出汗这事儿吧，再平常不过了，尤其是在大夏天里——吃个饭，身体粘乎乎的；出个门，更是大汗淋漓；稍微动一动，就会出一身汗&&不过，入夏以来，小编一直听到出汗有各种好处，比如能排毒、减肥、滋润皮肤&&话说，出汗真的有这么神奇吗，今个儿就和大家说说！出汗真的能排毒？排毒，通过出汗还真做不到啊~因为在汗液中，99％是水分，剩余的1％则为组织代谢的废物，其中包括钠、钾、尿素、乳酸、氨基酸代谢的有机物等。而在这1%的废物中，能得上“毒”的只有“尿素氮”。但是，你也看到了汗液中的尿素氮的含量小到可以忽略不计，它主要通过小便排出人体。总之， “出汗=给身体排毒”的说法，实际上是夸大了出汗的作用。
每天出一身汗，可以减肥？大热天里出身，让人浑身汗津津、粘乎乎的，特别不舒服。不过，有些想减肥却懒得动的人却窃窃自喜：平时不动没汗可出，现在坐着不动都一身汗，正是减肥的大好时机，真是天助我也~
如果你也这么想，那就太天真了~其实，出汗主要是把体内的多余热量散发出去（1克汗约散发2.4千焦的热量）。汗腺活动过程本身只能产生极少的热量。大量出汗导致人体处于失水状态，只能暂时减轻体重，真正的减肥应是减少脂肪（还是老老实实管住嘴迈开腿吧~）。说了这么多，既然出汗不能减肥、排毒，那么出汗到底有啥用？出汗到底有啥作用？先来说说人为啥会出汗——人体在遭遇热应激时（人体内产热大量），汗腺就会分泌汗液；当汗液气化时，便可带走大量的热量，从而维持人体体温的恒定。产热增加汗腺分泌汗液汗液气化带走热量维持正常体温而这样的热应激有两种：一种是高温环境应激；还有一种是剧烈运动引起的。
此外，人在紧张、遭遇危险时，也会出汗。这种出汗属于剧烈运动的热应激范畴，由交感神经异常兴奋导致。所以，出汗就是人体进行体温调节的生理行为。尤其是在夏天，我们的皮肤存在着约200~500万个汗腺，密密麻麻地覆盖着全身的皮肤，是保护我们机体的天然屏障。在炎热的夏天，人体散热主要就靠皮肤上的小汗腺来完成。因此，出汗说明你很健康，夏天出汗还能散热解暑。要知道，老不出还可能是汗腺出问题了，有一种病叫做“无汗症”，需要到医院接受治疗。
强行出汗，对身体有害有很多人认为出汗多更健康，想尽各种强行捂汗。其实，大量出汗会对身体产生不利的影响。从西医的角度来说，汗液里含有多种电解质，如钠、氯、锌，大量的出汗会造成身体脱水（电解质紊乱）。从中医的角度来说，“汗血同源”，汗为心之液，而心主血。若出汗过多，会耗气也会伤及津液而损及心血。
大部分情况下出汗，都是属于正常的生理现象，但是有一些出汗的情况我们要特别重视，比如——这3种汗，预示身体出大事了！1、浑身大汗，还头晕眼花如果你高温的环境里，感到浑身大汗、头昏、胸闷、四肢发麻&&很有可能是——中暑了！你可别以为中暑是小事，每年都有人因此丧命！
图源/网络应对：急救：轻度中暑者，要迅速离开高温环境到通风阴凉处；物理降温有三招：冰袋敷头，温水擦身，吹风扇；病人仍有意识，可适量喝些淡盐水。如果上述施救无效，必须立即送院诊治。预防：避免在10：00～16：00时间段外出； 出门注意遮阳，如打伞、戴帽等； 补充水分，睡眠充足，增强营养；2、睡个觉，把床单都汗湿了温度不高，但是晚上睡觉的时候，出很多汗，甚至把床单的汗湿了。出现这种情况，很有可能是盗汗。盗汗，指的是除室温过高以外，睡眠时出汗的现象。出现盗汗，可能是某些疾病的表现，最常见是结核感染，如果还伴有发热、消瘦及咳嗽、咳痰等呼吸道症状，一定要非常警惕。
应对：需要到医院做结核菌素试验、X线胸片等检查，以排除结核病。3、大热天的，直冒冷汗大夏天里，出汗再平常不过了，但是要小心你出的是“热汗”还是“冷汗”！热的出汗常出现在前胸后背、额头、脖子、腋下，皮肤温度是升高的。而冷汗，出汗的部位不同，出汗的温度也不同，比如在同一间屋子里，的人别人不出汗偏偏他出汗，跟天热造成的出汗是不一样的。
出这种汗，很可能是发生了心肌梗死！心肌梗死时，由于心输出量下降、血压下降和血管收缩，所以皮肤是湿冷的，脖子额头手心脚心布满汗珠。而且，心肌梗死的患者几乎都有出冷汗的症状。应对：一旦出现心梗，要立即拨打120急救电话；患者应避免起身，情况相对稳定时以担架运送，在运输过程中应该尽量平稳；途中可使用硝酸甘油，并嚼服一片阿司匹林（约150~300毫克）。特别声明：本文为网易自媒体平台“网易号”作者上传并发布，仅代表该作者观点。网易仅提供信息发布平台。
一键安装官方客户端
重大事件及时推送 阅读更流畅
http://dingyue.nosdn.127.net/nxqoeA5K99f8kK8XgfAfjDaCBpyBKyqIdLMOJ28A6pVjZ0.jpg为什么这么热的天,我不怎么出汗,我确定系没有中署_百度拇指医生
&&&普通咨询
为什么这么热的天,我不怎么出汗,我确定系没有中署
你好，借你用一段时间的补中益气丸，和玉屏风散
向医生提问
完善患者资料：*性别：
为您推荐：
* 百度拇指医生解答内容由公立医院医生提供，不代表百度立场。* 由于网上问答无法全面了解具体情况，回答仅供参考，如有必要建议您及时当面咨询医生
向医生提问1.9K152 条评论分享收藏感谢收起赞同 367 条评论分享收藏感谢收起Single-page HTML
Configuration Guide
Red Hat JBoss Enterprise Application Platform 7.0For Use with Red Hat JBoss Enterprise Application Platform 7.0Red Hat Customer Content ServicesAbstract
This document provides a practical guide for administrators to configure Red Hat JBoss Enterprise Application Platform 7.0.
Chapter 1. Overview
