[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for OpenSearch](../index.md) > FAQ

# FAQ about Managed Service for OpenSearch

* [How are OpenSearch clusters maintained?](#service-window)

* [Is cluster backup enabled by default?](#default-backup)

* [Which OpenSearch version does Managed Service for OpenSearch use?](#dbms-version)

* [What happens when a new OpenSearch version is released?](#new-version)

* [How do I get the logs of my activity in the Yandex Cloud services?](#logs)

* [How longs are logs retained?](#log-keeping)

* [How can I configure an alert for when disk usage reaches a certain percentage?](#disk-space-percentage)

* [Why is my cluster slow even though the computing resources are not fully utilized?](#throttling)

* [Can I connect to cluster hosts over SSH or get superuser privileges on hosts?](#connect-ssh)

* [What should I do if I get a revocation check error when using PowerShell to obtain an SSL certificate?](#get-ssl-error)

* [How can I fix the no permission error when attaching a service account to a cluster?](#attach-service-account)

* [Why do I get an error when activating a transfer?](#data-transfer-error)


* [How do I make sure that Yandex Cloud AI Studio AI models can access my Managed Service for OpenSearch cluster for fine-tuning?](#ai-access)


* [What is the role of Managed Service for OpenSearch in database management and maintenance?](#services)

* [What block size is used on the cluster disks?](#block-size)

* [What restrictions apply when creating or deleting host groups?](#host-group-limits)

## General questions {#general}

#### How are OpenSearch clusters maintained? {#service-window}

Maintenance in Managed Service for OpenSearch includes:

* Automatic installation of OpenSearch updates and fixes for your hosts.
* Changes in the host class and storage size.
* Other Managed Service for OpenSearch maintenance tasks.

For more information, see [Maintenance](../concepts/maintenance.md).

#### Is cluster backup enabled by default? {#default-backup}

Yes, automatic [backup](../concepts/backup.md) is enabled by default and takes place every hour. All backups are incremental and store only the data that has changed since the previous backup to save storage space.

Automatic backups are stored for two weeks.

#### Which OpenSearch version does Managed Service for OpenSearch use? {#dbms-version}

Managed Service for OpenSearch uses the OpenSearch versions maintained and supported by the vendor. For more information, see [OpenSearch versioning policy](../concepts/update-policy.md).

#### What happens when a new OpenSearch version is released? {#new-version}

When a new version is released, the cluster software is [automatically updated](../concepts/update-policy.md) after testing. Clusters running on an OpenSearch version that is no longer supported will also be automatically updated.

The owner of the affected clusters receives an advance email notice of the update schedule and database availability.

#### Can I get logs of my operations in Yandex Cloud? {#logs}

Yes, you can request information about operations with your resources from Yandex Cloud logs. Do it by contacting [support](https://center.yandex.cloud/support).

#### What is the retention period for logs? {#log-keeping}

Cluster logs are stored for 45 days.

#### How do I set up an alert that triggers as soon as a certain percentage of disk space is used up? {#disk-space-percentage}

[Create an alert](../operations/monitoring.md#monitoring-integration) for the `disk.used_bytes` metric in Yandex Monitoring. This metric shows the disk space usage in the Managed Service for OpenSearch cluster.

For `disk.used_bytes`, use notification thresholds. with the following recommended values:

* `Alarm`: 90% of disk space
* `Warning`: 80% of disk space

Thresholds are set in bytes only. For example, the recommended values for a 100 GB disk are as follows:

* `Alarm`: `96636764160` bytes (90%).
* `Warning`: `85899345920` bytes (80%).

#### Why is my cluster slow even though the computing resources are not fully utilized? {#throttling}

Your storage may have insufficient maximum [IOPS and bandwidth](../../compute/concepts/storage-read-write.md) to process the current number of requests. In this case, [throttling](../../compute/concepts/storage-read-write.md#throttling) occurs, which degrades the entire cluster performance.

The maximum IOPS and bandwidth values increase by a fixed value when the storage size increases by a certain step. The step and increment values depend on the disk type:

| Disk type                  | Step, GB | Max IOPS increase (read/write) | Max bandwidth increase (read/write), MB/s |
|-----------------------------|---------|------------------------------------|-----------------------------------------------|
| `network-hdd`               | 256     | 300/300                            | 30/30                                         |
| `network-ssd`               | 32      | 1,000/1,000                          | 15/15                                         |
| `network-ssd-nonreplicated`, `network-ssd-io-m3` | 93      | 28,000/5,600                         | 110/82                                        |

To increase the maximum IOPS and bandwidth values and make throttling less likely, expand the storage or switch to a faster disk type by [restoring the cluster](../operations/cluster-backups.md#restore) from a backup.

