- Getting Started
- Requirements
- Best Practices
- Installation
- Updating
- Identity Server
- Troubleshooting startup errors
UiPath.Orchestrator.dll.config
UiPath.Orchestrator.dll.config
file (C:\Program Files (x86)\UiPath\Orchestrator
) defines the parameters, settings, and preferences applied to your Orchestrator deployment.
-
Any changes to the parameters in this file are overwritten upon upgrade.
-
Only administrators should change the values of these parameters.
-
It is recommended to manually restart the website after making changes to
UiPath.Orchestrator.dll.config
. -
Parameters that are not documented on this page should not be changed or have counterparts in the Settings pages.
-
All parameters are case sensitive.
EncryptionKeyPerTenant.Enabled
Enables you to use different encryption keys per tenant, based on a Microsoft Azure Key Vault account. The following values can be attributed:
false
- Uses a single encryption key on the entire Orchestrator instance. This is the default value.true
- Uses a different encryption key for each tenant, enhancing your tenant security and providing better segregation of sensitive data.
EncryptionKeyPerTenant.KeyProvider
parameter, as well as the ones in the SecureAppSettings section.
EncryptionKeyPerTenant.KeyProvider
AzureKeyVault
to use a preconfigured Microsoft Azure Key Vault. We do not provide Azure Key Vault licenses. Please note that you also have to configure the parameters described in the SecureAppSettings section. If EncryptionKeyPerTenant.Enabled
is set to false
, this parameter is not used.
Changes made to the encryption settings here need to be mirrored in the Identity Server appsettings.Production.json file, according to the following field equivalence:
Orchestrator UiPath.Orchestrator.dll.config |
Identity Server appsettings.Production.json |
---|---|
EncryptionKeyPerTenant.Enabled |
EncryptionKeyPerTenant |
Azure.KeyVault.VaultAddress |
AzureKeyVaultAddress |
Azure.KeyVault.CertificateThumbprint |
AzureKeyVaultCertificateThumbprint |
Azure.KeyVault.ClientId |
AzureKeyVaultClientId |
Azure.KeyVault.DirectoryId |
AzureKeyVaultDirectoryId |
EncryptionKeyPerTenant.KeyProvider |
MultiTenantEncryptionKeyProvider |
inProgressMaxNumberOfMinutes
The maximum amount of time queue items can have the In Progress status. After this time, the status of the queue items changes to Abandoned. By default, this is set to 1440 minutes (24 hours).
QueuesStatisticsScheduleCron
The frequency of updating queue items statistics in the Dashboard and Transactions page, and the Chart window. By default, they are updated every minute.
UpdateUncompletedItemsJobCron
The frequency of searching the database for queues that need to be moved to Abandoned. By default, this parameter is set to every hour.
Queue.MaxSlaInMinutes
UiPath.Orchestrator.dll.config
, including in update scenarios.
Queue.MaxSchemaFileSizeInKilobytes
UiPath.Orchestrator.dll.config
file.
Queue.SlaReadaheadTimeLimitHours
UiPath.Orchestrator.dll.config
.
Queue.MaxSpecificDataSizeInKiloBytes
The maximum size of Specific Data content for new queue items, in kilobytes. For clean Orchestrator installations, this parameter is hidden and has a default value of 1024 (1MB). In upgrade scenarios, this parameter is visible and has a value of 204800 (200MB).
Queue.ProcessActivationSchedule
The amount of time between checks for unprocessed queue items. By default, it is set to 30 minutes. To adjust the check interval, specify a value between 0 and 59, restart the IIS, then delete the existing queue trigger and recreate it.
DailyAlertMailJobCron
Enables you to configure a cron expression that controls when daily email alerts are sent. This only works if email alerts are enabled. The report contains all the Fatal and Error severity alerts generated the previous day. By default, it is sent every day at 7 a.m.
Alerts.Email.Enabled
false
by default. You can set it to true
to enable email alerts automatically for the tenant that you are about to create.
Once the tenant is created, however, any changes to this parameter are no longer taken into account. Instead, the setting can be toggled via the Enable Alerts Email check box from the Settings page. Details...
NotificationDistributerJobCron
The frequency with which alert notifications are sent to the interface. By default, alerts are sent every 10 seconds.
PeriodicErrorMailJobCron
Enables you to configure a cron expression that controls the frequency with which periodic email alerts are sent. This only works if email alerts are enabled. The default value is every 10 minutes, meaning the report contains Fatal and Error severity alerts generated in the past 10 minutes. If no alerts have been generated, no report is sent.
PasswordComplexity
Controls the validation rules for password complexity and is expressed using regular expressions. The complexity applies to all passwords (including the host admin one) by default. Still, each tenant can customize their user login password complexity on the Security tab in the Settings page. By default, passwords must contain at least 8 characters and at least one letter and a digit.
SystemJobs.DetectNotRespondingRobots.MaxAlertCount
<add key="SystemJobs.DetectNotRespondingRobots.MaxAlertCount" value="10" />
in the UiPath.Orchestrator.dll.config
file, under all the other alerts parameters. If you apply this setting, please note that a warning is raised in the Event
Viewer when the total number of alerts is higher than that of the one configured, such as: Alerts not published: total number of unresponsive sessions (21) is bigger than the configured max allowed (10).
.
SystemJobs.LicenseExpirationAlert.DaysBefore
180,90,30,14,7,1
, meaning you receive email alerts 6 times: 180, 90, 30, 14, 7, and 1 day before your license expires. You can define fewer
values to reduce the email alerts' frequency. For example, this can be done by adding the following key in the UiPath.Orchestrator.dll.config
file: <add key="SystemJobs.LicenseExpirationAlert.DaysBefore" value="90,30,14" />
.
Storage.Type
and Storage.Location
parameters.
