Trento provides a local permission-based user management feature with optional multi-factor authentication. This feature enables segregation of duties in the Trento interface and ensures that only authorized users with the right permissions can access it.

User management actions are performed in the Users view in the left-hand side panel of the Trento UI.

By default, a newly created user is granted display access rights except for the Users view. Where available, a user with default access can configure filters and pagination settings matching their preferences.

To perform protected actions, the user must have additional permissions added to their user profile. Below is the list of currently available permissions:

Using the described permissions, it is possible to create the following types of users:

The default admin user created during the installation process is granted all:all permissions and cannot be modified or deleted. Use it only to create the first user manager (a user with all:users permissions who creates all the other required users). Once a user with all:users permissions is created, the default admin user must be treated as a fallback user in case all other access to the console is lost. If the password of the default admin user is lost, it can be reset by updating the Helm chart or the web component configuration, depending on which deployment method was used to install Trento Server.

User passwords, including the default admin user password, must follow the rules below:

The Create User and Edit User views provide a built-in password generation button that allows user managers to easily generate secure and compliant passwords. The user manager must provide the user with their password through an authorized secure channel.

User managers may also set a preferred timezone for the account from the Create User and Edit User views. Individual users can configure their own preference later in the Profile view. The web console displays dates and times according to each user’s preferred timezone for presentation; if no preference is set, UTC is used. This preference affects only how timestamps are presented in the UI — backend storage, API payloads, logs and scheduled tasks continue to use UTC.

A user can reset their password in the Profile view. In this view, they can also update their name and email address as well as activate multi-factor authentication using an authenticator app. Multi-factor authentication increases the security of a user account by requesting a temporary second password or code when logging in the console. User managers can disable multi-factor authentication for any given user that has it enabled. However, user managers cannot enable multi-factor authentication on their behalf. The default admin user cannot enable its own multi-factor authentication.

User managers can enable and disable users. When a user logged in the console is disabled by a user admin, their session is terminated immediately.

Trento can be integrated for Single Sign-On (SSO) with a third-party identity provider (IDP).

The following protocols are supported:

Trento collects system events and user actions in the Activity Log. It records what happened in the monitored landscape and who triggered the event. With the Activity Log, you can discover health and heartbeat changes, host de-registrations, login attempts, user updates and more.

The Activity Log can be accessed from the left-hand side panel of the Trento console.

When the heartbeat of an agent fails, an option to clean-up the corresponding host is displayed in the Hosts overview and the corresponding Host details view.

Use the Clean up button to remove all the components discovered by the agent in the host (including the host itself and other components that might depend on the ones running on the host) from the console.

For example, when cleaning up the host where the primary application server of an SAP System is registered, the entire SAP System is removed from the console.

Similarly, when a registered application or SAP HANA instance is no longer discovered, an option to clean it up is displayed in the corresponding overview and the corresponding details view.

Use the Clean up button to remove the instance and any dependencies from the console.

For example, cleaning up the ASCS instance of an SAP system removes the entire SAP system from the console.

To preserve peak performance and manage disk space, administrators can optimize the storage used by Trento Server by adjusting data retention.

Several factors impact the amount of storage Trento Server uses, such as:

The event pruning feature allows administrators to manage how long registered events are stored in the database and how often the expired events are removed.

The following configuration options are available:

You can adjust the level of detail that Trento Server components write to their logs to manage disk space, capture more detailed information, for example for troubleshooting purposes, or to reduce log noise. The available log levels are debug, info, warning and error, and the default level is info for every component and deployment type. You can change log levels for Trento Web, Trento Wanda and Trento MCP Server.

Tags are used to label specific objects with location, owner, etc. The objects can be hosts, clusters, databases or SAP systems. Tags make it easier to distinguish and show all these different objects, making your lists more readable and searchable. You can use any text you like to create your tags except blank spaces and special characters other than + - = . , _ : and @.

The following subsection shows how you can add, remove, and filter objects based on your tags.

Communication from the Trento Agent to the Trento Server is secured by a API key that must be provided in the agent configuration file.

By default, the API key does not have an expiration date. You can set up a custom expiration date to increase the overall security of the setup and meet internal security requirements. If an expiration date is configured, it is displayed in the user’s timezone but stored in UTC.

To do this, go to the Settings view and click the Generate Key button in the API Key section:

Whenever a new key is generated, the configuration of all the reporting agents must be updated accordingly.

Trento allows users to create personal access tokens (PATs) for authentication and authorization purposes in third-party integrations with the APIs exposed by its components: