Fresh install PMM3 and face Login failed Invalid username or password

Percona Monitoring and Management (PMM)
1

Description:

Login failed Invalid username or password after fresh install of PMM3 with default login user admin/admin

Steps to Reproduce:

[Step-by-step instructions on how to reproduce the issue, including any specific settings or configurations]

Version:

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
a53bc7480452 percona/watchtower “/watchtower --clean…” About a minute ago Up About a minute (healthy) 8080/tcp watchtower
8ac3d7117011 percona/pmm-server:3 “/opt/entrypoint.sh” 2 minutes ago Up 2 minutes (healthy) 8080/tcp, 0.0.0.0:443->8443/tcp, :::443->8443/tcp pmm-server

Logs:

[If applicable, include any relevant log files or error messages]

Expected Result:

[What the user expected to see or happen before the issue occurred]

Actual Result:

[What actually happened when the user encountered the issue]

Additional Information:

[Include any additional information that could be helpful to diagnose the issue, such as browser or device information]

3

@suresh From Inside the docker container can you please check the grafana logs (/srv/logs/ grafana.log) if they telling any crucial information.

You can find all the PMM related logs inside your PMM container.

docker exec -it pmm-server bash

cd /srv/logs

Let’s try resetting the password again - https://www.percona.com/blog/changing-the-default-admin-password-in-docker-based-deployment-of-pmm2/

If it still not work then restart the grafana OR all component service. Run these commands from the PMM container.

 supervisorctl restart grafana

 supervisorctl restart all
4

Hi Anil,

/srv/logs/ grafana.log
logger=context userId=0 orgId=0 uname= t=2025-07-31T13:10:30.27458827Z level=info msg=“Request Completed” method=GET path=/api/auth/serviceaccount status=400 remote_addr=127.0.0.1 time_ms=0 duration=847.838µs size=54 referer= handler=/api/auth/serviceaccount/ status_source=server error=“failed to get service account info”
logger=authn.service t=2025-07-31T13:10:30.277564118Z level=warn msg=“Failed to authenticate request” client=auth.client.api-key error=“invalid Service Token/API key”
logger=context userId=0 orgId=0 uname= t=2025-07-31T13:10:30.277824035Z level=info msg=“Request Completed” method=GET path=/api/auth/serviceaccount status=400 remote_addr=127.0.0.1 time_ms=0 duration=736.191µs size=54 referer= handler=/api/auth/serviceaccount/ status_source=server error="failed to get service account info

**I reset the password but it still doesn’t work also restarted **

password change command used
docker exec -t pmm-server bash -c ‘grafana-cli --homepath /usr/share/grafana --configOverrides cfg:default.paths.data=/srv/grafana admin reset-admin-password newpass’

INFO [07-31|13:11:55] Executing migration logger=migrator id=“cleanup alert_rule_version table”
INFO [07-31|13:11:55] Rule version record limit is not set, fallback to 100 logger=migrator limit=0
INFO [07-31|13:11:55] Cleaning up table alert_rule_version logger=migrator batchSize=50 batches=0 keepVersions=100
INFO [07-31|13:11:55] Migration successfully executed logger=migrator id=“cleanup alert_rule_version table” duration=330.699µs
INFO [07-31|13:11:55] Executing migration logger=migrator id=“populate rule guid in alert rule table”
INFO [07-31|13:11:55] Migration successfully executed logger=migrator id=“populate rule guid in alert rule table” duration=282.444µs
INFO [07-31|13:11:55] Executing migration logger=migrator id=“drop index in alert_rule_version table on rule_org_id, rule_uid and version columns”
INFO [07-31|13:11:55] Migration successfully executed logger=migrator id=“drop index in alert_rule_version table on rule_org_id, rule_uid and version columns” duration=575.885µs
INFO [07-31|13:11:55] Executing migration logger=migrator id=“add index in alert_rule_version table on rule_org_id, rule_uid, rule_guid and version columns”
INFO [07-31|13:11:55] Migration successfully executed logger=migrator id=“add index in alert_rule_version table on rule_org_id, rule_uid, rule_guid and version columns” duration=518.21µs
INFO [07-31|13:11:55] Executing migration logger=migrator id=“add index in alert_rule_version table on rule_guid and version columns”
INFO [07-31|13:11:55] Migration successfully executed logger=migrator id=“add index in alert_rule_version table on rule_guid and version columns” duration=416.415µs
INFO [07-31|13:11:55] Executing migration logger=migrator id=“add index in alert_rule table on guid columns”
INFO [07-31|13:11:55] Migration successfully executed logger=migrator id=“add index in alert_rule table on guid columns” duration=387.36µs
INFO [07-31|13:11:55] migrations completed logger=migrator performed=644 skipped=0 duration=10.777178562s
INFO [07-31|13:11:55] Unlocking database logger=migrator
INFO [07-31|13:11:55] Created default admin logger=sqlstore user=admin
INFO [07-31|13:11:55] Created default organization logger=sqlstore
INFO [07-31|13:11:55] Envelope encryption state logger=secrets enabled=true current provider=secretKey.v1