The purpose of this guide is to cover many of the configuration tasks needed for setting up and maintaining JBoss EAP as well as running applications and other services on it. Before using this guide to configure JBoss EAP, it is assumed that the latest version of JBoss EAP has been downloaded and installed. For installation instructions, see the JBoss EAP .
Since the installation location of JBoss EAP will vary between host machines, this guide refers to the installation location as EAP_HOME. The actual location of the JBoss EAP installation should be used instead of EAP_HOME when performing administrative tasks.
Chapter 2. Starting and Stopping JBoss EAP2.1. Starting JBoss EAP
JBoss EAP runs in one of two operating modes: as a standalone server or in a managed domain, and is supported on several platforms: Red Hat Enterprise Linux, Windows Server, Oracle Solaris, and Hewlett-Packard HP-UX.
The specific command to start JBoss EAP depends on the underlying platform and the desired operating mode.
Start JBoss EAP as a Standalone Server$ EAP_HOME/bin/standalone.sh
For Windows Server, use the EAP_HOME\bin\standalone.bat script.
This startup script uses the EAP_HOME/bin/standalone.conf file (or standalone.conf.bat for Windows Server) to set some default preferences, such as JVM options. You can customize the settings in this file.
JBoss EAP uses the standalone.xml configuration file by default, but can be started using a different one. For details on the available standalone configuration files and how to use them, see the
For a complete listing of all available startup script arguments and their purposes, use the --help argument or see the
Start JBoss EAP in a Managed Domain
The domain controller must be started before the servers in any of the server groups in the domain. Use this script to first start the domain controller, and then for each associated host controller.
$ EAP_HOME/bin/domain.sh
For Windows Server, use the EAP_HOME\bin\domain.bat script.
This startup script uses the EAP_HOME/bin/domain.conf file (or domain.conf.bat for Windows Server) to set some default preferences, such as JVM options. You can customize the settings in this file.
JBoss EAP uses the host.xml host configuration file by default, but can be started using a different one. For details on the available managed domain configuration files and how to use them, see the
When setting up a managed domain, additional arguments will need to be passed into the startup script. For a complete listing of all available startup script arguments and their purposes, use the --help argument or see the
2.2. Stopping JBoss EAP
The way that you stop JBoss EAP depends on how it was started.
Stop an Interactive Instance of JBoss EAP
Press Ctrl+C in the terminal where JBoss EAP was started.