#### Can I connect to cluster hosts over SSH or get superuser privileges on hosts? {#connect-ssh}

You cannot connect to hosts via SSH. This is done for the sake of security and user cluster fault tolerance because direct changes inside a host can render it completely inoperable.

#### What should I do if I get a revocation check error when obtaining an SSL certificate via PowerShell? {#get-ssl-error}

Complete error message:

```text
curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x80092012)
The revocation function was unable to check revocation for the certificate
```
This means that, when connecting to the website, the function was unable to check if its certificate was listed as revoked.

To fix this error:

* Make sure your corporate network policies are not blocking the verification.
* Run the following command with the `--ssl-no-revoke` parameter:

   ```powershell
   mkdir $HOME\.opensearch; curl --ssl-no-revoke --output $HOME\.opensearch\root.crt https://storage.yandexcloud.net/cloud-certs/CA.pem
   ```

#### How can I fix the no permission error when attaching a service account to a cluster? {#attach-service-account}

#### How can I fix the no permission error when connecting a service account to the cluster? {#attach-service-account}

Error message:

```text
ERROR: rpc error: code = PermissionDenied desc = you do not have permission to access the requested service account or service account does not exist
```

The error occurs in the following cases:

* You are creating or modifying a cluster and linking it to a service account.
* You are restoring a cluster linked to a service account from its backup.

To fix this error, [assign](../../iam/operations/roles/grant.md) your Yandex Cloud account the [iam.serviceAccounts.user](../../iam/security/index.md#iam-serviceAccounts-user) role or higher.

#### Why do I get an `Unable to confirm permission` error when activating a transfer? {#data-transfer-error}

Complete error message:

```text
Unable to confirm permission 'data-transfer.transfers.createExternal'
```

This error occurs if the transfer is activated in or from a custom OpenSearch installation database, but the OpenSearch endpoint settings have no subnet ID specified.

To fix this error, specify a subnet ID in the OpenSearch endpoint settings, even if the source and target can access each other without the internet.


#### How do I make sure that Yandex Cloud AI Studio AI models can access my Managed Service for OpenSearch cluster for fine-tuning? {#ai-access}

Use one of these methods:

* Configure internet access to hosts with the `DATA` and `MANAGER` roles:

    1. [Enable](../operations/host-groups.md#update-host-group) the **Public access** option in the `DATA`/`MANAGER` host group settings.
    1. [Configure all cluster security groups](../../vpc/operations/security-group-add-rule.md) to allow incoming traffic on port `9200`. To do this, create the following inbound rule:
        * **Port range**: `9200`.
        * **Protocol**: `TCP`.
        * **Source**: `CIDR`.
        * **CIDR blocks**: `0.0.0.0/0`.

* Create and set up a NAT gateway:

    1. [Create a NAT gateway](../../vpc/operations/create-nat-gateway.md).
    1. [Create a route table](../../vpc/operations/static-route-create.md) with the `0.0.0.0/0` prefix and associate it with the subnet where the group of `DATA` and `MANAGER` hosts reside.


#### What is the role of Managed Service for OpenSearch in database management and maintenance? {#services}

Be mindful of what is managed by the service and what, by the Yandex Cloud customer. Understanding these zones of control makes you an efficient user of cloud resources and helps avoid potential database-related issues. For more information, see [Zones of control between managed database (MDB) service users and Yandex Cloud](../../overview/concepts/mdb-responsibilities.md).

#### What block size is used on the cluster disks? {#block-size}

[Block](https://en.wikipedia.org/wiki/Block_(data_storage)) size for all disk types is 4 KB.

#### What restrictions apply when creating or deleting host groups? {#host-group-limits}

* If you add a host group with the `MANAGER` role to a cluster where that role is assigned to hosts with the `DATA` role, that group cannot be removed. The only way to revert to the previous host configuration is to [restore the cluster from a backup](../operations/cluster-backups.md#restore).
* When deleting a host group, you cannot delete a single host group with the `DATA` role.