Storage.Type
Defines the target where packages and execution media are saved. It can be populated with the following targets:
File System
-<add key="Storage.Type" value="FileSystem" />
.Azure
-<add key="Storage.Type" value="Azure" />
.Amazon
-<add key="Storage.Type" value="Amazon" />
.Minio
-<add key="Storage.Type" value="Minio" />
.
Storage.Location
Defines the actual location where packages and execution media are saved.
Storage.Location
parameter is mandatory when:
- upgrading from any pre-2020.10 version of Orchestrator, and
- the previous
NuGet.Repository.Type
wasLegacy
, and - the previous
NuGet.Packages.Path
did not use the default value.
Target |
Location |
---|---|
FileSystem |
Provide an absolute path using the following format:
RootPath=C:\FolderName\AnotherFolderName .
Example:
<add key="Storage.Location" value="RootPath=C:\FolderName\AnotherFolderName" /> .
In the provided folder, the following folder structure gets created: Orchestrator-Host\Libraries - One folder dedicated to the libraries stored in the host feed.
Orchestrator-[tenantKey] -One folder for each tenant. The tenant is identified by the tenant key as found in the database. For example Orchestrator-12ab1234-a567-456b-a12b-ab3456b123ab .
For each tenant folder, three other sub-directories are created:
Files are saved in the dedicated folders at the specified location. By default, they are stored at the following path:
C:\Program Files (x86)\UiPath\Orchestrator\Storage .
|
Azure |
Provide a connection string. Example:
<add key="Storage.Location" value="DefaultEndpointsProtocol=https;AccountName=usr;AccountKey=...;EndpointSuffix=core.windows.net"
/> .
|
Amazon |
Example:
<add key="Storage.Location" value="EndpointRegion=eu-west-3;accessKey=AKIAZGUEIGXUJ3BBI4MW;secretKey=W/LOzDbI1qumvcwYs8iUf4pRwW6ltKos/paTLVYM;useHttp=false"
/> .
Example:
<add key="Storage.Location" value="EndpointRegion=eu-west-3;accessKey=AKIAZGUEIGXUJ3BBI4MW;secretKey=W/LOzDbI1qumvcwYs8iUf4pRwW6ltKos/paTLVYM;useHttp=false;BlockPublicAccess=true"
/> .
Example:
<add key="Storage.Location" value="EndpointRegion=eu-west-3;UseDefaultCredentials=true" /> .
|
Minio |
Provide a connection string. Example:
<add key="Storage.Location" value="host=localhost:9001;accessKey=YVKYFJ0ZY246KDKP0634;secretKey=bdBEk2ubhIFsTNPuQ80PjKL+oqZBj67HoSWBFnw1"
/> .
|
Example
<add key=\"Storage.Type\" value=\"Azure\" /> <add key=\"Storage.Location\" value=\"DefaultEndpointsProtocol=https;AccountName=usr;AccountKey=...;EndpointSuffix=core.windows.net\" />
<add key=\"Storage.Type\" value=\"Azure\" /> <add key=\"Storage.Location\" value=\"DefaultEndpointsProtocol=https;AccountName=usr;AccountKey=...;EndpointSuffix=core.windows.net\" />
The configuration above instructs Orchestrator:
- to store the package metadata in the SQL database;
- to keep the actual files in the Azure Blob storage at the location indicated by the
DefaultEndpointsProtocol=https;AccountName=usr;AccountKey=...;EndpointSuffix=core.windows.net
connection string; -
to use the default naming convention for the Azure container name -
Orchestrator-tenantKey
.Important:If you have more than 99 tenants in Orchestrator, you have two options to avoid AWS S3 bucket account limit.
- Store your data in a single external bucket, as instructed in the following section.
- Increase your default AWS S3 bucket account limit to match the number of tenants.
This is required because a separate bucket is created for each tenant.
Storing Orchestrator data in a single external bucket
To use a single bucket with your own external storage provider, add the following parameters to the corresponding connection string:
BucketName
- mandatory. Enables Orchestrator to store all tenants in a single bucket. It requires the bucket name as set in your storage provider. For this, your external storage must exist prior to installing Orchestrator.CanCreateBucket
- optional. If set to true, it allows Orchestrator to create the bucket in your external storage on your behalf. The default value is false.
ContentPrefix
- optional. Specifies the path of your Orchestrator data inside the external storage. For example,orchestrator/data
.
Example: Using a single bucket with your own external storage provider
<add key="Storage.Location" value="DefaultEndpointsProtocol=https;AccountName=usr;AccountKey=...;EndpointSuffix=core.windows.net;BucketName=UiPath;ContentPrefix=orchestrator/data" />
<add key="Storage.Location" value="DefaultEndpointsProtocol=https;AccountName=usr;AccountKey=...;EndpointSuffix=core.windows.net;BucketName=UiPath;ContentPrefix=orchestrator/data" />
NuGet.Packages.ApiKey
NuGet.Activities.ApiKey
one. The default value is used in the initial seeding of the database. Please note that arbitrary strings are also accepted.
NuGet.Activities.ApiKey
NuGet.Packages.ApiKey
one. Please note that arbitrary strings are also accepted.
Package synchronization between multiple Orchestrator nodes and the interface can be done either by monitoring the file system or using Redis. This can be configured using the configuration below. The recommended way is through Redis.
Processes.AllowUpdateWithRunningJobs
Specifies whether you can delete a process while having running or pending jobs associated with it. Note that this parameter is hidden by default. The following values are available:
true
- Processes can be deleted while having associated running or pending jobs.false
- Processes cannot be deleted while having associated running or pending jobs. Trying to delete a process, in this case, displays the following error message: "Modifying this process is not possible at the moment, because there are active jobs associated with it. (#1666)". This is the default value.