Stop a Background Instance of JBoss EAP
Use the management CLI to connect to the running instance and shut down the server.
Launch the management CLI.
$ EAP_HOME/bin/jboss-cli.sh --connect
Issue the shutdown command.
When running in a managed domain, you must specify the host name to shut down by using the --host argument with the shutdown command.
2.3. Running JBoss EAP in Admin-Only Mode
JBoss EAP has the ability to be started in admin-only mode. This enables JBoss EAP to run and accept management requests but not start other runtime services or accept end user requests. Admin-only mode is available in both standalone servers as well as managed domains. In a managed domain, if a domain controller is started in admin-only mode, it will not accept incoming connections from slave host controllers.
To start a JBoss EAP instance in admin-only mode, use the --admin-only runtime switch when starting the JBoss EAP instance.
The management CLI commands shown assume that you are running a JBoss EAP standalone server. For more details on using the management CLI for a JBoss EAP managed domain, please see the .
Start JBoss EAP in Admin-Only Mode$ EAP_HOME/bin/standalone.sh --admin-onlyCheck If JBoss EAP is Running in Admin-Only Mode
To determine if a JBoss EAP instance is running in admin-only mode:
The management CLI commands shown assume that you are running a JBoss EAP standalone server. For more details on using the management CLI for a JBoss EAP managed domain, please see the .
:read-attribute(name=running-mode)
If the JBoss EAP instance is running in admin-only mode, the result will be:
"outcome" =& "success",
"result" =& "ADMIN_ONLY"
otherwise, the result will be:
"outcome" =& "success",
"result" =& "NORMAL"
}Restart in a Different Mode from the Management CLI
In addition to stopping and starting a JBoss EAP instance with a different runtime switch, the management CLI may also be used to reload the server and start it in a different mode. To reload a JBoss EAP instance to start in admin-only mode:
The management CLI commands shown assume that you are running a JBoss EAP standalone server. For more details on using the management CLI for a JBoss EAP managed domain, please see the .
reload --admin-only=true
To reload a JBoss EAP instance to start in normal mode:
reload --admin-only=false
Separate from the current running mode, the initial running mode may also be checked with the following command: /core-service=server-environment:read-attribute(name=initial-running-mode). This command differs from :read-attribute(name=running-mode) by displaying the running mode in which JBoss EAP was launched and NOT its current running mode.
2.4. Suspend and Shut Down JBoss EAP Gracefully
JBoss EAP can be suspended or shut down gracefully. This allows active requests to complete normally, without accepting any new requests. A timeout value specifies how long that the suspend or shut down operation will wait for active requests to complete. While the server is suspended, management requests are still processed.
Graceful shutdown is coordinated at a server-wide level, mostly focused on the entry points at which a request enters the server. The following subsystems support graceful shutdown:
The undertow subsystem will wait for all requests to finish.
mod_cluster
The modcluster subsystem will notify the load balancer that the server is suspending in the PRE_SUSPEND phase.
The ejb3 subsystem will wait for all remote EJB requests and MDB message deliveries to finish. Delivery to MDBs is stopped in the PRE_SUSPEND phase. EJB timers are suspended, and missed timers will be activated when the server is resumed.
EE Concurrency
The server will wait for all active jobs to finish. All queued jobs will be skipped. Currently, since EE Concurrency does not have persistence, those queued jobs that were skipped will be lost.
While the server is in a suspended state, scheduled tasks will continue to execute at their scheduled times but will throw a java.lang.IllegalStateException. Once the server is resumed, scheduled tasks will continue to execute normally and in most cases, tasks will not need to be rescheduled.
The server will stop all running jobs within the timeout period and defer all scheduled jobs.
Graceful shutdown currently will not reject inbound remote distributed transactions or new inbound JMS messages. EE batch jobs and EE concurrency tasks scheduled by inflight activity are currently allowed to proceed. However, EE concurrency tasks submitted that pass the timeout window currently error when executed.
Requests are tracked by the request-controller subsystem. Without this subsystem, suspend and resume capabilities are limited and the server will not wait for requests to complete before suspending or shutting down. However, if you do not need this capability, the request-controller subsystem can be removed for a small performance improvement.
2.4.1. Suspend Servers
JBoss EAP 7 introduced a suspend mode, which suspends server operations gracefully. This allows all active requests to complete normally, but will not accept any new requests. Once the server has been suspended, it can be shut down, returned back to a running state, or left in a suspended state to perform maintenance.
The management interfaces are not impacted by suspending the server.
