> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prometheus

> Let agents run PromQL, see firing alerts and find scrape targets that are down

The Prometheus connector works with Prometheus and with anything that answers the same queries: Thanos Query, Grafana Mimir, Cortex and VictoriaMetrics.

## Tools

| Tool                | What it returns                                                                                                          |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **Test Connection** | Server version, whether it is ready, a trivial query's success, and a warning when a public server has no authentication |
| **Instant Query**   | Each series' labels and value for a PromQL expression at one moment (now by default)                                     |
| **Range Query**     | Each series' labels, `[time, value]` points and min, max, avg and last over a time range                                 |
| **Alerts**          | Firing and pending alerts with labels, annotations, since when and the current value                                     |
| **Targets**         | Scrape targets with job, instance, health, last error and last scrape time, down targets first                           |
| **Metric Names**    | Metric names the server knows, filtered by text or a series selector                                                     |

## Safety

* **Read-only.** PromQL cannot write, and the connector only calls the query, alert, target and label endpoints. The admin endpoints (`/api/v1/admin/tsdb/*`) are never called.
* **Bounded range queries.** The step defaults to about 500 points per series and is raised automatically so no series has more than 11,000 points. Results stop at 500 series (up to 5,000 with `max_rows`) and 1,000 points per series (`max_points`, keeping the most recent).
* **Limits on every call.** 15 s timeout by default (up to 55 s with `timeout_seconds`), passed to Prometheus as the query timeout too. A cut result has `truncated: true`.
* **No redirects, no private hosts.** A direct connection only reaches public addresses, is pinned to the address that was checked, and never follows a redirect.
* **No secrets in results.** The bearer token or password is removed from every error message.

## Put Prometheus behind authentication

Prometheus has no users of its own, so anything that can reach it can query it. Pick one of:

* **An authenticating reverse proxy** in front of Prometheus (nginx, Caddy, oauth2-proxy), or Prometheus' own `--web.config.file` with `basic_auth_users`. Store the username and password (or the bearer token) on the connection.
* **An SSH bastion or the data-plane agent**, keeping Prometheus on a private address.
* **A managed service's own credentials:** Grafana Cloud Prometheus (the instance ID as username, a Cloud access policy token with `metrics:read` as password), or Mimir behind your gateway with a tenant ID.

Test Connection warns when a public server answers without authentication.

## Connect

Open **Prometheus** in the dashboard's tool catalog and click **Connect**, or let the agent call `store_credential`. Fill in the base URL (without `/api/v1`) and the authentication. For Mimir, Cortex or a multi-tenant setup, set **Tenant ID**; it is sent as `X-Scope-OrgID`.

<Tabs>
  <Tab title="Public URL">
    A Prometheus behind an authenticating proxy, or a managed service, connects directly. Allow Danube's egress addresses in the firewall: see [Connect your production database safely](/connectors/production-database#allowlist-danubes-addresses). For a self-signed certificate, paste the CA bundle into **CA certificate**.
  </Tab>

  <Tab title="Private network, SSH bastion">
    Fill in the **SSH bastion** fields: the bastion's public host, user, private key and host key fingerprint. Set the URL to the address the bastion reaches, such as `http://prometheus.monitoring.svc:9090`. Danube verifies the bastion's host key and never trusts a new key on first use.
  </Tab>

  <Tab title="Private network, data-plane agent">
    Run the [data-plane agent](/organizations/data-plane) inside the cluster or network and store any secret as a reference, for example `env://PROM_TOKEN`. The call runs on the agent, and nothing inbound is opened.
  </Tab>
</Tabs>

Run **Test Connection** after saving. It tells you which of these failed: the credentials (`auth_required`), the network (`connection_error`, `destination_blocked`) or TLS (`tls_error`).

## Example prompts

* "Which alerts are firing, and since when?"
* "Which scrape targets are down, and what error do they report?"
* "Chart p99 latency for the `api` job over the last 6 hours and tell me when it crossed 500 ms."
* "Which pods used the most memory in the last hour?"
* "Find the metric that counts HTTP requests for the checkout service."