <code>indexandsearchserver.vmopts</code>, depending on the version of Tableau Server that you are running.</p>&#13; <p>Tableau recommends increasing the shard count by 1 for every 50 GB. To reduce the number of times you need to adjust the shard count, calculate the total index size by adding 50% to the current index. For example, if the total index size is less than 50 GB, then 1 shard is sufficient. Actual performance will vary depending on the server, the rate at which the index size grows, and other factors.</p>&#13; <li value="1">0 to 50 GB: 1</li>&#13; <li value="2">50 GB to 100 GB: 2</li>&#13; <li value="3">100 GB to 150 GB: 3</li>&#13; <p>You can use the following command to increase the Concepts index shard count from default to 2:</p>&#13; <p><code>tsm configuration set -k nlp.concepts_shards_count -v 2</code>&#13; <h3 is="heading-item" :level="3" id="nlpvaluesshardscount"><a name="nlpvalues_shards"/>nlp.values_shards_count</h3>&#13; <p>Default value: 1</p>&#13; <p> Controls the number of data shards for the Concepts index of Ask Data, field names, field synonyms, and analytical terms stored in shards in:</p>&#13; <li value="1">The Index and Search Server for 2022.1 and later versions.</li>&#13; <li value="2">Elastic Server for 2019.1 - 2021. 4</li>&#13; <p>The shard count partitions the search index to reduce total index size, which may improve the performance of Ask Data's semantic parser. Adjusting the shard count is another performance enhancement measure that you can take along with increasing the heap size through <code>elasticserver.vmopts</code> or <code>indexandsearchserver.vmopts</code>, depending on the version of Tableau Server that you are running.</p>&#13; <p>Tableau recommends increasing the shard count by 1 for every 50 GB. To reduce the number of times you need to adjust the shard count, calculate the total index size by adding 50% to the current index. For example, if the total index size is less than 50 GB, then 1 shard is sufficient. Actual performance will vary depending on the server, the rate at which the index size grows, and other factors.</p>&#13; <li value="1">0 to 50 GB: 1</li>&#13; <li value="2">50 GB to 100 GB: 2</li>&#13; <li value="3">100 GB to 150 GB: 3</li>&#13; <p>You can use the following command to increase the Values index shard count from default to 2:</p>&#13; <p><code>tsm configuration set -k nlp.values_shards_count -v 2</code>&#13; <h3 is="heading-item" :level="3" id="nlpdefaultnewsiteaskdatamode"><a name="nlp_newsite_askdatamode"/>nlp.defaultNewSiteAskDataMode </h3>&#13; <p>Default value: <code>disabled_by_default</code></p>&#13; <p>Use this option to set the initial value of the Ask Data Mode when a site is created. For more information see <a href="ask_data_enable.htm#EnableDisableAskDataForSite" class="MCXref xref" xrefformat="{paratext}">Disable or Enable Ask Data for a Site</a>.</p>&#13; <p>Valid options are <code>disabled_by_default</code> and <code>disabled_always</code>.</p>&#13; <p>This option was added beginning with Tableau Server versions: 2019.4.5, 2020.1.3.</p>&#13; <h3 is="heading-item" :level="3" id="noninteractivevmopts"><a name="metadata_noninteractive"/>noninteractive.vmopts</h3>&#13; <p>Default value: <code>"-XX:+UseConcMarkSweepGC -Xmx&lt;default_value&gt;g -XX:+ExitOnOutOfMemoryError"</code></p>&#13; <p>The default value varies based on the amount of system memory. The JVM maximum heap size is scaled to be 6.25% of the total system RAM.</p>&#13; <p>This option controls the JVM maximum heap size for Tableau Catalog ingestion. Because the default value scales automatically, use this option to override the default value only when absolutely necessary by modifying the <code>-Xmx&lt;default_value&gt;g</code> argument. For example, you can use the following command to increase the max heap size to 2 GB:</p>&#13; <p><code>tsm configuration set -k noninteractive.vmopts -v "-XX:+UseConcMarkSweepGC -Xmx2g -XX:+ExitOnOutOfMemoryError"</code>&#13; <p>For more information, see <a href="dm_catalog_enable.htm#Memory" class="MCXref xref" xrefformat="{paratext}">Memory for non-interactive microservice containers</a>.</p>&#13; <h3 is="heading-item" :level="3" id="pgsqlport">pgsql.port</h3>&#13; <p>Default value: <code>8060</code></p>&#13; <p>Port that PostgreSQL listens on.</p>&#13; <h3 is="heading-item" :level="3" id="pgsqlpreferredhost">pgsql.preferred_host</h3>&#13; <p>Specifies the computer name of the node with the preferred repository installed. This value is used if the <code>--preferred</code> or <code>-r</code> option is specified with the <a href="cli_topology_tsm.htm#TSMFailoverRepository" class="MCXref xref" xrefformat="{paratext}">tsm topology failover-repository</a> command.</p>&#13; <p>Example:</p>&#13; <p><code>tsm configuration set -k pgsql.preferred_host -v "&lt;host_name&gt;"</code>&#13; <p class="note"><strong>Note:</strong> The <code>host_name</code> is case-sensitive and must match the node name shown in the output of <code>tsm status -v</code>. </p>&#13; <h3 is="heading-item" :level="3" id="pgsqlsslciphersuite"><a name="pgsql.ss"/>pgsql.ssl.ciphersuite</h3>&#13; <p>Default value: <code>HIGH:MEDIUM:!aNULL:!MD5:!RC4</code></p>&#13; <p>Specifies the cipher algorithms that are allowed for SSL for the Repository.</p>&#13; <p>For acceptable values and formatting requirements, see <a href="https://www.postgresql.org/docs/12/runtime-config-connection.html#GUC-SSL-CIPHERS" target="_blank">ssl_ciphers<span class="sr-only">(Link opens in a new window)</span></a> on the Postgres website.</p>&#13; <h3 is="heading-item" :level="3" id="pgsqlsslmaxprotocolversion"><a name="pgsql.ssl-max"/>pgsql.ssl.max_protocol_version</h3>&#13; <p>Default value:<code>TLSv1.3</code></p>&#13; <p>Sets the maximum SSL/TLS protocol version to use when connecting to the repository over SSL.</p>&#13; <p>Valid values: <code>TLSv1</code>, <code>TLSv1.1</code>, <code>TLSv1.2</code>, <code>TLSv1.3</code></p>&#13; <h3 is="heading-item" :level="3" id="pgsqlsslminprotocolversion"><a name="pgsql.ssl-min"/>pgsql.ssl.min_protocol_version</h3>&#13; <p>Default value:<code>TLSv1.2</code></p>&#13; <p>Sets the minimum SSL/TLS protocol version to use when connecting to the repository over SSL.</p>&#13; <p>Valid values: <code>TLSv1</code>, <code>TLSv1.1</code>, <code>TLSv1.2</code>, <code>TLSv1.3</code></p>&#13; <h3 is="heading-item" :level="3" id="pgsqlverifyrestoreport">pgsql.verify_restore.port</h3>&#13; <p>Default value: <code>8061</code></p>&#13; <p>Port used to verify the integrity of the PostgreSQL database. See <a href="cli_maintenance_tsm.htm#tsm" class="MCXref xref" xrefformat="{paratext}">tsm maintenance backup</a> for more information.</p>&#13; <h3 is="heading-item" :level="3" id="portsblocklist"><a name="portsBlocklist"/>ports.blocklist</h3>&#13; <p><strong>Version:</strong> Added in version 2021.1</p>&#13; <p>Default value: no ports blocked in the range used for automatic port assignment.</p>&#13; <p>Used to specify ports within the port assignment range that should not be used by Tableau when dynamically assigning ports. This is useful when you know that another application is using a port within the range. Separate multiple ports with commas, for example:</p><pre xml:space="preserve"><code>tsm configuration set -k ports.blocklist -v 8000,8089, 8090</code></pre>&#13; <p> For more information on using the <code>ports.blocklist</code> key, see <a href="ports.htm#PortsBlocked" class="MCXref xref" xrefformat="{paratext}">Blocking specific ports within the range</a></p>&#13; <h3 is="heading-item" :level="3" id="recommendationsenabled"><a name="recommendations"/>recommendations.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls the recommendations feature, which powers recommendations for data sources and tables (for Tableau Desktop) and recommendations for views (for Tableau Server). Recommendations are based on the popularity of content and on content used by other users determined to be similar to the current user.</p>&#13; <h3 is="heading-item" :level="3" id="recommendationsvizrecsenabled">recommendations.vizrecs.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls recommendations for views for Tableau Server users. This option is a child of <code>recommendations.enabled</code> and will have no effect if the parent option is set to false. When the parent option is set to true, and this option is set to false, data sources and tables will still be recommended to Tableau Desktop users, but recommendations for views on Tableau Server will be disabled. </p>&#13; <h3 is="heading-item" :level="3" id="redismaxmemoryinmb">redis.max_memory_in_mb</h3>&#13; <p>Default value: <code>1024</code></p>&#13; <p>Specifies the size in megabytes of the cache server external query cache.</p>&#13; <h3 is="heading-item" :level="3" id="refreshtokenabsoluteexpiryinseconds"><a name="refresh"/>refresh_token.absolute_expiry_in_seconds&#13; <p>Default value: <code>31536000</code></p>&#13; <p>Specifies the number of seconds for absolute expiration of refresh tokens and personal access tokens (PATs). </p>&#13; <p>Refresh tokens are used by connected clients (Tableau Desktop, Tableau Prep Builder, Tableau Mobile, etc.) for authentication to Tableau Server after initial sign-in. </p>&#13; <p>To remove limits set the value to <code>-1</code>. To disable refresh tokens and PATs, see <a href="devices_connected_credentials.htm" class="MCXref xref" xrefformat="{paratext}">Disable Automatic Client Authentication</a>.</p>&#13; <h3 is="heading-item" :level="3" id="refreshtokenidleexpiryinseconds">refresh_token.idle_expiry_in_seconds</h3>&#13; <p>Default value: <code>1209600</code></p>&#13; <p>Specifies the number of seconds when idle refresh tokens expire. The refresh tokens are used by connected clients (Tableau Desktop, Tableau Prep Builder, Tableau Mobile, etc.) for authentication to Tableau Server after initial sign-in. To remove limits set the value to <code>-1</code>.</p>&#13; <h3 is="heading-item" :level="3" id="refreshtokenmaxcountperuser">refresh_token.max_count_per_user</h3>&#13; <p>Default value: <code>24</code></p>&#13; <p>Specifies the maximum number of refresh tokens that can be issued for each user. If user sessions are expiring more quickly than you expect, either increase this value or set it to <code>-1</code> to entirely remove this refresh token limit.</p>&#13; <h3 is="heading-item" :level="3" id="rsynctimeout">rsync.timeout</h3>&#13; <p>Default value: <code>600</code></p>&#13; <p>Longest allowable time, in seconds, for completing file synchronization (600 seconds = 10 minutes). File synchronization occurs as part of configuring high availability, or moving the data engine and repository processes.</p>&#13; <h3 is="heading-item" :level="3" id="schedulesdisplayscheduledescriptionasname">schedules.display_schedule_description_as_name</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether a schedule name displays when creating a subscription or extract refresh (the default), or the "schedule frequency description" name describing the time and frequency of the schedule displays. To configure Tableau Server to display timezone-sensitive names for schedules, set this value to <code>true</code>.</p>&#13; <p>When true, the "schedule frequency description" is also displayed after the schedule name on the schedule list page.</p>&#13; <h3 is="heading-item" :level="3" id="schedulesdisplayschedulesinclienttimezone">schedules.display_schedules_in_client_timezone</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Shows the "schedule frequency description" in the timezone of the user when true (uses the client browser timezone to calculate the "schedule frequency description"). </p>&#13; <h3 is="heading-item" :level="3" id="schedulesignoreextracttaskpriority">schedules.ignore_extract_task_priority </h3>&#13; <p>Default value (boolean): <code>False</code></p>&#13; <p>This setting controls whether or not task priority is considered for determining the job rank which determines when to pull jobs off the queue. Setting this to <code>true </code>disables editing the task priority on tasks, and only schedule priority will be considered for determining the job rank. </p>&#13; <h3 is="heading-item" :level="3" id="searchserverconnectiontimeoutmilliseconds"><a name="searchserver_cx_timeout_ms"/>searchserver.connection_timeout_milliseconds</h3>&#13; <p><strong>Version:</strong> Added in version 2019.1.</p>&#13; <p>Default value, in milliseconds: <code>100000</code></p>&#13; <p>Specifies, in milliseconds, the amount of time Search &amp; Browse clients will wait to establish a connection to the Search &amp; Browse server. </p>&#13; <p>On especially busy Tableau Server computers, or if you see log errors "Failed zookeeper health check. Refusing to start SOLR." increase this value.</p>&#13; <p>For more information, see <a href="server_process_search-n-browse.htm#searchserverClient_session_timeouts" class="MCXref xref" xrefformat="{paratext}">Client session timeouts</a>.</p>&#13; <h3 is="heading-item" :level="3" id="searchserverindexbulkqueryusergroups">searchserver.index.bulk_query_user_groups</h3>&#13; <p><strong>Version:</strong> Deprecated in version 2022.3.</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Specifies whether querying of site users is done in bulk when importing or deleting users with a CSV file. When set to <code>true</code>(the default) indexing is done as in bulk.</p>&#13; <h3 is="heading-item" :level="3" id="searchserverjavamemopts"><a name="searchserver_javamemopts"/>searchserver.javamemopts</h3>&#13; <p><strong>Version: </strong>Added in version 2019.1.</p>&#13; <p>Default value: <code>-Xmx512m -Xms512m -XX:+ExitOnOutOfMemoryError -XX:-UsePerfData</code></p>&#13; <p>Determines JVM options for SOLR. </p>&#13; <p>Of all configurable options, the maximum heap memory, configured by the <code>-Xmx</code> parameter, is the most important when tuning the searchserver. In most cases this should be set as high as is possible, up to 24 GB, based on available physical memory on the Tableau Server computer. To change only the max heap memory, specify the entire default string but only change the value for <code>-Xmx</code>.</p>&#13; <p>Valid values for <code>-Xmx</code> depend on available memory on the Tableau Server computer, but cannot be greater than 24 GB. For more information, see <a href="server_process_search-n-browse.htm#searchserverMaxHeapMem" class="MCXref xref" xrefformat="{paratext}">Search &amp; Browse Max Heap Memory</a>.</p>&#13; <h3 is="heading-item" :level="3" id="searchserverstartupzookeeperhealthchecktimeoutms"><a name="searchserver_zk_healthchk"/>searchserver.startup.zookeeper_healthcheck_timeout_ms</h3>&#13; <p><strong>Version:</strong> Added in version 2020.1.</p>&#13; <p>Default value, in milliseconds: <code>300000</code></p>&#13; <p>Specifies, in milliseconds, the amount of time Tableau Server should wait for a successful Zookeeper health check on startup. </p>&#13; <p>On especially busy Tableau Server computers, or if you see log errors "Failed zookeeper health check. Refusing to start SOLR." increase this value.</p>&#13; <p>For more information, see <a href="server_process_search-n-browse.htm#searchserverZKhealth_chk_timeout" class="MCXref xref" xrefformat="{paratext}">Zookeeper connection health check timeout at startup</a>.</p>&#13; <h3 is="heading-item" :level="3" id="searchserverzookeepersessiontimeoutmilliseconds"><a name="searchserver_zk_sess_timeout_ms"/>searchserver.zookeeper_session_timeout_milliseconds</h3>&#13; <p>Default value, in milliseconds: <code>100000</code></p>&#13; <p>Specifies, in milliseconds, the amount of time Search &amp; Browse clients will wait to establish a connection to the Coordination Service (Zookeeper). </p>&#13; <p>For more information, see <a href="server_process_search-n-browse.htm#searchserverClient_session_timeouts" class="MCXref xref" xrefformat="{paratext}">Client session timeouts</a>.</p>&#13; <h3 is="heading-item" :level="3" id="serverexportcsvmaxrowsbycols">ServerExportCSVMaxRowsByCols</h3>&#13; <p><strong>Version: </strong>Added in version 2020.3.</p>&#13; <p>Default value: <code>0</code> (no limit)</p>&#13; <p>Specifies the maximum number of cells of data that can be downloaded from View Data into a CSV file. By default, there is no limit. Specify the number of cells. For example to set a limit of 3 million: </p><pre xml:space="preserve">tsm configuration set -k ServerExportCSVMaxRowsByCols -v 3000000 </pre><pre xml:space="preserve">tsm pending-changes apply</pre>&#13; <h3 is="heading-item" :level="3" id="servicejmxenabled"><a name="service_jmx_enabled"/>service.jmx_enabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Setting to <code>true</code> enables JMX ports for optional monitoring and troubleshooting.</p>&#13; <h3 is="heading-item" :level="3" id="servicemaxprocs">service.max_procs</h3>&#13; <p>Default value: &lt;number&gt;</p>&#13; <p>Maximum number of server processes.</p>&#13; <h3 is="heading-item" :level="3" id="serviceportremappingenabled">service.port_remapping.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Determines whether or not Tableau Server will attempt to dynamically remap ports when the default or configured ports are unavailable. Setting to <code>false</code> disables dynamic port remapping.</p>&#13; <h3 is="heading-item" :level="3" id="sessionipsticky">session.ipsticky</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Makes client sessions valid only for the IP address that was used to sign in. If a request is made from an IP address different from that associated with the session token, the session token is considered invalid.</p>&#13; <p>In certain circumstances—for example, when Tableau Server is being accessed by computers with known and static IP addresses—this setting can yield improved security.</p>&#13; <p class="note"><b>Note:</b> Consider carefully whether this setting will help your server security. This setting requires that the client have a unique IP address and an IP address that stays the same for the duration of the session. For example, different users who are behind a proxy might look like they have the same IP address (namely, the IP address of the proxy); in that case, one user might have access to another user's session. In other circumstances, users might have a dynamic IP address, and their address might change during the course of the session. If so, the user has to sign in again.</p>&#13; <h3 is="heading-item" :level="3" id="sheetimageenabled">sheet_image.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether you can get images for views with the REST API. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api_ref.htm#query_view_image">REST API Reference</a>.</p>&#13; <h3 is="heading-item" :level="3" id="sslciphersuite">ssl.ciphersuite</h3>&#13; <p>Default value: <code>HIGH:MEDIUM:!EXP:!aNULL:!MD5:!RC4:!3DES:!CAMELLIA:!IDEA:!SEED</code></p>&#13; <p>Specifies the cipher algorithms that are allowed for SSL for Gateway. </p>&#13; <p>For acceptable values and formatting requirements, see <a href="https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslciphersuite" target="_blank">SSLCipherSuite<span class="sr-only">(Link opens in a new window)</span></a> on the Apache website.