The server can be suspended and resumed using the management console or the management CLI.
Check the Server Suspend State
The server suspend state can be viewed using the following management CLI commands. The resulting value will be one of RUNNING, PRE_SUSPEND, SUSPENDING, or SUSPENDED.
Check the suspend state for a standalone server.
:read-attribute(name=suspend-state)
Check the suspend state for a server in a managed domain.
/host=master/server=server-one:read-attribute(name=suspend-state)Suspend
Use the following management CLI commands to suspend the server, specifying the timeout value, in seconds, for the server to wait for active requests to complete. The default is 0, which will suspend immediately. A value of -1 will cause the server to wait indefinitely for all active requests to complete.
Each example waits up to 60 seconds for requests to complete before suspending.
Suspend a standalone server.
:suspend(timeout=60)
Suspend all servers in a managed domain.
:suspend-servers(timeout=60)
Suspend a single server in a managed domain.
/host=master/server-config=server-one:suspend(timeout=60)
Suspend all servers in a server group.
/server-group=main-server-group:suspend-servers(timeout=60)Resume
The server can be returned back to a normal running state to accept new requests by using the resume command at the appropriate level (server, server group, entire domain). For example:
:resume2.4.2. Shut Down Servers Gracefully
A server will be shut down gracefully if an appropriate timeout value is specified when stopping the server. Once the command is issued, the server will be suspended and will wait up to the specified timeout for all requests to finish before shutting down.
Use the following management CLI commands to shut down the server gracefully. Specify the timeout value, in seconds, for the server to wait for active requests to complete. The default is 0, which will shut down the server immediately. A value of -1 will cause the server to wait indefinitely for all active requests to complete before shutting down.
Each example waits up to 60 seconds for requests to complete before shutting down.
Shut down a standalone server gracefully.
:shutdown(timeout=60)
Stop all servers in a managed domain gracefully.
:stop-servers(timeout=60)
Stop a single server in a managed domain gracefully.
/host=master/server-config=server-one:stop(timeout=60)
Stop all servers in a server group gracefully.
/server-group=main-server-group:stop-servers(timeout=60)2.5. Starting and Stopping JBoss EAP (RPM Installation)
Starting and stopping JBoss EAP is different for an RPM installation compared to a ZIP or installer installation.
2.5.1. Starting JBoss EAP (RPM Installation)
The command for starting an RPM installation of JBoss EAP depends on which operating mode you want to start (a standalone server or a managed domain), and which Red Hat Enterprise Linux version you are running.
Start JBoss EAP as a Standalone Server (RPM Installation)
For Red Hat Enterprise Linux 6:
$ service eap7-standalone start
For Red Hat Enterprise Linux 7:
$ systemctl start eap7-standalone.service
This will start JBoss EAP using the standalone.xml configuration file by default. You can start JBoss EAP with a different
by setting a property in the . For more information, see the
section below.
Start JBoss EAP in a Managed Domain (RPM Installation)
For Red Hat Enterprise Linux 6:
$ service eap7-domain start
For Red Hat Enterprise Linux 7:
$ systemctl start eap7-domain.service
This will start JBoss EAP using the host.xml configuration file by default. You can start JBoss EAP with a different
by setting a property in the . For more information, see the
section below.
Configure RPM Service Properties
This section shows you how to configure the RPM service properties and other startup options for your JBoss EAP installation. Note that it is recommended to back up your configuration files before making modifications.
For a listing of all available startup options for an RPM installation, see the
For Red Hat Enterprise Linux 7, RPM service configuration files are loaded using systemd, so variable expressions are not expanded.
Specify the server configuration file.
When starting a standalone server, the standalone.xml file is used by default. When running in a managed domain, the host.xml file is used by default. You can start JBoss EAP with a different configuration file by setting the WILDFLY_SERVER_CONFIG property in the appropriate , for example, eap7-standalone.conf.
WILDFLY_SERVER_CONFIG=standalone-full.xml
Bind to a specific IP address.
By default, a JBoss EAP RPM installation binds to 0.0.0.0. You can bind JBoss EAP to a specific IP address by setting the WILDFLY_BIND property in the appropriate , for example, eap7-standalone.conf.
WILDFLY_BIND=192.168.0.1
If you want to bind the management interfaces to a specific IP address, this can be configured in the JBoss EAP startup configuration file as shown in the next example.
Set JVM options or Java properties.