<add key="Processes.AllowUpdateWithRunningJobs" value="true" />
in the UiPath.Orchestrator.dll.config
file.
Deployment.Libraries.AllowTenantPublish
Enables you to specify whether the tenants using the host feed can or cannot upload libraries into the feed. The following values are available:
true
- Libraries uploaded at the tenant level are propagated to the host feed. This is the default value.false
- Libraries uploaded at the tenant level are not propagated to the host feed. However, note that users do have access to the existing libraries in the feed.
You can configure this from the user interface as well. The corresponding option, Allow Tenant Users to Upload into the Feed, can be found at the host level, on the Settings page.
Buckets.ContentSecurityPolicy
UiPath.Orchestrator.dll.config
file.
Buckets.AvailableProviders
Used to control which providers can be used in creating storage buckets. The available providers are: Orchestrator, Amazon, Azure, Minio, S3 compatible storage providers, and File System. Multiple values can be entered with a comma separator.
UiPath.Orchestrator.dll.config
file, and only the following providers are selected: Orchestrator
, Amazon
, Azure
, Minio
and S3Compatible
. The default behavior is specific to both clean installations and upgrades. If the key is visible, the available providers
are limited to those specified as Buckets.AvailableProviders
values.
Example: To use only Orchestrator, Amazon and Azure as storage bucket providers, add the following key:
<add key="Buckets.AvailableProviders" value="Orchestrator,Amazon,Azure" />
<add key="Buckets.AvailableProviders" value="Orchestrator,Amazon,Azure" />
Buckets.FileSystem.Allowlist
Buckets.FileSystem.Allowlist
.
|
character, can be entered. Note that the paths must be fully qualified, either rooted with a drive or a UNC path (e.g. c:\
, c: est
, \\servershare\shared
), and each of them represents a prefix allowed to be used for any bucket. A bucket can be created on that particular path
or any subpath.
Buckets.FileSystem.Allowlist
setting has a series of security implications, you are strongly advised to refer to Using the FileSystem Storage Allowlist Securely before proceeding.
AcceptedRootUrls
,
), such as "https://server1,https://server2"
.
Auth.Bearer.Robot.Expire
The amount of time after which the bearer token of your Robot expires. By default, it is set to 30 minutes.
Auth.DisabledPermissions
<add key="Auth.DisabledPermissions" value="Machines.Delete,Libraries.Delete" />
.
Auth.AllowChangePassword
Enables you to configure whether a user can change their password via API. This setting is not displayed by default in the
UiPath.Orchestrator.dll.config
file. The available values are true
(default value) and false
.
Auth.AllowSelfEmailUpdate
true
, meaning you can update it. Set the parameter to false
to make the field read-only. This setting is not displayed by default in the UiPath.Orchestrator.dll.config
file.
ExternalAuth.AccessTokenAuth.Enabled
UiPath.Orchestrator.dll.config
file. The following values are available:
true
- The user can make authenticated requests using an access token issued by Auth0. This is only considered if you set a valid audience for theExternalAuth.AccessTokenAuth.Audience
parameter.false
- The user cannot make authenticated requests using an access token issued by Auth0. This is the default value.
ExternalAuth.AccessTokenAuth.Audience
<add key="ExternalAuth.AccessTokenAuth.Audience" value="https://cloud.uipath.com" />
. This setting is not displayed by default in the UiPath.Orchestrator.dll.config
file.
ExternalAuth.ShowPII
<add key="ExternalAuth.ShowPII" value="true" />
. The key is not displayed by default in UiPath.Orchestrator.dll.config
, and the default behavior does not allow for PII display.
RestrictBasicAuthentication
Moved to Identity Server appsettings.json.
EnableBasicAuthenticationForHostTenant
Moved to Identity Server appsettings.json.
These settings should only be modified if you are using a load balancer.
LoadBalancer.UseRedis
false
.
LoadBalancer.Redis.ConnectionString
LoadBalancer.UseRedis
is set to true
. A connection string that enables you to set up your Redis server, which contains the URL of the server, the password, and
the port used with Redis. All the HAA cluster nodes should be added in the connection string.
It is also possible to enable SSL encrypted connections between the Orchestrator nodes and the Redis service. For more information, please click here. Examples:
- with SSL enabled -
<add key="LoadBalancer.Redis.ConnectionString" value="10.10.20.184:10000,10.10.24.148:10000,10.10.22.114:10000,password=12345678,ssl=true" />
- without SSL enabled -
<add key="LoadBalancer.Redis.ConnectionString" value="10.10.20.184:10000,10.10.24.148:10000,10.10.22.114:10000,password=12345678" />
Plugins.SecureStores
\Orchestrator\Plugins
folder of your installation directory. For example:
- Single Store:
<add key="Plugins.SecureStores" value="UiPath.Orchestrator.CyberArk.dll"/>
-
Multiple Stores:
<add key="Plugins.SecureStores" value="UiPath.Orchestrator.CyberArk.dll;UiPath.Orchestrator.AzureKeyVault.SecureStore.dll;UiPath.Orchestrator.SecureStore.CyberArkCCP.dll;UiPath.Orchestrator.SecureStore.HashiCorpVault.dll;UiPath.Orchestrator.SecureStore.BeyondTrust.dll;UiPath.Orchestrator.SecureStore.AWSSecretsManager.dll" />
Note: When upgrading an Orchestrator instance with an existing CyberArk integration, this setting is pre-populated with the CyberArk plugin. For all other installations, the setting value is empty by default.