</p>&#13; <h3 is="heading-item" :level="3" id="sslclientcertificateloginblocklistedsignaturealgorithms"><a name="ssl.clie"/>ssl.client_certificate_login.blocklisted_signature_algorithms</h3>&#13; <p>Default value:</p>&#13; <p>Version 2020.4.0: </p>&#13; <p><code>sha1withrsaencryption,<br/>sha1withrsa</code>&#13; <p>Version 2020.4.1 and later:</p>&#13; <p><code>sha1withrsaencryption,<br/>sha1withrsa,<br/>sha1withrsaandmgf1,<br/>sha1withdsa,<br/>sha1withecdsa</code>&#13; <p>The default value blocks certificates with the SHA-1 signing algorithm. Specifies the client signing algorithms that are blocked for SSL. To disable blocking of all signature algorithms, run this key with an empty set of quotes.</p>&#13; <p>For more information about this key, see the Knowledge Base article, <a href="https://kb.tableau.com/articles/Issue/mutual-ssl-fails-after-upgrading-if-certificates-signed-with-sha-1" target="_blank">Mutual SSL Fails After Upgrading if Certificates Signed with SHA-1<span class="sr-only">(Link opens in a new window)</span></a>. </p>&#13; <h3 is="heading-item" :level="3" id="sslclientcertificateloginminallowedellipticcurvesize">ssl.client_certificate_login.min_allowed.elliptic_curve_size</h3>&#13; <p>Default value: <code>256</code></p>&#13; <p>Specifies the minimum elliptic curve size required for ECDSA client certificates that are authenticating with Tableau Server over mutual SSL If a client presents an ECDSA client certificate that does not satisfy this minimum curve size, the authentication request will fail. </p>&#13; <p>This option was introduced in Tableau Server version 2021.1.</p>&#13; <h3 is="heading-item" :level="3" id="sslclientcertificateloginminallowedrsakeysize">ssl.client_certificate_login.min_allowed.rsa_key_size</h3>&#13; <p>Default value: <code>2048</code></p>&#13; <p>Specifies the minimum key size for RSA client certificates that are authenticating with Tableau Server over mutual SSL If a client presents an RSA client certificate that does not satisfy this minimum key size, the authentication request will fail. </p>&#13; <p>This option was introduced in Tableau Server version 2021.1.</p>&#13; <h3 is="heading-item" :level="3" id="sslprotocols">ssl.protocols</h3>&#13; <p>Default value: <code>all +TLSv1.2 -SSLv2 -SSLv3 -TLSv1.3</code></p>&#13; <p>Specifies the SSL protocols that Tableau Server supports for TLS connections for Gateway. Acceptable values derive from the <a href="https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslprotocol" target="_blank">Apache SSLPrtocol Directive<span class="sr-only">(Link opens in a new window)</span></a>. We recommend following SSL protocol configuration as described in <a href="security_harden.htm" class="MCXref xref" xrefformat="{paratext}">Security Hardening Checklist</a>.</p>&#13; <h3 is="heading-item" :level="3" id="storagemonitoringemailenabled">storage.monitoring.email_enabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether email notifications are enabled for server disk space monitoring. By default, email notifications are enabled. To enable notifications for disk space monitoring, set this to <code>true</code>.</p>&#13; <p>SMTP must be configured for notifications to be sent. For details, see <a href="config_smtp.htm" class="MCXref xref" xrefformat="{paratext}">Configure SMTP Setup</a>.</p>&#13; <h3 is="heading-item" :level="3" id="storagemonitoringwarningpercent">storage.monitoring.warning_percent</h3>&#13; <p>Default value: <code>20</code></p>&#13; <p>Warning threshold of remaining disk space, in percentage of total disk space. If disk space falls below this threshold, a warning notification is sent. </p>&#13; <h3 is="heading-item" :level="3" id="storagemonitoringcriticalpercent">storage.monitoring.critical_percent</h3>&#13; <p>Default value: <code>10</code></p>&#13; <p>Critical threshold of remaining disk space, in percentage of total disk space. If disk space falls below this threshold, a critical notification is sent. </p>&#13; <h3 is="heading-item" :level="3" id="storagemonitoringemailintervalmin">storage.monitoring.email_interval_min</h3>&#13; <p>Default value: <code>60</code></p>&#13; <p>How often, in minutes, that email notifications should be sent when disk space monitoring is enabled and a threshold is crossed.</p>&#13; <h3 is="heading-item" :level="3" id="storagemonitoringrecordhistoryenabled">storage.monitoring.record_history_enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Determines whether free disk space history is saved and available to view in Administrative Views. To disable history storage for monitoring, set <code>storage.monitoring.record_history_enabled</code> to <code>false</code>.</p>&#13; <h3 is="heading-item" :level="3" id="subscriptionsenabled">subscriptions.enabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether subscriptions are configurable system-wide. See <a href="subscribe.htm" class="MCXref xref" xrefformat="{paratext}">Set Up a Site for Subscriptions</a>.</p>&#13; <h3 is="heading-item" :level="3" id="subscriptionstimeout"><a name="subscriptions_timeout"/>subscriptions.timeout</h3>&#13; <p>Default value: <code>1800</code></p>&#13; <p>Length of time, in seconds, for a view in a workbook subscription task to be rendered before the task times out. If this time limit is reached while a view is being rendered, the rendering continues, <em>but any subsequent view in the workbook is not rendered</em>, and the job ends in error. In the case of a single-view workbook, this value will never result in the rendering being halted due to a timeout.</p>&#13; <h3 is="heading-item" :level="3" id="svcmonitornotificationsmtpenabled">svcmonitor.notification.smtp.enabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether email notifications are enabled for server process events. By default notifications are sent when processes go down, fail over, or restart. To enable server process notifications, set this to <code>true</code>.</p>&#13; <p>SMTP must be configured for notifications to be sent. For details, see <a href="config_smtp.htm" class="MCXref xref" xrefformat="{paratext}">Configure SMTP Setup</a>.</p>&#13; <h3 is="heading-item" :level="3" id="svcmonitornotificationsmtpmimeusemultipartmixed">svcmonitor.notification.smtp.mime_use_multipart_mixed</h3>&#13; <p><strong>Version:</strong> Added in version: 2020.1.8, 2020.2.5, 2020.3.1</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether subscription HTML MIME attachments are sent as <em>multipart/related</em> (the default) or <em>multipart/mixed</em>.</p>&#13; <p>In rare cases, email clients may not properly parse emails sent by Tableau Server. Many times this can be fixed by setting this property to <code>true</code>. Known clients include iOS Mail and Microsoft Outlook (when paired with Exchange S/MIME encryption).</p>&#13; <h3 is="heading-item" :level="3" id="tabadmincontrollerauthexpirationminutes"><a name="tabadminctrlrauthexpire"/>tabadmincontroller.auth.expiration.minutes</h3>&#13; <p>Default value: <code>120</code></p>&#13; <p>Controls how long session cookies are valid. By default this is set to 120 minutes. This value also determines how long the embedded credentials in a node bootstrap file are valid. For more information, see <a href="cli_topology_tsm.htm#TSMGetBootstrap" class="MCXref xref" xrefformat="{paratext}">tsm topology nodes get-bootstrap-file</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tdsserviceloglevel">tdsservice.log.level</h3>&#13; <p><strong>Version:</strong> Added in version 2020.3.0</p>&#13; <p>Default value: <code>info</code></p>&#13; <p>The logging level for the Data Source Properties service. This is dynamically configurable, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tomcathttpmaxrequestsize">tomcat.http.maxrequestsize</h3>&#13; <p>Default value: <code>16380</code></p>&#13; <p>The maximum size (bytes) of header content that is allowed to pass through the Apache gateway on HTTP requests. Headers that exceed the value set on this option will result in browser errors, such as HTTP Error 413 (Request Entity Too Large) or authentication failures.</p>&#13; <p> A low value for <code>tomcat.http.maxrequestsize</code> may result in authentication errors. Single sign-on solutions that integrate with Active Directory (SAML and Kerberos) often require large authentication tokens in HTTP headers. Be sure to test HTTP authentication scenarios before deploying into production. </p>&#13; <p>We recommend setting <code>gateway.http.request_size_limit</code> option to the same value that you set for this option.</p>&#13; <h3 is="heading-item" :level="3" id="tomcathttpproxyhost">tomcat.http.proxyHost</h3>&#13; <p>Specifies forward proxy host name for OpenID requests to the IdP. See <a href="openid_auth_server_config.htm" class="MCXref xref" xrefformat="{paratext}">Configure Tableau Server for OpenID Connect</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tomcathttpproxyport">tomcat.http.ProxyPort</h3>&#13; <p>Specifies forward proxy port for OpenID requests to the IdP. See <a href="openid_auth_server_config.htm" class="MCXref xref" xrefformat="{paratext}">Configure Tableau Server for OpenID Connect</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tomcathttpsproxyhost">tomcat.https.proxyHost</h3>&#13; <p>Specifies forward proxy host name for OpenID requests to the IdP. See <a href="openid_auth_server_config.htm" class="MCXref xref" xrefformat="{paratext}">Configure Tableau Server for OpenID Connect</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tomcathttpsproxyport">tomcat.https.ProxyPort</h3>&#13; <p>Specifies forward proxy port for OpenID requests to the IdP. See <a href="openid_auth_server_config.htm" class="MCXref xref" xrefformat="{paratext}">Configure Tableau Server for OpenID Connect</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tomcathttpsport">tomcat.https.port</h3>&#13; <p>Default value: <code>8443</code></p>&#13; <p>SSL port for Tomcat (unused).</p>&#13; <h3 is="heading-item" :level="3" id="tomcatserverport">tomcat.server.port</h3>&#13; <p>Default value: <code>8085</code></p>&#13; <p>Port that tomcat listens on for shutdown messages.