Anypoint Monitoring | Metrics May Stop Being Populated for Hybrid and RTF Deployments After 25 September 2025 (Oct 16 2025 for GovCloud)

Please follow the knowledge article solution for your environment.

Hybrid On-premise Runtime

AM Agent Certificates will be expiring on 25th Sept, 2025 (Oct 16 2025 for GovCloud). If you have restarted the AM agent post June 10, 2025, your certificates would have been refreshed automatically, but we encourage you to verify your current certificates!

Steps for Verification: 
Check your certificate folder under $MULE_HOME/am/config/certs if any of the certificates have expired in mule-agent-chain.crt bundle by running the below command:

openssl x509 -enddate -noout -in mule-agent-chain.crt

Certification with later Expiration date  - Valid
notAfter= 31 Oct 2027 GMT|
(OR)
Certification with Expiry of 25 September 2025 - This needs to be refreshed
notAfter=25 Sep 2025 GMT

Steps for refreshing Certificates:
Restart the AM Agent

$MULE_HOME/am/bin/am stop
$MULE_HOME/am/bin/am start

If the certificate is up to date but metrics are not populated check if AM agent is configured to start manually or as a service.

Take a backup of $MULE_HOME/am/config folder
Execute ./uninstall in $MULE_HOME/am/bin folder
Execute ./install in $MULE_HOME/am/bin folder
Execute ./setup in $MULE_HOME/am/bin folder

Rerun the validation and verify that the new expiration date is to 31 Oct 2027 (US), 31 Dec 2027 (EU)

Runtime Fabric Runtime

AM Agent Certificates will be expiring on 25th Sept, 2025.

Option 1

Please follow the instructions for refreshing AM Agent Certificates for each of the Apps via Runtime Manager.
Go to Runtime Manager -> Click on the Application -> Settings 
Make sure that the Deployment Model is set to Rolling Update

Note: If your application’s deployment model is set to ‘Recreate’, you need to follow option 2 by stopping and starting the application, which will likely have downtime.

Make any configuration change in the app (such as runtime patch version, a new application property) to perform a rolling update without incurring a downtime.
Click on "Apply Changes"

Option 2

Stop and then start your application(s) directly from the Runtime Manager.

Note: If your RTF version is <2.6, you need to also update the RTF Agent to the latest version: steps. Note that there is no need to upgrade the RTF appliance version to resolve this issue.

Updating the RTF Agent has the additional benefits of the latest features / bug fixes. RTF Agent release notes.

Certification Validation

Note: To determine whether the certificate has been successfully upgraded, the following can be checked:
1) Exec into the anypoint-monitoring container of RTF mule applications:

kubectl exec -it -n <app-namespace> <app-pod-name> -c anypoint-monitoring -- bash

2) Verify

cd /data/certs
openssl x509 -enddate -noout -in mule-agent-chain.crt

If the output indicates that the certificate has expired or is about to expire, restart the application. After restarting, the application should show the renewed expiration date.

Bulk Updates to Applications

For restarting multiple applications,  “Stop/Start” multiple apps -> RTF Stop and Start Applications in Bulk.
Note: Please test the Stop/Start solution with one app on Runtime Manager, before trying the Bulk API. 
Related Articles 
https://help.salesforce.com/s/articleView?id=005166859&type=1 

CloudHub 2.0 (Applications On Exception List for Monthly Runtime Auto-Patching)

Your application will require a redeployment to adopt the latest Anypoint Monitoring agent certificate. You can go about this in one of 2 options listed below.

Option 1

Go to Runtime Manager -> Click on the Application -> Settings
Make any configuration change in the app (such as a runtime patch version, a new application property).
Click on "Apply Changes". You can configure whether to use Rolling Update or Recreate as your deployment strategy.

Note: If your application’s deployment model is set to ‘Recreate’, you need to follow option 2 by stopping and starting the application, which will likely have downtime.

Option 2

Go to Runtime Manager -> Click on the Application -> Settings
Stop and then start your application(s) directly from the Runtime Manager

Should you continue to experience an issue with Anypoint Monitoring metrics or logs, after applying the above solution, please raise a case with MuleSoft Support via the Salesforce Help Center