Plugins.SecureStores.CyberArk.CLIPasswordSDKExePath
CLIPasswordSDK64.exe
in a custom installation path. For example, if D:\CustomFolder\
is the CyberArk installation directory, you need to add the following key: <add key="Plugins.SecureStores.CyberArk.CLIPasswordSDKExePath" value="D:\CustomFolder\CLIPasswordSDK64.exe"/>
. The default value of this app setting is C:\Program Files (x86)\CyberArk\ApplicationPasswordSdk\CLIPasswordSDK64.exe
.
Plugins.SecureStores.CyberArk.UsePowerShellCLI
false
. Add the following key to enable it: <add key="Plugins.SecureStores.CyberArk.UsePowerShellCLI" value="true"/>
.
Plugins.SecureStores.CyberArkCCP.KeyStorageFlags
Enables choosing where to store and how to import the private key of the client certificate configured for a CyberArk CCP credential store.
DefaultKeySet
being the default option.
EphemeralKeySet
does not work on Windows machines. We
recommend using MachineKeySet
instead.
The configuration for Azure AD authentication has been moved to Identity Server's External Providers page.
The configuration for Active Directory authentication is performed post-installation from Orchestrator's Management portal.
For instructions, see Configuring the Active Directory integration page.
Logs.RobotLogs.ReadTarget
database
or robotelasticbuffer
).
RobotsLogs.Flush.Interval
UiPath.Orchestrator.dll.config
. Unless specified otherwise, its value is 0 seconds. The following example shows how to set a flush interval of 60 seconds,
which means that the Robot sends logs to the server every 60 seconds.
<add key="RobotsLogs.Flush.Interval" value="60" />
<add key="RobotsLogs.Flush.Interval" value="60" />
RobotsLogs.Flush.BatchSize
UiPath.Orchestrator.dll.config
. Unless specified otherwise, its value is 100 log message entries, which translates to the Robot sending batches of 100 logs
to the server.
<add key="RobotsLogs.Flush.BatchSize" value="100" />
<add key="RobotsLogs.Flush.BatchSize" value="100" />
Logs.RequestAbortedLogBehavior
Specifies the logging behavior for cancellation exceptions which are thrown upon cancellation of an operation that was executing. These are generated, for example, when you click a button, and before the operation is executed, you click a different one. Note that this parameter is hidden by default. The following values are available:
Ignore
- All cancellation exceptions are ignored if the corresponding requests were aborted. This is the default value.Info
- Cancellation exceptions are logged with Info severity level.None
- Cancellation exceptions are logged with Error severity level.
<add key="Logs.RequestAbortedLogBehavior" value="Ignore" />
in the config file.
Logs.Elasticsearch.SharedIndex
index
parameter in the NLog target. For example, <add key="Logs.Elasticsearch.SharedIndex" value="robotlogs" />
. Details here. Note that this parameter is hidden by default.
Logs.Elasticsearch.EnableFolderIdFilter
true
by default, meaning logs are hidden. Set it to false
to display them: <add key="Logs.Elasticsearch.EnableFolderIdFilter" value="false" />
Logs.Elasticsearch.Username
The username required for reading logs in Elasticsearch. Note that you need to configure this parameter only if Elasticsearch authentication is enabled, and you do not use an NLog target. When configuring the parameter, make sure its value matches the Elasticsearch server settings. For more details, see X-Pack Authentication.
Logs.Elasticsearch.Password
The username required for reading logs in Elasticsearch. Note that you need to configure this parameter only if Elasticsearch authentication is enabled, and you do not use an NLog target. When configuring the parameter, make sure its value matches the Elasticsearch server settings. For more details, see X-Pack Authentication.
Logs.Elasticsearch.OAuthEnabled
true
to enable OAuth2 and use a token-based authentication mechanism for reading robot logs in Elasticsearch, as an alternative
to the user and password system. By default, this parameter is set to false
.
When enabling OAuth authentication, you still need to provide the username and password as in the default authentication method. This is required because the initial token is generated based on those credentials.
See OAuth2 Authentication for detailed instructions on how to configure OAuth2 authentication for Elasticsearch.
Logs.Elasticsearch.OAuthExpireInSeconds
Enables you to set the time (in seconds) before the access token used for reading robot logs in Elasticsearch expires and is refreshed. Its default and recommended value is 1200 seconds (20 minutes), and its maximum value is 3600 seconds (60 minutes). To invalidate a token, you can use the dedicated button available in the Orchestrator UI.
Logs.Elasticsearch.OAuthEnabled
is set to true
and that you have properly configured the Elasticsearch server. For more on this, see OAuth2 Authentication.
Logs.Elasticsearch.DisableProductCheckStatus
true
.
false
.
disableProductCheckStatus
in the Nlog file, which is also hidden and false
by default. It must also be set to true
in order to enable the feature.
More webhooks settings are available in Webhooks AppSettings.json.
Webhooks.VerifyAvailability.Enabled
true
, meaning the feature is enabled.
Scalability.Heartbeat.PeriodSeconds
30
seconds.
Scalability.Heartbeat.FailureThreshold
4
, meaning that after 2 minutes of failed heartbeats (4 x 30 seconds = 2 minutes), a Robot is flagged as unresponsive.
Scalability.SignalR.Enabled
true
. This parameter is used in the initial seeding of the database. To make changes after installation, use the Settings page, at tenant or host level.
Scalability.SignalR.Transport
Specifies the transport protocol used to connect to Orchestrator's SignalR channels. The following values can be attributed (any combination bitwise OR):
- WebSocketTransport = 1
- ServerSentEventsTransport = 2
- LongPollingTransport = 4
- Default value: 7 (WebSocketTransport | ServerSentEventsTransport | LongPollingTransport)
This parameter is used in the initial seeding of the database. To make changes after installation, use the Settings page, at tenant or host level.
Scalability.AzureSignalR.ConnectionString
Helps you enable Azure SignalR Service, facilitating direct communication between your Robot fleet and the SignalR Service
Scalability.AzureSignalR.ConnectionCount
key. This parameter is enabled in our Cloud offering. It is not displayed by default in the UiPath.Orchestrator.dll.config
file.