</p>&#13; <h3 is="heading-item" :level="3" id="tomcatusesystemproxies">tomcat.useSystemProxies</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Specifies whether tomcat components (OpenID) require access to the forward proxy configuration on the local Windows operating system. See <a href="openid_auth_server_config.htm" class="MCXref xref" xrefformat="{paratext}">Configure Tableau Server for OpenID Connect</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tomcatcontainerloglevel">tomcatcontainer.log.level</h3>&#13; <p>Default value: <code>info</code></p>&#13; <p>The logging level for microservices in the Interactive Microservice Container and Non-Interactive Microservice Container. This is dynamically configurable starting in version 2020.4, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tsmloglevel">tsm.log.level</h3>&#13; <p>Default value: <code>info</code></p>&#13; <p>Logging level for TSM services. These logs include information that can be useful if you have problems with TSM services: Administration Agent, Administration Controller, Client File Service, Cluster Controller, Service Manager, and License Service. This configuration key does not change the logging level for Coordination Service or for maintenance processes. For more information, see <a href="logs_debug_level.htm#ChangeLoggingLevel" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a> and <a href="processes.htm" class="MCXref xref" xrefformat="{paratext}">Tableau Server Processes</a>.</p>&#13; <h3 is="heading-item" :level="3" id="tsmcontrolapploglevel">tsm.controlapp.log.level</h3>&#13; <p>Default value: <code>info</code></p>&#13; <p>Logging level for <code>control_&lt;app&gt;</code> services. These logs include information that can be useful if you are running into problems starting or reconfiguring a TSM or Tableau Server process. For more information, see <a href="logs_debug_level.htm#ChangeLoggingLevel" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="usernotificationsreapafterdays">usernotifications.reap_after_days</h3>&#13; <p>Default value: <code>30</code></p>&#13; <p>Number of days after which a user notification will be deleted from the server.</p>&#13; <h3 is="heading-item" :level="3" id="vizportaladsyncupdatesystemuser">vizportal.adsync.update_system_user</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Specifies whether email addresses and display names of users are changed (even when changed in Active Directory) when an Active Directory group is synchronized in Tableau Server. To ensure that user email addresses and display names are updated during synchronization, set <code>vizportal.adsync.update_system_user</code> to <code>true</code>, and then restart the server.</p>&#13; <h3 is="heading-item" :level="3" id="vizportalalwaysuseembeddedsharelinks"><a name="vizportalalwaysUseEmbeddedShareLinks"/>vizportal.alwaysUseEmbeddedShareLinks</h3>&#13; <p><strong>Version:</strong> Added in version 2021.3.0</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Specifies whether the <span class="uicontrol">Copy Link</span> option should include the "embed=y" parameter. Starting in version 2019.4, by default it does not include this parameter. Setting this configuration key to true changes the behavior so that the "embed=y" parameter is included. For details about using the <span class="uicontrol">Copy Link</span> option to share links for embedding in web pages, see <a href="https://help.tableau.com/current/pro/desktop/en-us/embed.htm" target="_blank">Embed Views into Webpages<span class="sr-only">(Link opens in a new window)</span></a> in the Tableau Desktop and Web Authoring Help.</p>&#13; <h3 is="heading-item" :level="3" id="vizportalcommentingdeleteenabled">vizportal.commenting.delete_enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>When set to <code>true</code>, lets users delete comments on views. You can delete a comment if you created it, are the content owner, a project leader with an appropriate site role, or are an administrator. To learn which site roles are required for full project leader access, see <a href="projects.htm#project-admin" class="MCXref xref" xrefformat="{paratext}">Project-level administration</a>.</p>&#13; <h3 is="heading-item" :level="3" id="vizportalcsvusermgmtindexsiteusers">vizportal.csv_user_mgmt.index_site_users</h3>&#13; <p><strong>Version:</strong> Deprecated in version 2022.3.</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>Specifies whether indexing of site users is done user by user when importing or deleting users with a CSV file. When set to <code>true</code>(the default) indexing is done as each user is added or deleted. To delay the indexing of the site users until after the entire CSV file has been processed, set this to <code>false</code>.</p>&#13; <h3 is="heading-item" :level="3" id="vizportalcsvusermgmtbulkindexusers">vizportal.csv_user_mgmt.bulk_index_users</h3>&#13; <p><strong>Version:</strong> Deprecated in version 2022.3.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Specifies whether indexing of site users is done in bulk when importing or deleting users with a CSV file. When set to <code>false</code>(the default) indexing is done individually. To have the indexing done in bulk after the CSV file has been processed, set this to <code>true</code>. </p>&#13; <h3 is="heading-item" :level="3" id="vizportalloglevel">vizportal.log.level</h3>&#13; <p>Default value: <code>info</code></p>&#13; <p data-mc-conditions="Product.serverwindows">The logging level for vizportal Java components. Logs are written to <code> C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizportal\*.log</code>.</p>&#13; <p>Set to <code>debug</code> for more information. Using the debug setting can significantly impact performance, so you should only use this setting when directed to do so by Tableau Support.</p>&#13; <p>Beginning with version 2020.4.0, this is dynamically configurable, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="vizportaloauthconnectedappsmaxexpirationperiodinminutes"><a name="connectedapps_max_expiration_period"/>vizportal.oauth.connected_apps.max_expiration_period_in_minutes</h3>&#13; <p><strong>Version:</strong> Added in version 2021.4.</p>&#13; <p>Default value: <code>10</code></p>&#13; <p>The maximum period of time, in minutes, the JSON web token (JWT) is valid. At the time the JWT is verified, Tableau Server checks that the time period specified in the JWT doesn’t exceed this default value. This setting is used when a Tableau connected app has been configured on Tableau Server using the <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_connected_app.htm" target="_blank">Tableau REST API<span class="sr-only">(Link opens in a new window)</span></a>.</p>&#13; <p>For example, to change maximum period to 5 minutes, run the following command:</p>&#13; <p><code>tsm configuration set -k vizportal.oauth.external_authorization_server.max_expiration_period_in_minutes -v 5</code>&#13; <h3 is="heading-item" :level="3" id="vizportaloauthexternalauthorizationenabled"><a name="eas_enable"/>vizportal.oauth.external_authorization.enabled</h3>&#13; <p><strong>Version:</strong> Added in version 2021.4.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Specifies whether the <span class="uicontrol">Enable OAuth Access for Embedding Content</span> option is enabled for Tableau Server. Use this option to register an external authorization server (EAS) with Tableau Server so that you can enable single sign-on (SSO) for embedded content in a custom application. For more information, see <a href="connected_apps_eas.htm" class="MCXref xref" xrefformat="{paratext}">Register EAS to Enable SSO for Embedded Content</a>.</p>&#13; <p>To enable this option, run the following command:</p>&#13; <p><code>tsm configuration set -k vizportal.oauth.external_authorization.enabled -v true</code>&#13; <h3 is="heading-item" :level="3" id="vizportaloauthexternalauthorizationserverblocklistedjwsalgorithms"><a name="eas_algorithms"/>vizportal.oauth.external_authorization_server.blocklisted_jws_algorithms</h3>&#13; <p><strong>Version:</strong> Added in version 2021.4.</p>&#13; <p>Default value: <code>ES256K</code></p>&#13; <p>When an external authorization server (EAS) is registered or connected app is configured, you can use this command to specify the signing algorithm used in JSON web token (JWT) header. For more information, see <a href="connected_apps_eas.htm" class="MCXref xref" xrefformat="{paratext}">Register EAS to Enable SSO for Embedded Content</a> or <a href="connected_apps.htm" class="MCXref xref" xrefformat="{paratext}">Configure Tableau Connected Apps to Enable SSO for Embedded Content </a>.</p>&#13; <p>For example, if needed, you might run the following command to remove the algorithm:</p>&#13; <p><code>tsm configuration set - k vizportal.oauth.external_authorization_server.blocklisted_jws_algorithms -v</code>&#13; <p><b>Important:</b> The example command above allows unsafe signing algorithms and should only be used to troubleshoot errors.</p>&#13; <h3 is="heading-item" :level="3" id="vizportaloauthexternalauthorizationserverissuer"><a name="eas_issuer"/>vizportal.oauth.external_authorization_server.issuer</h3>&#13; <p><strong>Version:</strong> Added in version 2021.4.</p>&#13; <p>Default value: <code>null</code></p>&#13; <p>Required. Use this command to specify the issuer URL. The issuer URL is required to register the external authorization server (EAS) with Tableau Server. For more information, see <a href="connected_apps_eas.htm" class="MCXref xref" xrefformat="{paratext}">Register EAS to Enable SSO for Embedded Content</a>.