Admin password changed successfully

[root@percona01:~]# docker exec -it pmm-server bash
[pmm@8ac3d7117011 opt] # supervisorctl restart grafana
grafana: stopped
grafana: started
[pmm@8ac3d7117011 opt] # supervisorctl restart all
grafana: stopped
nginx: stopped
vmalert: stopped
vmproxy: stopped
qan-api2: stopped
pmm-agent: stopped
postgresql: stopped
victoriametrics: stopped
pmm-managed: stopped
clickhouse: stopped
qan-api2: ERROR (spawn error)
pmm-init: started
postgresql: started
clickhouse: started
grafana: started
nginx: started
nomad-server: started
victoriametrics: started
vmalert: started
vmproxy: started
pmm-managed: started
pmm-agent: started

5

Hi Anil,

install ppm3 using following - –curl -fsSL https://www.percona.com/get/pmm | /bin/bash

Thanks

6

@anil.joshi , any update, how to fix the admin login issues, its use to work on pmm2 after migration pmm3 can’t login anymore and lost all the monitoring instance and could not go back to pmm2

Thanks

Suresh

7

curl -fsSL https://www.percona.com/get/pmm | /bin/bash

Gathering/downloading required components, this may take a moment

Checking docker installation - installed.

Created PMM Network: pmm-net
Generated Watchtower Token: random-2025-08-04-162340
Pulling percona/pmm-server:3
Created PMM Data Volume: pmm-data
Starting PMM Server…
Created PMM Server: pmm-server

Use the following command if you ever need to update your container manually:
docker pull percona/pmm-server:3

    docker run -d -p 443:8443 --volume pmm-data:/srv --name pmm-server --network pmm-net -e PMM_WATCHTOWER_HOST=http://watchtower:8080 -e PMM_WATCHTOWER_TOKEN=random-2025-08-04-162340  --restart always percona/pmm-server:3

Unable to find image ‘percona/watchtower:latest’ locally
latest: Pulling from percona/watchtower
ecbc0dd76899: Pull complete
a54339142755: Pull complete
5dfbcd7da7ce: Pull complete
Digest: sha256:d477cf69f16ef84b518f849008e050d20290903acedb7808a6acead3a27869b4
Status: Downloaded newer image for percona/watchtower:latest
8bbaf6800780c205e5aa8464d29b52d448dbc7765091afbe096973ab6b4fe2ed
Created Watchtower container
PMM Server has been successfully setup on this system!

You can access your new server using one of the following web addresses:

    https://127.0.0.1:443/

The default username is ‘admin’ and the password is ‘admin’ :slight_smile:
Note: Some browsers may not trust the default SSL certificate when you first open one of the urls above.
If this is the case, Chrome users may want to type ‘thisisunsafe’ to bypass the warning.

Enjoy Percona Monitoring and Management!

Still login issues as admin/admin

8

Hi Suresh

These warnings doesn’t look very sound. I see some invalid Token issues.

Well I tried to run the setup steps at my end however it ran fine and I was able to login to the PMM UI without noticing any such warning messages.