<add key="Scalability.AzureSignalR.ConnectionString" value="Endpoint=https://test.signalr.net;AccessKey=M1ug+sBu07hyyi12AgyJ52SEd4OgC2Mm6BvllVHCC9c=;Version=1.0;"
/>
.
Scalability.AzureSignalR.ConnectionCount
5
. Example: <add key="Scalability.AzureSignalR.ConnectionCount" value="7" />
. This setting is not displayed by default and cannot be used without the Scalability.AzureSignalR.ConnectionString
key.
Scalability.SignalR.RequireStickySessions
true
, all transports are enabled, and Orchestrator assumes sticky sessions are enabled on the load balancer. Enabling sticky sessions
in UiPath.Orchestrator.dll.config
without enabling them on the load balancer will result in failed SignalR connections.
Telemetry.Enabled
Enables or disables the usage and performance data collection that UiPath uses to help diagnose problems and improve Orchestrator. For more details about UiPath’s privacy practices, please review the privacy statement. The following values are available:
true
- The telemetry feature is enabled. This is the default value.false
- The telemetry feature is disabled.
It is also possible to opt-in or out of the performance and usage data collection when you install or update your Orchestrator instance, as described here.
MediaRecording.Enabled
false
to disable the recording feature. By default, it is set to true
, meaning the feature is enabled. File storage is configured using the Storage.Type
and Storage.Location
parameters.
Pagination.Limits.Enabled
true
by default for Cloud Platform and clean installs of on-premise Orchestrator instances. Adds a default $top
value for all calls to API endpoints with pagination parameters (e.g. odata/Users
).
Triggers.DisableWhenFailedCount
Triggers.DisableWhenFailedCount
allows you to adjust the number of failed runs whereas Triggers.DisableWhenFailingSinceDays
enables you to change the number of days. By default, the Triggers.DisableWhenFailedCount
value is 10, and the Triggers.DisableWhenFailingSinceDays
value is 1, which means that the trigger is disabled after 10 unsuccessful attempts to launch if there were no successful
runs in the past day.
Triggers.DisableWhenFailedCount
to 0.
A trigger is automatically disabled if it experiences 10 consecutive failed launches and hasn't successfully launched in the past 24 hours.
Triggers.JobsCountStrategy
Enables you to choose the job count strategy for jobs launched through triggers. Hidden by default. The following options are available:
PerProcess
- A trigger launches the required number of jobs taking into account any pending jobs for the specified process. E.g., two triggers defined for the same process launch 3 and 5 jobs, respectively. If the first trigger launches 3 jobs at a given point in time, when the second trigger is set off, 2 jobs are launched so as to reach the 5 required jobs. Add the following key in the config file to use this strategy:<add key="Triggers.JobsCountStrategy" value="PerProcess" />
. This is the default value.PerTrigger
- A trigger launches the required number of jobs taking into account any existing jobs previously launched by that same trigger. E.g., a trigger is defined to launch 9 jobs at a given point in time. If 2 jobs have been successfully completed by the time this trigger is set off again, Orchestrator launches another 2 jobs so as to reach the 9 required jobs. Add the following key in the config file to use this strategy:<add key="Triggers.JobsCountStrategy" value="PerTrigger" />
.NoLimit
- The trigger launches the required number of jobs irrespective of any existing, pending jobs. E.g., a trigger is defined to launch 5 jobs at a given point in time. The second time the trigger is set off, another 5 jobs are launched. Add the following key in the config file to use this strategy:<add key="Triggers.JobsCountStrategy" value="NoLimit" />
.
Features.QueueTriggers.PendingJobsStrategy
Enables you to choose the computation method for the number of additional jobs to be triggered when new items are added to a queue. This is done by subtracting the number of jobs in a certain state from the maximum targeted number of jobs to be created.
The following options are available:
-
True
- This is the default option. It is best suited for cases where you want Orchestrator to assume that all running jobs have already moved queue items out of the status New.The number is computed as follows:
Maximum additional jobs to be created based on newly available queue items = the maximum number of pending and running jobs allowed simultaneously minus the number of jobs in a Pending state.
-
False
- This option is best suited for cases where you want Orchestrator to assume all running jobs have yet to move queue items out of the status New.The number is computed as follows:
Maximum additional jobs to be created based on newly available queue items = the maximum number of pending and running jobs allowed simultaneously minus the number of jobs in one of these states: Pending,Resumed,Running,Stopping,Terminating.
PreventAutoRefresh.Enabled
<add key="PreventAutoRefresh.Enabled" value="true" />
key can be added to restrict auto-refreshing of the page when jobs are running. The key is not displayed by default, and
the default value is false
meaning Orchestrator auto-refreshes the page for each new job.
PreventAutoRefresh.Enabled
parameter.
Features.ClassicFolders.Enabled
false
, meaning classic folders are disabled, and only modern folders are available. This parameter is hidden by default.
Jobs.TerminatingJobsTimeout
1440
, meaning jobs can't be marked as Failed unless they have been in a Terminating state for at least one day. This parameter
is hidden by default.
Jobs.TerminatingJobsCleanupCron
Jobs.TerminatingJobsTimeout
parameter. The default values are 0 0 0/3 1/1 * ? *
for Jobs.TerminatingJobsCleanupCron
, and 1440
for Jobs.TerminatingJobsTimeout
, meaning the background job runs once every three hours and only transitions to Failed the jobs that have been in a Terminating
state for at least one day. This parameter is hidden by default.
PW.StopExploringCron
0 25 * ? * *
meaning the background job runs at minute 25 of every hour. If they do not have the required permissions, the explore sessions
are terminated. This parameter is hidden by default.