</p>&#13; <p>For example, if your EAS is Okta, you might run a command similar to the following:</p>&#13; <p><code>tsm configuration set -k vizportal.oauth.external_authorization_server.issuer -v "https://dev-12345678.okta.com/oauth2/abcdefg9abc8eFghi76j5"</code>&#13; <h3 is="heading-item" :level="3" id="vizportaloauthexternalauthorizationserverjwks"><a name="eas_jwks"/>vizportal.oauth.external_authorization_server.jwks</h3>&#13; <p><strong>Version:</strong> Added in version 2021.4.</p>&#13; <p>Default value: <code>null</code></p>&#13; <p>When an external authorization server (EAS) is registered, you can use this command to specify the JSON web key set (JWKS) URL. The JWKS URL is required if the identity provider (IdP) doesn’t expose the external authorization server metadata endpoint.</p>&#13; <p>For example, if your IdP is Amazon Cognito, you might run a command similar to the following:</p>&#13; <p><code>tsm configuration set -k vizportal.oauth.external_authorization_server.jwks -v "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_Ab129faBb/.well-known/jwks.json"</code>&#13; <h3 is="heading-item" :level="3" id="vizportaloauthexternalauthorizationservermaxexpirationperiodinminutes"><a name="eas_max_expiration_period"/>vizportal.oauth.external_authorization_server.max_expiration_period_in_minutes</h3>&#13; <p><strong>Version:</strong> Added in version 2021.4.</p>&#13; <p>Default value: <code>10</code></p>&#13; <p>The maximum period of time, in minutes, the JSON web token (JWT) is valid. At the time the JWT is verified, Tableau Server checks that the time period specified in the JWT doesn’t exceed this default value. This setting is used when an EAS has been registered with Tableau Server. For more information, see <a href="connected_apps_eas.htm" class="MCXref xref" xrefformat="{paratext}">Register EAS to Enable SSO for Embedded Content</a>.</p>&#13; <p>For example, to change maximum period to 5 minutes, run the following command:</p>&#13; <p><code>tsm configuration set -k vizportal.oauth.external_authorization_server.max_expiration_period_in_minutes -v 5</code>&#13; <h3 is="heading-item" :level="3" id="vizportalopenidclientauthentication">vizportal.openid.client_authentication</h3>&#13; <p>Specifies custom client authentication method for OpenID Connect.</p>&#13; <p>To configure Tableau Server to use the IdPs that require the <code>client_secret_post</code>, set this value to <code>client_secret_post</code>.</p>&#13; <p>An example would be when connecting to the Salesforce IDP, which requires this.</p>&#13; <h3 is="heading-item" :level="3" id="vizportalopenidessentialacrvalues">vizportal.openid.essential_acr_values</h3>&#13; <p><strong>Version:</strong> Added in version 2020.4.</p>&#13; <p>Specifies a list of authentication context class reference (ACR) values to provide the OpenID Connect IdP as an essential claim request. The IdP is responsible for ensuring that authentication meets the expected criteria. If the <code>vizportal.openid.essential_acr_values</code> configuration key is populated, Tableau Server acts as the relying party and will inspect the ACR claim in the token response. Tableau Server will only warn if the ACR claim doesn't match the expected configuration key value.</p>&#13; <p>To set this option, enter the ACR values in order of preference, enclosed by double-quotes. You must separate multiple values by a comma and space, as in this example:</p>&#13; <p><code>tsm configuration set -k vizportal.openid.essential_acr_values -v "value1, value2"</code>&#13; <h3 is="heading-item" :level="3" id="vizportalopenidfullserverrequestloggingenabled">vizportal.openid.full_server_request_logging_enabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Specifies whether to do full logging of OpenID activity. </p>&#13; <p>Set this to <code>true </code>when troubleshooting OpenID Connect issues to gather more detailed logs and allow you to better troubleshoot.</p>&#13; <p>As with all logging-related configurations, we recommend that after you are finished troubleshooting and collecting logs, you reset this key to its default (<code>false</code>). This limits the amount of information logged, and keeps the log file sizes to a minimum.</p>&#13; <h3 is="heading-item" :level="3" id="vizportalopenidvoluntaryacrvalues">vizportal.openid.voluntary_acr_values</h3>&#13; <p><strong>Version:</strong> Added in version 2020.4.</p>&#13; <p>Specifies a list of authentication context class reference (ACR) values to provide the OpenID Connect IdP as a voluntary claim request. The IdP is responsible for ensuring that authentication meets the expected criteria. If the <code>vizportal.openid.voluntary_acr_values</code> configuration key is populated, Tableau Server acts as the relying party and will inspect the ACR claim in the token response. The authentication request will fail if the ACR claim is missing or the provided claim value doesn't match the expected configuration key value.</p>&#13; <p>To set this option, enter the ACR values in order of preference, enclosed by double-quotes. You must separate multiple values by a comma and space, as in this example:</p>&#13; <p><code>tsm configuration set -k vizportal.openid.voluntary_acr_values -v "value1, value2"</code>&#13; <h3 is="heading-item" :level="3" id="vizportalrestapicorsalloworigin">vizportal.rest_api.cors.allow_origin</h3>&#13; <p>Specifies the origins (sites) that are allowed access to the REST API endpoints on Tableau Server when <code>vizportal.rest_api.cors.enabled</code> is set to <code>true</code>. You can specify more than one origin by separating each entry with a comma (,).</p>&#13; <p><code>tsm configuration set -k vizportal.rest_api.cors.allow_origin -v https://mysite, https://yoursite</code>&#13; <p> If <code>vizportal.rest_api.cors.enabled</code> is <code>false</code>, the origins listed by this option are ignored. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api_concepts_fundamentals.htm#Enabling">Enabling CORS on Tableau Server</a>. </p>&#13; <p class="note"><b>Note:</b> You can use an asterisk (<b>*</b>) as a wild card to match all sites. This is not recommended as it allows access from any origin that has access to the server and can present a security risk. Do not use an asterisk (<b>*</b>) unless you fully understand the implications and risks for your site.</p>&#13; <h3 is="heading-item" :level="3" id="vizportalrestapicorsenabled">vizportal.rest_api.cors.enabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether Tableau Server allows Cross Origin Resource Sharing (CORS). When set to <code>true</code>, the server allows web browsers to access the <a href="https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api_ref.htm">Tableau REST API</a> endpoints. You can use this option and the REST API to create custom portals. By default, this functionality is not enabled. To specify which origins (sites) have access, use the <code>vizportal.rest_api.cors.allow_origin</code> option. Only the origins specified with this option are allowed to make requests to the Tableau Server REST API. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api_concepts_fundamentals.htm#Enabling">Enabling CORS on Tableau Server</a>. </p>&#13; <h3 is="heading-item" :level="3" id="vizportalsiteusergroupcountenabled">vizportal.site_user_group_count_enabled</h3>&#13; <p><strong>Version:</strong> Added in version 2022.3.5 and later, 2023.1.0 and later.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether Site Users page will include a column showing the group count for each user. </p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverallowinsecurescripts">vizqlserver.allow_insecure_scripts</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Allows a workbook to be published to the server from Tableau Desktop, and to be opened from the server, even if the workbook contains SQL or R expressions that are potentially unsafe (for example, a SQL expression that could potentially allow SQL injection). When this setting is <code>false</code> (the default), publishing a workbook or opening it from the server results in an error message, and the workbook is blocked. Before you set this value to <code>true</code> review the Knowledge Base article, <a href="https://kb.tableau.com/articles/issue/blocking-or-allowing-insecure-scripts-in-tableau-server" target="_blank">Blocking or Allowing Insecure Scripts in Tableau Server<span class="sr-only">(Link opens in a new window)</span></a>.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverbrowserrender">vizqlserver.browser.render</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Views under the threshold set by <code>vizqlserver.browser.render_threshold</code> or <code>vizqlserver.browser.render_threshold_mobile</code> are rendered by the client web browser instead of by the server. See <a href="browser_rendering.htm" class="MCXref xref" xrefformat="{paratext}"> Configure Client-Side Rendering</a> for details.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverbrowserrenderthreshold">vizqlserver.browser.render_threshold</h3>&#13; <p>Default value: <code>100</code></p>&#13; <p>The default value represents a high level of complexity for a view displayed on a PC. Complexity factors include number of marks, headers, reference lines, and annotations. Views that exceed this level of complexity are rendered by the server instead of in the PC's web browser.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverbrowserrenderthresholdmobile">vizqlserver.browser.render_threshold_mobile</h3>&#13; <p>Default value: <code>60</code></p>&#13; <p>The default value represents a high level of complexity for a view displayed on a tablet. Complexity factors include number of marks, headers, reference lines, and annotations. Views that exceed this level of complexity are rendered by the server instead of in the tablet's web browser.