Let me share my steps for your clarity.

docker network create pmm-network

openssl rand -hex 161ce32a005032765baf5c151e2c9e4b05

Install watchtower:

docker run --detach
–restart always
–network=pmm-network
-e WATCHTOWER_HTTP_API_TOKEN=1ce32a005032765baf5c151e2c9e4b05
-e WATCHTOWER_HTTP_API_UPDATE=1
–volume /var/run/docker.sock:/var/run/docker.sock
–name watchtower
percona/watchtower:latest

docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9fcfd3b12fea percona/watchtower:latest “/watchtower” 33 seconds ago Up 32 seconds (healthy) 8080/tcp watchtower

Install PMM Server:

docker pull percona/pmm-server:3docker volume create pmm-data

docker run --detach --restart always –publish 443:8443 –env PMM_WATCHTOWER_HOST=http://127.0.0.1:8080 –env PMM_WATCHTOWER_TOKEN=1ce32a005032765baf5c151e2c9e4b05 –volume pmm-data:/srv –network=pmm-network –name pmm-server percona/pmm-server:3

docker psCONTAINER ID   IMAGE                       COMMAND                CREATED          STATUS                    PORTS                             NAMES5bb884b8ace2   percona/pmm-server:3        “/opt/entrypoint.sh”   16 seconds ago   Up 14 seconds (healthy)   8080/tcp, 0.0.0.0:443->8443/tcp   pmm-server9fcfd3b12fea   percona/watchtower:latest   “/watchtower”          4 minutes ago    Up 4 minutes (healthy)    8080/tcp                          watchtower

Screenshot 2025-08-04 at 10.11.51 PM
Screenshot 2025-08-04 at 10.11.51 PM1378×1348 47.4 KB

Screenshot 2025-08-04 at 10.11.41 PM
Screenshot 2025-08-04 at 10.11.41 PM1822×1302 43.8 KB

Please make sure you putting the correct watchtower token details in the PMM Server container part. Also, you can refer my steps from scratch and let us know if that solves the issue or not.

9

Hi Anil,

I followed your steps, but I still haven’t resolved the issue. Please help

Step:1

docker network create pmm-nectwork

step 2

# openssl rand -hex 16

a7ef35b59d7ef3c98883820a858131ba

step 3

# docker run --detach \

–restart always \

–network=pmm-network \

-e WATCHTOWER_HTTP_API_TOKEN=a7ef35b59d7ef3c98883820a858131ba \

-e WATCHTOWER_HTTP_API_UPDATE=1 \

–volume /var/run/docker.sock:/var/run/docker.sock \

–name watchtower \

percona/watchtower:latest

Unable to find image ‘percona/watchtower:latest’ locally

latest: Pulling from percona/watchtower

ecbc0dd76899: Pull complete

a54339142755: Pull complete

5dfbcd7da7ce: Pull complete

Digest: sha256:d477cf69f16ef84b518f849008e050d20290903acedb7808a6acead3a27869b4

Status: Downloaded newer image for percona/watchtower:latest

f87987102fd1966ebb482c4bf42c277aebe372c44d7d8ba7057345089297fbe9

# docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

f87987102fd1 percona/watchtower:latest “/watchtower” 2 seconds ago Up 2 seconds (health: starting) 8080/tcp watchtower

step 4

# docker run --detach --restart always \

–publish 443:8443 \

–env PMM_WATCHTOWER_HOST=http://127.0.0.1:8080 \

–env PMM_WATCHTOWER_TOKEN=a7ef35b59d7ef3c98883820a858131ba \

–volume pmm-data:/srv \

–network=pmm-network \

–name pmm-server \

percona/pmm-server:3

2cde3238c637c17084456f38c31decc44bf886b347351144531e117dee382200

# docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

2cde3238c637 percona/pmm-server:3 “/opt/entrypoint.sh” 3 seconds ago Up 2 seconds (health: starting) 8080/tcp, 0.0.0.0:443->8443/tcp, :::443->8443/tcp pmm-server

f87987102fd1 percona/watchtower:latest “/watchtower” 49 seconds ago Up 49 seconds (healthy) 8080/tcp watchtower

# docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

2cde3238c637 percona/pmm-server:3 “/opt/entrypoint.sh” 22 seconds ago Up 20 seconds (healthy) 8080/tcp, 0.0.0.0:443->8443/tcp, :::443->8443/tcp pmm-server

f87987102fd1 percona/watchtower:latest “/watchtower” About a minute ago Up About a minute (healthy) 8080/tcp watchtower

]# docker --version
Docker version 26.1.3, build b72abbb

Please let me know what logs you would like to review

Thanks

Suresh

10

Hi Anil,

I was able to login as username: admin@localhost and password admin, don’t know why username admin don’t work

Thanks

Suresh

11

Yes it worked for me too using admin@localhost, but I can’t see the home page, the page is just blank. Aha it took sometime to show the home page. Thanks a ton.