Features.LongRunning.Enabled
<add key="Features.LongRunning.Enabled" value="true" />
.
Tasks.ModuleEnabled
<add key="Tasks.ModuleEnabled" value="true" />
. This setting makes the feature available at the instance level. To configure it on a per-tenant basis, follow the steps
here. The Features.LongRunning.Enabled
parameter needs to be set to true
for this setting to take effect.
Features.SmartCardAuthentication.Enabled
<add key="Features.SmartCardAuthentication.Enabled" value="true" />
.
OData.BackwardsCompatible.Enabled
true
, special characters in the body of requests and responses are parsed. By default, this parameter is hidden and set to false
.
NotRespondingRobotsJobStartDelay
UiPath.Orchestrator.dll.config
.
Upload.Queues.MaxNumberOfItems
15000
. Please note that this parameter is not displayed by default in UiPath.Orchestrator.dll.config
.
Processes.FilterOutDeleted
Enables you to optimize how Orchestrator retrieves processes. Optimization is achieved by removing unnecessary verifications for orphaned processes whose associated packages were deleted. This improves the overall performance of your instance, especially if it's a large deployment. The following values are available:
false
- Package retrieval is optimized; verifications are not performed for orphaned processes.true
- Package retrieval is not optimized.
true
by default, meaning process retrieval is not optimized.
CertificatesStoreLocation
<add key="CertificatesStoreLocation" value="LocalMachine" />
. Make sure that AzureKeyVaultCertificateStoreLocation
in appsettings.Production.json has the same value.
ProxyIntegration.Enabled
UiPath.Orchestrator.dll.config
, and its value is set to true
, which means that proxy integration is enabled unless otherwise specified. Use <add key="ProxyIntegration.Enabled" value="false"/>
to disable proxy integration.
The encryption key used to secure passwords in credential assets. If you are using an environment with a network load balancer, this key should be the same for all machines.
EncryptionKeyPerTenant.Enabled
is set to true
, and EncryptionKeyPerTenant.KeyProvider
set to AzureKeyVault
. Additionally, ensure that you provide all key, secret, and certificate permissions to your Orchestrator instance, in the
Access policies of your Azure Key Vault. For the full procedure, please see this page.
ae11aa1a-1234-1234-a123-a12a12aaa1aa
format. This setting is not displayed by default in the UiPath.Orchestrator.dll.config
file. Example: <add key="Azure.KeyVault.ClientId" value="ae11aa1a-1234-1234-a123-a12a12aaa1aa" />
.
UiPath.Orchestrator.dll.config
file. Example: <add key="Azure.KeyVault.CertificateThumbprint" value="1234123412341234123412341234124312341234" />
.
https://CustomVaultName.vault.azure.net/
format. This setting is not displayed by default in the UiPath.Orchestrator.dll.config
file. Example: <add key="Azure.KeyVault.VaultAddress" value="https://CustomVaultName.vault.azure.net/" />
.
This section contains settings for configuring S2S access tokens and Robot provisioning access tokens.
UiPath.Orchestrator.dll.config
:
IdentityServer.GroupMembershipCacheExpireHours
1
IdentityServer.Integration.Enabled
true
.
IdentityServer.Integration.Authority
https://Orchestrator/Identity
, where Orchestrator
is the installation address of your Orchestrator.
IdentityServer.Integration.ClientId
Enables you to set the application Id (Client Id) used to generate S2S access tokens registered inside Identity Server. The value is generated at install time.
IdentityServer.Integration.ClientSecret
Enables you to set the Client Secret for the Orchestrator S2S application to be recognized by Identity Server. The value is generated at install time.
IdentityServer.Integration.AccessTokenCacheBufferInSeconds
50
.
IdentityServer.Integration.UserOrchestratorApiAudience
OrchestratorApiUserAccess
.
<add key="IdentityServer.Integration.Enabled" value="true" />
<add key="IdentityServer.Integration.Authority" value="https://Orchestrator/Identity" />
<add key="IdentityServer.Integration.ClientId" value="orchestratorapiaccess" />
<add key="IdentityServer.Integration.ClientSecret" value="a5d57b1d-5b25-49ba-bff7-33aa57f96a58" />
<add key="IdentityServer.Integration.AccessTokenCacheBufferInSeconds" value="50" />
<add key="IdentityServer.Integration.UserOrchestratorApiAudience" value="OrchestratorApiUserAccess" />
<add key="IdentityServer.Integration.Enabled" value="true" />
<add key="IdentityServer.Integration.Authority" value="https://Orchestrator/Identity" />
<add key="IdentityServer.Integration.ClientId" value="orchestratorapiaccess" />
<add key="IdentityServer.Integration.ClientSecret" value="a5d57b1d-5b25-49ba-bff7-33aa57f96a58" />
<add key="IdentityServer.Integration.AccessTokenCacheBufferInSeconds" value="50" />
<add key="IdentityServer.Integration.UserOrchestratorApiAudience" value="OrchestratorApiUserAccess" />
UiPath.Orchestrator.dll.config
:
IdentityServer.Integration.S2SOrchestratorApiAudience
OrchestratorApiS2SAccess
.
UiPath.Orchestrator.dll.config
also contains the following pre-existent keys with their values set to true
:
MultiTenancy.AllowHostToAccessTenantApi
true
, it allows the host users to access other tenants' specific data. By default, the value is set to true
.
MultiTenancy.TenantResolvers.HttpGlobalIdHeaderEnabled
true
setting allows Orchestrator to identify the tenant by reading the tenant global id from the API's request header.