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverclearsessiononunload">vizqlserver.clear_session_on_unload</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Determines whether or not VizQL sessions are kept in memory when a user navigates away from a view or closes their browser. The default value (false) keeps sessions in memory. To close VizQL sessions on leaving a view or closing a browser, set this to <code>true</code>.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverforcemapstooffline"><a name="vizqlserver_offlinemaps"/>vizqlserver.force_maps_to_offline</h3>&#13; <p><strong>Version:</strong> Added in version 2020.4.0.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>Determines whether Tableau Server runs in offline mode for maps. This is useful in disconnected environments where access to the internet and the map server is restricted. To enable offline mode for maps, set this value to <code>true</code>. For more information about installing and configuring Tableau Server in an environment without internet access, see <a href="install_air_gapped.htm" class="MCXref xref" xrefformat="{paratext}">Install Tableau Server in a Disconnected (Air-Gapped) Environment</a>.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlservergeosearchcachesize">vizqlserver.geosearch_cache_size</h3>&#13; <p>Default value: <code>5</code></p>&#13; <p>Sets the maximum number of different geographic search locale/language data sets that can be loaded into server memory at the same time. When the server receives a geographic search request for locale/language data set that is not in memory, it will load the set into memory. If loading the data set will exceed the specified limit, the least recently used locale/language data set is cleared from memory so the requested one can be loaded. The minimum value is 1. Each cache takes approximately 60 MB in memory (so if you set this to 10, the memory usage would be 600 MB (60 * 10).</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverinitialsqldisabled">vizqlserver.initialsql.disabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Specify whether to ignore initial SQL statements for all data sources. Set this to true to ignore initial SQL:</p><pre xml:space="preserve">tsm configuration set -k vizqlserver.initialsql.disabled -v true</pre>&#13; <h3 is="heading-item" :level="3" id="vizqlserverloglevel">vizqlserver.log.level</h3>&#13; <p>Default value: <code>info</code></p>&#13; <p data-mc-conditions="Product.serverwindows">The logging level for vizportal Java components. Logs are written to <code> C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\*.log</code>.</p>&#13; <p>Set to <code>debug</code> for more information. Using the debug setting can significantly impact performance, so you should only use it when directed to do so by Tableau Support.</p>&#13; <p>Beginning with version 2020.3.0, this is dynamically configurable, so if you are only changing this you do not have to restart Tableau Server. For more information, see <a href="logs_debug_level.htm" class="MCXref xref" xrefformat="{paratext}">Change Logging Levels</a>.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlservernumberofworkbookchangesbetweenautosaves">vizqlserver.NumberOfWorkbookChangesBetweenAutoSaves</h3>&#13; <p>Default value: <code>5</code></p>&#13; <p>Auto recover configuration for web authoring. Specifies the number of changes that a user must make to trigger auto save. Take care when changing this value. Auto recover functionality may impact the performance of web authoring and other viz-related operations on Tableau Server. We recommend tuning this value by making incremental adjustments over time.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlservernport">vizqlserver_&lt;n&gt;.port</h3>&#13; <p>The port a VizQL server instance (specified by "&lt;n&gt;") is running on.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverprotectsessions">vizqlserver.protect_sessions</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>When set to <code>true</code>, prevents VizQL sessions from being reused after the original user signs out.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverquerylimit">vizqlserver.querylimit</h3>&#13; <p>Default value: <code>1800</code></p>&#13; <p>Longest allowable time for updating a view, in seconds. 1800 seconds = 30 minutes. This configuration option impacts VizQL Server and Data Server.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverrecoveryattemptlimitpersession">vizqlserver.RecoveryAttemptLimitPerSession</h3>&#13; <p>Default value: <code>3</code></p>&#13; <p>Auto recover configuration for web authoring. The maximum number of attempts to recover the same session. Take care when changing this value. Auto recover functionality may impact the performance of web authoring and other viz-related operations on Tableau Server. We recommend tuning this value by making incremental adjustments over time.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserversessionexpiryminimum">vizqlserver.session.expiry.minimum</h3>&#13; <p>Default value: <code>5</code></p>&#13; <p>Number of minutes of idle time after which a VizQL session is eligible to be discarded if the VizQL process starts to run out of memory.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserversessionexpirytimeout">vizqlserver.session.expiry.timeout</h3>&#13; <p>Default value: <code>30</code></p>&#13; <p>Number of minutes of idle time after which a VizQL session is discarded.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserversheetimageapimaxagefloor">vizqlserver.sheet_image_api.max_age_floor</h3>&#13; <p>Default value: <code>1</code></p>&#13; <p>The amount of time, in minutes, to cache images that are generated by the Query View Image method of the REST API. For more information, see the <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#query_view_image" target="_blank">REST API Reference<span class="sr-only">(Link opens in a new window)</span></a> in the REST API help.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlservershowdownload">vizqlserver.showdownload</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls the display of the <span class="uicontrol">Tableau Workbook</span> option of the Download menu in views. When set to <code>false</code>, the Tableau Workbook option is unavailable.</p>&#13; <p class="note"><strong>Note:</strong> This setting does not remove the option for users in Web Edit mode.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlservershowshare">vizqlserver.showshare</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls the display of Share options in views. To hide these options, set to false.</p>&#13; <p class="note"><strong>Note:</strong> Users can override the server default by setting the "showShareOptions" JavaScript or URL parameter.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverurlschemewhitelist">vizqlserver.url_scheme_whitelist</h3>&#13; <p>Specifies one or more URL schemes to allow (safe list) when using <a href="https://help.tableau.com/current/pro/desktop/en-us/actions_url.htm" target="_blank">URL actions<span class="sr-only">(Link opens in a new window)</span></a> on views and dashboards. The schemes <code>http</code>, <code>https</code>, <code>gopher</code>, <code>mailto</code>, <code>news</code>, <code>sms</code>, <code>tel</code>, <code>tsc</code>, and <code>tsl</code> are allowed (safe listed) by default. This command can contain multiple comma and space-separated values, as in this example:</p>&#13; <p><code>tsm configuration set -k vizqlserver.url_scheme_whitelist -v scheme1, scheme2</code>&#13; <p>The values you specify overwrite previous settings. Therefore, you must include the full list of schemes in the <code>set</code> command. (You cannot amend the list of schemes by running the <code>set</code> command repeatedly.)</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverwebpageobjectsenabled">vizqlserver.web_page_objects_enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether Web Page objects in dashboards can display target URLs. To prevent web pages from appearing, set to false.</p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverworkbooktoolargetocheckpointsizekib">vizqlserver.WorkbookTooLargeToCheckpointSizeKiB</h3>&#13; <p>Default value: <code>5120</code></p>&#13; <p>Auto recover configuration for web authoring. Size limit (KB) for a workbook that will auto save. Workbooks larger than this value will not be auto-saved. Take care when changing this value. Auto recover functionality may impact the performance of web authoring and other viz-related operations on Tableau Server. We recommend tuning this value by making incremental adjustments over time.</p>&#13; <p><strong>Note:</strong> Older versions of Server use a default value: <code>1024</code></p>&#13; <h3 is="heading-item" :level="3" id="vizqlserverworkflowobjectsenabled">vizqlserver.workflow_objects_enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Determines whether the Tableau External Actions Workflow object can be added to dashboards.</p>&#13; <h3 is="heading-item" :level="3" id="webdataconnectorrefreshenabled">webdataconnector.refresh.enabled</h3>&#13; <p>Deprecated. Use <code><a href="cli_data-access.htm#web-data-connectors-allow">tsm data-access web-data-connectors allow</a></code> instead.</p>&#13; <p>Determines whether extract refreshes for web data connectors (WDCs) are enabled in Tableau Server. To disable refresh for all WDCs, set the value for this key to <code>false</code>, as shown below:</p>&#13; <p><code>tsm configuration set --key webdataconnector.refresh.enabled --value false</code>&#13; <p>To learn more, see <a href="datasource_wdc.htm">Web Data Connectors in Tableau Server</a>.</p>&#13; <h3 is="heading-item" :level="3" id="webdataconnectorwhitelistfixed">webdataconnector.whitelist.fixed</h3>&#13; <p>Deprecated. Use <code><a href="cli_data-access.htm#web-data-connectors-add">tsm data-access web-data-connectors add</a></code> instead.</p>&#13; <p>Specifies one or more web data connectors (WDCs) that can be used by to access data connections that are accessible over HTTP or HTTPS. This command is formatted as JSON data on a single line, with all double-quotes (") escaped using a backslash (\).</p>&#13; <p>For example to add a San Francisco Film Locations WDC to the safe list:</p>&#13; <p><code>tsm configuration set --key webdataconnector.whitelist.fixed --value "'{\"https://tableau.data.world:443\": {\"properties\": { \"secondary_whitelist\": [\"(https://data.world/)(.*)\"] } } }'"</code>&#13; <p>To learn more, see <a href="datasource_wdc.htm">Web Data Connectors in Tableau Server</a>.</p>&#13; <h3 is="heading-item" :level="3" id="webdataconnectorenabled">webdataconnector.enabled</h3>&#13; <p>Deprecated. Use <code><a href="cli_data-access.htm#web-data-connectors-allow">tsm data-access web-data-connectors allow</a></code> instead.</p>&#13; <p>Default value: <code>true</code></p>&#13; <p>When set to <code>true</code>, you can use <code>tsm</code> commands to manage web data connectors on the server.</p>&#13; <h3 is="heading-item" :level="3" id="webdataconnectorwhitelistmode">webdataconnector.whitelist.mode</h3>&#13; <p>Default value: <code>mixed</code></p>&#13; <p>Determines how Tableau Server can run web data connectors. Supported modes are:</p>&#13; <li value="1"><code>mixed</code>. Users can run connectors that are on an allowlist (safe list) of URLs. This mode originally also allowed users to run WDCs that had been imported. Importing WDCs is no longer supported.</li>&#13; <li value="2"><code>fixed</code>. Users can run connectors that are on an allowlist (safe list) of URLs.</li>&#13; <li value="3"><code>insecure</code>. Users can run any connector.</li>&#13; <p class="note"><b>Important:</b> Use the <code>insecure</code> option <i>only</i> for development and testing. Because connectors run custom code, running connectors that have not been vetted can pose a security threat.</p>&#13; <h3 is="heading-item" :level="3" id="wgserveraudithistoryexpirationdays"><a name="wgserver"/>wgserver.audit_history_expiration_days</h3>&#13; <p>Default value: <code>183</code></p>&#13; <p>Specifies the number of days after which historical events records are removed from the PostgreSQL database (the Tableau Server database).</p>&#13; <h3 is="heading-item" :level="3" id="wgserverauthenticationidentitypoolsdefaultpooldescription"><a name="initial_pool_description"/>wgserver.authentication.identity_pools.default_pool_description</h3>&#13; <p><b>Version:</b> Added in version 2023.1</p>&#13; <p>Default value: Null</p>&#13; <p>Optionally, you can add a description for the initial pool (TSM configured) to the Tableau Server landing page and is visible to all users. When one or more identity pools are created, this description is added below the primary sign-in option and can be used to help guide users that belong to the initial pool (TSM configured) to the correct sign-in option.</p>&#13; <p>For example, to add a “Regular employees sign in here” description, you can use the following command:</p>&#13; <p><code>tsm configuration set -k wgserver.authentication.identity_pools.default_pool_description -v “Regular employees sign in here"</code>&#13; <p><b>Note:</b> The initial pool (TSM configured) description is different from the <a href="maintenance_set.htm#sign_in_custom" class="MCXref xref" xrefformat="{paratext}">Sign In Customization</a> note. The Sign In Customization note is displayed on the Tableau Server landing page below all sign-in options and on the page where your initial pool (TSM configured) users enter their username and password.</p>&#13; <h3 is="heading-item" :level="3" id="wgserverchangeownerenabled">wgserver.change_owner.enabled</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether the ownership of a workbook, data source or project can be changed. Other options include <code>false</code> and <code>adminonly</code>.</p>&#13; <h3 is="heading-item" :level="3" id="wgserverclickjackdefenseenabled">wgserver.clickjack_defense.enabled</h3>&#13; <p> Default value: <code>true</code></p>&#13; <p>When set to <code>true</code>, helps prevents a malicious person from "clickjacking" a Tableau Server user. In a clickjack attack, the target page is displayed transparently over a second page, and the attacker gets the user to click or enter information in the target page while the user thinks he or she is interacting with the second page.</p>&#13; <p>For more information, see <a href="clickjack_protection.htm" class="MCXref xref" xrefformat="{paratext}">Clickjack Protection</a>.</p>&#13; <h3 is="heading-item" :level="3" id="wgserverdomainacceptlist"><a name="wgserver-domain-acceptlist"/>wgserver.domain.accept_list</h3>&#13; <p><strong>Version:</strong> This was added in version 2020.4.0 and replaces <code>wgserver.domain.whitelist</code>. </p>&#13; <p>Default value: null</p>&#13; <p>Allows connection from Tableau Server to secondary Active Directory domains. A secondary domain is one that Tableau Server connects to for user synchronization, but is a domain where Tableau Server is not installed. Tableau Server will attempt to connect to secondary domains for user and group synchronization. In some cases, Tableau Server may be unable to connect to the secondary domain, which will result in the error, "Domain not in accept list (errorCode=101015)."</p>&#13; <p>Setting the <code>wgserver.domain.accept_list</code> option is required by a fix for the security vulnerability, <a href="https://community.tableau.com/s/news/a0A4T000001v3SaUAI" target="_blank">[Important] ADV-2020-003: Tableau Server Forced Authentication<span class="sr-only">(Link opens in a new window)</span></a>. As of February 2020, the fix for this vulnerability is included in all latest versions and maintenance releases of Tableau Server.</p>&#13; <p>To set this option, enter the secondary domain enclosed by double-quotes. Multiple domains must be separated by a comma and a space. For example, <code>tsm configuration set -k wgserver.domain.accept_list -v "example.org, domain.com"</code>.</p>&#13; <p>Wildcard functionality is not supported. For example, if Tableau connects to <code>sub1.example.org</code> and <code>sub2.example.org</code>, then both domains must be added.</p>&#13; <p>Updating the <code>wgserver.domain.accept_list</code> option overwrites the existing value. Therefore, if you are adding a new domain to an existing set of domains stored in the value, include all existing domains with the new domain when you set the option. You can retrieve the full list of existing domains by running <code>tsm configuration get –k wgserver.domain.accept_list</code>.</p>&#13; <h3 is="heading-item" :level="3" id="wgserverdomainallowinsecureconnection"><a name="wgserver6"/>wgserver.domain.allow_insecure_connection </h3>&#13; <p>Default value: <code>False</code></p>&#13; <p>This setting only applies to Windows. This option specifies whether Tableau Server will connect to Active Directory over an unencrypted channel. The default value, <code>False</code>, enforces an encrypted channel. If the LDAP channel is not encrypted, then Tableau Server will not connect to Active Directory.</p>&#13; <p>Your Active Directory infrastructure should manage certificates and trust with domain-joined computers. As such, the channel communication between Tableau Server and Active Directory resources should be encrypted. We do not recommend allowing unencrypted communications with Active Directory, as this configuration is vulnerable to man-in-the-middle attacks.</p>&#13; <p>If you are upgrading to Tableau Server 2021.2 or later and your LDAP channel is not encrypted, upgrade will fail. You can run this command to allow an insecure connection on older versions of Tableau Server before you upgrade. If you are running this command on a version prior to 2021.2, you must include the <code>--force-keys</code> option with the command.</p>&#13; <h3 is="heading-item" :level="3" id="wgserverdomainfqdn">wgserver.domain.fqdn</h3>&#13; <p>Default value: value of <code>%USERDOMAIN%</code></p>&#13; <p>The fully qualified domain name of the Active Directory server to use.</p>&#13; <h3 is="heading-item" :level="3" id="wgserverdomainwhitelist"><a name="wgserver-domain"/>wgserver.domain.whitelist </h3>&#13; <p class="note"><strong>Important:</strong> This key has been deprecated as of version 2020.4.0. Use <code><a href="#wgserver-domain-acceptlist" class="MCXref xref" xrefformat="{paratext}">wgserver.domain.accept_list</a> </code> instead.</p>&#13; <p>Default value: null</p>&#13; <p>Allows connection from Tableau Server to secondary Active Directory domains. A secondary domain is one that Tableau Server connects to for user synchronization, but is a domain where Tableau Server is not installed. Tableau Server will attempt to connect to secondary domains for user and group synchronization. In some cases, Tableau Server may be unable to connect to the secondary domain, which will result in the error, "Domain not in whitelist (errorCode=101015)."</p>&#13; <h3 is="heading-item" :level="3" id="wgserverextendedtrustedipchecking">wgserver.extended_trusted_ip_checking</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Enforces IP client matching for trusted ticket requests.</p>&#13; <h3 is="heading-item" :level="3" id="wgserverrestrictoptionsmethod">wgserver.restrict_options_method</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>Controls whether Tableau Server accepts HTTP OPTIONS requests. If this option is set to <code>true</code>, the server returns HTTP 405 (Method Not Allowed) for HTTP OPTIONS requests.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversamlblocklisteddigestalgorithms"><a name="wgserver5"/>wgserver.saml.blocklisted_digest_algorithms</h3>&#13; <p><strong>Version:</strong> Added in version 2021.1.</p>&#13; <p>Default value: <code>SHA1</code></p>&#13; <p>Specifies the hashing algorithms that are not allowed for any relevant SAML certificate signatures or SAML assertion digest method or signature methods . When set, certificates or assertions that are signed &amp; hashed with a blocklisted algorithm will be rejected and fail.</p>&#13; <p>There are multiple places where SHA-1 could be used on both the Tableau and IdP side. For example:</p>&#13; <li value="1">Certificates uploaded with TSM that are used by Tableau Server to sign the request that is sent to the IdP.</li>&#13; <li value="2">Certificates in the IdP metadata used to verify the AuthnResponse (signature) received from the IdP using the public key in the Certificate.</li>&#13; <li value="3">Incoming assertions signed and hashed with SHA-1 (DigestMethod set to SHA-1 and SignatureMethod set to SHA-1).</li>&#13; <p>The default value was changed to (<code>SHA1</code> in Tableau Server 2021.2. For more information about upgrading to 2021.2 with SAML configured, see the Knowledge Base article, <a href="https://kb.tableau.com/articles/issue/tableau-server-using-saml-authentication-fails-to-start-or-rejects-login-after-upgrade-to-tableau-server-2021-2">Tableau Server Using SAML Authentication Fails to Start or Rejects Login After Upgrade to Tableau Server 2021.2</a>.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversamlforceauthn"><a name="wgserver-saml-forceauthn"/>wgserver.saml.forceauthn</h3>&#13; <p><strong>Version:</strong> Added in version 2019.3.</p>&#13; <p>Default value: <code>false</code></p>&#13; <p>When set to <code>true</code>, if the Tableau user session expires, Tableau Server will re-authenticate the user with the IdP. This option can also be used to ask the IdP to prompt the user for re-authentication, even if the user has an active IdP session.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversamlidpattributeusername">wgserver.saml.idpattribute.username</h3>&#13; <p>Specifies the name of the attribute in which your SAML IdP stores user names. By default, this is set to <code>username</code>. If the attribute name that your IdP uses contains spaces, enclose it in quotation marks. For more information, see <a href="config_saml.htm" class="MCXref xref" xrefformat="{paratext}">Configure Server-Wide SAML</a> or <a href="saml_site_specific.htm" class="MCXref xref" xrefformat="{paratext}">Configure Site-Specific SAML</a>.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversamliframedidpenabled">wgserver.saml.iframed_idp.enabled</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Default of false means that when users select the sign-in button on an embedded view, the IdP’s sign-in form opens in a pop-up window.</p>&#13; <p>When you set it to true, and a server SAML user who is already signed in navigates to a web page with an embedded view, the user will not need to sign in to see the view.</p>&#13; <p>You can set this to true only if the IdP supports signing in within an iframe. The iframe option is less secure than using a pop-up, so not all IdPs support it. If the IdP sign-in page implements clickjack protection, as most do, the sign-in page cannot display in an iframe, and the user cannot sign in.</p>&#13; <p>If your IdP does support signing in via an iframe, you might need to enable it explicitly. However, even if you can use this option, it disables Tableau Server clickjack protection for SAML, so it still presents a security risk.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversamlmaxassertiontime">wgserver.saml.maxassertiontime</h3>&#13; <p>Default value: <code>3000</code></p>&#13; <p>Specifies the maximum number of seconds, from creation, that a SAML assertion is usable.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversamlminallowedellipticcurvesize"><a name="wgserver2"/>wgserver.saml.min_allowed.elliptic_curve_size</h3>&#13; <p>Default value: <code>256</code></p>&#13; <p><strong>Version:</strong> Added in version 2021.1 but did not include a default value. In 2021.2, the default value was set to <code>256</code>.</p>&#13; <p>This option specifies the minimum allowed ECDSA curve size for the certificate used for SAML authentication. If you upload a certificate that has an ECDSA curve size less than 256, TSM will log an error when you apply changes. </p>&#13; <p>If you are upgrading to Tableau Server 2021.2 or later and your SAML certificate uses an ECDSA curve size less than 256, Tableau Server will not start after upgrading. We recommend uploading a new certificate with 256 (or larger) ECDSA curve size before upgrading. Alternatively, you can run this command to set a lower ECDSA curve size on older versions (pre-2021.1) of Tableau Server before you upgrade. If you are running this command on a version prior to 2021.1, you must include the <code>--force-keys</code> option with the command. For more information about upgrading to 2021.2 with SAML configured, see the Knowledge Base article, <a href="https://kb.tableau.com/articles/issue/tableau-server-using-saml-authentication-fails-to-start-or-rejects-login-after-upgrade-to-tableau-server-2021-2">Tableau Server Using SAML Authentication Fails to Start or Rejects Login After Upgrade to Tableau Server 2021.2</a>.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversamlminallowedrsakeysize"><a name="wgserver4"/>wgserver.saml.min_allowed.rsa_key_size</h3>&#13; <p>Default value: <code>2048</code></p>&#13; <p><strong>Version:</strong> Added in version 2021.1 but did not include a default value. In 2021.2, the default value was set to <code>2048</code>.</p>&#13; <p>This option specifies the minimum allowed RSA key length for the certificate used for SAML authentication. If you upload a certificate that has an RSA key length less than 2048, TSM will log an error when you apply changes. </p>&#13; <p>To run SAML authentication with a 1024 RSA key length (not recommended), set this value to <code>1024</code>.</p>&#13; <p>If you are upgrading to Tableau Server 2021.2 or later and your SAML certificate uses a key length less than 2048, Tableau Server will not start after upgrading. We recommend uploading a new certificate with 2048 (or larger) key length before upgrading. Alternatively, you can run this command to set a lower key strength on older versions (pre-2021.1) of Tableau Server before you upgrade. If you are running this command on a version prior to 2021.1, you must include the <code>--force-keys</code> option with the command. For more information about upgrading to 2021.2 with SAML configured, see the Knowledge Base article, <a href="https://kb.tableau.com/articles/issue/tableau-server-using-saml-authentication-fails-to-start-or-rejects-login-after-upgrade-to-tableau-server-2021-2">Tableau Server Using SAML Authentication Fails to Start or Rejects Login After Upgrade to Tableau Server 2021.2</a>.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversamlresponseskew">wgserver.saml.responseskew</h3>&#13; <p>Default value: <code>180</code></p>&#13; <p> Sets the maximum number of seconds difference between Tableau Server time and the time of the assertion creation (based on the IdP server time) that still allows the message to be processed. </p>&#13; <h3 is="heading-item" :level="3" id="wgserversamlsha256"><a name="wgserver3"/>wgserver.saml.sha256</h3>&#13; <p>Default value: <code>true</code></p>&#13; <p>When set to <code>true</code>, Tableau Server will hash message signatures and digests with SHA-256 in SAML assertions to the IdP. Set this option to <code>false</code> only if your IdP rejects assertions containing SHA-256 hashed content.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversessionapplylifetimelimit">wgserver.session.apply_lifetime_limit</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Controls whether there is a session lifetime for server sessions. Set this to <code>true</code>to configure a server session lifetime.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversessionidlelimit">wgserver.session.idle_limit</h3>&#13; <p>Default value: <code>240</code></p>&#13; <p>The number of minutes of idle time before a sign-in to the web application times out.</p>&#13; <h3 is="heading-item" :level="3" id="wgserversessionlifetimelimit">wgserver.session.lifetime_limit</h3>&#13; <p>Default value: <code>1440</code></p>&#13; <p>The number of minutes a server session lasts if a session lifetime is set. The default is 1440 minutes (24 hours). If <code>wgserver.session.apply_lifetime_limit</code> is <code>false</code> (the default) this is ignored.</p>&#13; <h3 is="heading-item" :level="3" id="wgserverunrestrictedticket">wgserver.unrestricted_ticket</h3>&#13; <p>Default value: <code>false</code></p>&#13; <p>Specifies whether to extend access to server resources for users authenticated by trusted tickets. Default behavior allows users to access views only. Setting this to <code>true</code> allows users with valid trusted tickets to access server resources (projects, workbooks, and so on) as if they had signed in using their credentials.</p>&#13; <h3 is="heading-item" :level="3" id="workerxgatewayport">workerX.gateway.port</h3>&#13; <p>Default value: <code>80 </code>(<code>443 </code>if SSL)</p>&#13; <p>External port that Apache listens on for workerX (where a “worker” is the term used for subsequent server nodes in the cluster). worker0.gateway.port is Tableau Server’s external port. In a distributed environment, worker0 is the initial Tableau Server node.</p>&#13; <h3 is="heading-item" :level="3" id="workerxvizqlserverprocs">workerX.vizqlserver.procs</h3>&#13; <p>Default value: &lt;number&gt;</p>&#13;