<add key="IdentityServer.Integration.S2SOrchestratorApiAudience" value="OrchestratorApiS2SAccess" />
<add key="MultiTenancy.AllowHostToAccessTenantApi" value="true" />
<add key="MultiTenancy.TenantResolvers.HttpGlobalIdHeaderEnabled" value="true" />
<add key="IdentityServer.Integration.S2SOrchestratorApiAudience" value="OrchestratorApiS2SAccess" />
<add key="MultiTenancy.AllowHostToAccessTenantApi" value="true" />
<add key="MultiTenancy.TenantResolvers.HttpGlobalIdHeaderEnabled" value="true" />
Orchestrator acts as a Token Generator for Robots. Robots call the Orchestrator endpoint to generate an access token. The access token is then passed to activities that can call different resources, such as AI Fabric. With the integration of Identity Service with Orchestrator, Identity Server takes over the access tokens' generation.
This section contains parameters for configuring the Update Server.
How often the client checks for updates. The default value is 180 minutes.
After how many minutes, a force update starts if the update has been postponed. The default value is 1440 minutes.
After how many minutes, a force update starts if the update has been postponed. This is specific to scheduled updates. The default value is 10 minutes.
How many times a failed update is retried. The default value is 3.
UiPath.Orchestrator.dll.config
key: <logger name="Robot.*" writeTo="database,robotElasticBuffer" final="true" />
. It is used to configure log messages generated by Robots. The following parameters have to be configured:
-
writeTo
- The location where log messages generated by the Robot are written. The following values are available:database
- Logs are sent to Orchestrator's SQL database. This is one of the default values.-
robotElasticBuffer
- Logs are sent to Elasticsearch. This is the second default value. Please remember this requires additional settings. Details here.Having logs sent both to the Orchestrator's SQL database and Elasticsearch enables you to have non-repudiation logs. Delete one of the values to stop logging to that location.
final
- A flag that indicates what to do when a match between a logged message and the logger name is found. When set totrue
, it does not look for another match. When set tofalse
, other rules matching the same source are checked. By default, it is set totrue
.
UiPath.Orchestrator.dll.config
key: <logger name="Monitoring.*" writeTo="monitoring" minlevel="Warn" final="true" />
. It is used to configure the error logs displayed on the Monitoring page. Please note if you remove this rule or alter the target
, no error logs will display on the Monitoring page.
UiPath.Orchestrator.dll.config
key: <logger name="BusinessException.*" minlevel="Info" writeTo="businessExceptionEventLog" final="true" />
. It is used to configure the logs for thrown business exceptions. For example validation issues (e.g Invalid username
) or business conflicts (e.g. License expired
).
UiPath.Orchestrator.dll.config
key: <logger name="*" minlevel="Info" writeTo="eventLog" />
. It is used to configure all other logs besides the ones described above, including those generated by Orchestrator.
Learn about additional settings.
The following NLog target must be populated according to your Elasticsearch configuration:
<target xsi:type="ElasticSearch" name="robotElastic" uri="<elasticSearch_url_1>,<elasticSearch_url_2>, <elasticSearch_url_3>" index="${event-properties:item=indexName}-${date:format=yyyy.MM}" documentType="logEvent" includeAllProperties="true" disablePing="true" layout="${message}" excludedProperties="agentSessionId,tenantId,organizationUnitId,indexName" />
<target xsi:type="ElasticSearch" name="robotElastic" uri="<elasticSearch_url_1>,<elasticSearch_url_2>, <elasticSearch_url_3>" index="${event-properties:item=indexName}-${date:format=yyyy.MM}" documentType="logEvent" includeAllProperties="true" disablePing="true" layout="${message}" excludedProperties="agentSessionId,tenantId,organizationUnitId,indexName" />
uri
- the Elasticsearch URL; note that you have to include the protocol and port, such ashttp://elastic_server:9200
. You can remove the need for a load balancer by populating this parameter with the Elasticseach URL of each node, such asuri="http://elastic-node1:9200,http://elastic-node2:9200,http://elastic-node3:9200"
.excludedProperties
- data that you do not want to be saved to Elasticsearch.index
- the format of the logging index, which can be either unique per tenant or shared across all tenants. Details below.requireAuth
- set totrue
to enable authentication when connecting Orchestrator to Elasticsearch.username
- specify the username used to log into Elasticsearch. You need to configure it ifrequireAuth
is set totrue
andOAuthEnabled
is set tofalse
.password
- specify the password used to log into Elasticsearch. You need to configure it ifrequireAuth
is set totrue
andOAuthEnabled
is set tofalse
.OAuthEnabled
- set this parameter totrue
to enable OAuth2 and use a token-based authentication mechanism for the Nlog target for Elasticsearch. When enabling this for the first time, you need to provide your current username and password to generate the initial token. For this parameter to take effect, you need to ensure thatLogs.Elasticsearch.OAuthEnabled
is also set totrue
and that you properly configured the Elasticsearch server. For more on this, see X-Pack Authentication.
- Individual Index -
index="${event-properties:item=indexName}-${date:format=yyyy.MM}"
A separate index is used for each tenant, meaning that logs specific to one tenant are generated and retrieved based on a unique tenant identifier, in this case,indexName
, which defaults to the name of the tenant. This is the default configuration. In this case, logs are generated per month. -
Shared Index -
index="robotlogs-${date:format=yyyy.MM.dd}"
One index is used for all tenants, meaning that all logs use the same index regardless of the tenant. In this case, logs are generated per day. To use a shared index, you are also required to add the following key inUiPath.Orchestrator.dll.config
:<add key="Logs.Elasticsearch.SharedIndex" value="robotlogs" />
. Make sure to set it to the same value as for theindex
parameter in the NLog target.Important: Logs generated using an individual index are kept if you shift to a shared index. However, logs generated using a shared index are lost if you shift to an individual one.
- The NLog target config section
name="robotElastic" index="robot-logs-${date:format=yyyy-MM}"
fromUiPath.Orchestrator.dll.config
. - The
LoggingIndex
record from the Orchestrator database’sdbo.Settings
table. Ensure the record matches the index pattern from the NLog target config (i.e.robot-logs-${date:format=yyyy-MM}
).
To store system event logs in the database rather than Event Viewer, follow these steps:
-
Create a new database table, for example:
CREATE TABLE [dbo].[EventLogs]( [Id] [bigint] IDENTITY(1,1) NOT NULL, [Timestamp] [datetime] NOT NULL, [Level] [int] NOT NULL, [Message] [nvarchar](max) NULL, [Exception] [nvarchar](max) NULL)
CREATE TABLE [dbo].[EventLogs]( [Id] [bigint] IDENTITY(1,1) NOT NULL, [Timestamp] [datetime] NOT NULL, [Level] [int] NOT NULL, [Message] [nvarchar](max) NULL, [Exception] [nvarchar](max) NULL)In the above query, we create a table namedEventLogs
with the following columns:Id
- to hold an ID number for each log, here starting with1
and incrementing the value with each log added;Timestamp
- to hold the time each event was logged;Level
- to hold the numerical logging level of each event;Message
- to hold the message of each event, if applicable;-
Exception
- to hold the exception logged for each event, if applicable.Note: You can use any name for your table, and remove any columns from the above query or add others to suit your needs.
-
In the
UiPath.Orchestrator.dll.config
file, add a new NLog target:<target xsi:type="Database" connectionString="${ui-connection-strings:item=Default}" name="eventLogDatabase" keepConnection="true"> <commandText> INSERT INTO dbo.EventLogs (Timestamp, Level, Message, Exception) VALUES (@timestamp, @level, @message, @exception) </commandText> <parameter name="@timestamp" layout="${date:format=yyyy-MM-dd HH\:mm\:ss.fff}" /> <parameter name="@level" layout="${event-properties:item=levelOrdinal}" /> <parameter name="@message" layout="${message}" /> <parameter name="@exception" layout="${onexception:${exception:format=tostring:maxInnerExceptionLevel=5:innerFormat=tostring}}" /> </target>
<target xsi:type="Database" connectionString="${ui-connection-strings:item=Default}" name="eventLogDatabase" keepConnection="true"> <commandText> INSERT INTO dbo.EventLogs (Timestamp, Level, Message, Exception) VALUES (@timestamp, @level, @message, @exception) </commandText> <parameter name="@timestamp" layout="${date:format=yyyy-MM-dd HH\:mm\:ss.fff}" /> <parameter name="@level" layout="${event-properties:item=levelOrdinal}" /> <parameter name="@message" layout="${message}" /> <parameter name="@exception" layout="${onexception:${exception:format=tostring:maxInnerExceptionLevel=5:innerFormat=tostring}}" /> </target>Defining a correspondingparameter
for the data to be added in each database column, in this example@timestamp
,@level
,@message
, and@exception
. -
Lastly, associate the newly created target with the NLog logger classification for all Orchestrator messages, from above, by adding:
<logger name="*" minlevel="Info" writeTo="eventLog,eventLogDatabase" />
<logger name="*" minlevel="Info" writeTo="eventLog,eventLogDatabase" />
NLog is an open-source, easily configured, and extensible logging platform for a variety of .NET platforms. With NLog, you can store or pass log data to any number of predefined or custom targets, such as a local file, an event log, email, or database.
Trace
, Debug
, Info
, Warn
, Error
, Fatal
, or Off
. See
Logging Levels
for a description of the available levels in Orchestrator.
Off
, it is enabled by configuring the following section of the UiPath.Orchestrator.dll.config
file:
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" autoReload="true" throwExceptions="false" internalLogLevel="Off" internalLogFile="">
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" autoReload="true" throwExceptions="false" internalLogLevel="Off" internalLogFile="">
The attributes which must be set are:
-
internalLogLevel
- the desired logging level -
internalLogFile
- the location of the log file
For example:
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" autoReload="true" throwExceptions="false" internalLogLevel="Debug" internalLogFile="C:\logs.txt">
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" autoReload="true" throwExceptions="false" internalLogLevel="Debug" internalLogFile="C:\logs.txt">
internalLogFile
attribute.
Features.Queues.QueryUseReadOnlyReplica
true
if you want to allow querying the read-only replica
for queue items.
false
.
Monitoring.UseReadOnlyReplica
true
if you want to retrieve monitoring data from the
read-only replica.
false
.
- App Settings
- Advanced Installation Settings
- Queues
- Alerts
- Deployment
- Storage Buckets
- Authorization
- Load Balancer
- Password Vault
- Azure AD Authentication
- Active Directory Authentication
- Logs
- Webhooks
- Scalability
- Analytics
- Media Recording
- Pagination
- Triggers
- Others
- SecureAppSettings
EncryptionKey
Azure.KeyVault.ClientId
Azure.KeyVault.CertificateThumbprint
Azure.KeyVault.VaultAddress
Azure.KeyVault.DirectoryId
- Identity Server Settings
- Integration
- Robot Provisioning Access Tokens
- Update Server Settings
UpdateServer.CheckUpdates.PollingInterval
UpdateServer.CheckUpdates.DefaultForceInstallAfterMinutes
UpdateServer.CheckUpdates.ScheduledForceInstallAfterMinutes
UpdateServer.CheckUpdates.MaxRetries
UpdateServer.UpdateRequest.RetryStepMinutes
- Logging Configuration
- Robot Logs
- Monitoring Logs
- Business Exception Logs
- Other Logs
- Additional Settings
- Elasticsearch
- Index Configuration
- Logging Events in the Database
- Enabling NLog Debugging
- Orchestrator read-only replica