You can specify JVM options or Java properties to pass into the JBoss EAP startup script by editing the startup configuration file. This file is EAP_HOME/bin/standalone.conf for a standalone server or EAP_HOME/bin/domain.conf for a managed domain. The below example configures the heap size and binds the JBoss EAP management interfaces to an IP address.
JAVA_OPTS="$JAVA_OPTS -Xms2048m -Xmx2048m"
JAVA_OPTS="$JAVA_OPTS -Djboss.bind.address.management=192.168.0.1"
If required, the JBoss EAP bind address must be configured using the WILDFLY_BIND property and not using the jboss.bind.address standard property here.
If a property has the same name in both the RPM service configuration file (for example, /etc/sysconfig/eap7-standalone) and in the JBoss EAP startup configuration file (for example, EAP_HOME/bin/standalone.conf), the value that takes precedence is the one in the JBoss EAP startup configuration file. One such property is JAVA_HOME.
2.5.2. Stopping JBoss EAP (RPM Installation)
The command for stopping an RPM installation of JBoss EAP depends on which operating mode that was started (a standalone server or a managed domain), and which Red Hat Enterprise Linux version you are running.
Stop JBoss EAP as a Standalone Server (RPM Installation)
For Red Hat Enterprise Linux 6:
$ service eap7-standalone stop
For Red Hat Enterprise Linux 7:
$ systemctl stop eap7-standalone.serviceStop JBoss EAP in a Managed Domain (RPM Installation)
For Red Hat Enterprise Linux 6:
$ service eap7-domain stop
For Red Hat Enterprise Linux 7:
$ systemctl stop eap7-domain.service
For a listing of all available startup options for an RPM installation, see the
2.6. PowerShell Scripts (Windows Server)
This feature is provided as Technology Preview only. It is not supported for use in a production environment, and it may be subject to significant future changes. See
on the Red Hat Customer Portal for information about the support scope for Technology Preview features.
JBoss EAP includes PowerShell script equivalents for most of the JBoss EAP management scripts. This includes a PowerShell script to start JBoss EAP on Microsoft Windows Server.
The JBoss EAP PowerShell scripts are designed to work with PowerShell version 2 and newer running on tested versions of Windows Server.
The JBoss EAP PowerShell scripts are located in EAP_HOME\bin, and are used in mostly the same way as the JBoss EAP batch scripts.
For example, to start a standalone JBoss EAP server with the standalone-full.xml configuration file, use the following PowerShell command:
.\standalone.ps1 "-c=standalone-full.xml"
Arguments of the JBoss EAP PowerShell scripts must be in quotes.
Chapter 3. JBoss EAP Management
JBoss EAP uses a simplified configuration, with one configuration file per standalone server or managed domain. Default configuration for a standalone server is stored in the EAP_HOME/standalone/configuration/standalone.xml file and default configuration for a managed domain is stored in the EAP_HOME/domain/configuration/domain.xml file. Additionally, the default configuration for a host controller is stored in the EAP_HOME/domain/configuration/host.xml file.
JBoss EAP can be configured using the command-line management CLI, web-based management console, Java API, or HTTP API. Changes made using these management interfaces persist automatically and the XML configuration files are overwritten by the Management API. The management CLI and management console are the preferred methods, and it is not recommended to edit the XML configuration files manually.
3.1. About Subsystems, Extensions, and Profiles
Different aspects of JBoss EAP functionality are configured in different subsystems. For example, application and server logging are configured in the logging subsystem.
A subsystem provides configuration options for a particular extension. An extension is a module that extends the core functionality of the server. Extensions are loaded as they are needed by deployments, and are unloaded when they are no longer needed.
A collection of subsystem configurations makes up a profile, which is configured to satisfy the needs of the server. A standalone server has a single, unnamed profile. A managed domain can define many
for use by server groups in the domain.
For more information on the available subsystems, see .
Using the Management Console or the Management CLI
Both the management console and the management CLI are valid, supported ways of updating the configuration of a JBoss EAP instance. Deciding between the two is a matter of preference. Those who prefer to use a graphical, web-based interface should use the management console. Those who prefer a command-line interface should use the management CLI.
3.2. Management Users
The default JBoss EAP configuration provides local authentication so that a user can access the management CLI on the local host without requiring authentication.
However, you must add a management user if you want to access the management CLI remotely or use the management console, which is considered remote access even if the traffic originates on the local host. If you attempt to access the management console before adding a management user, you will receive an error message.
If JBoss EAP is installed using the graphical installer, then a management user is created during the installation process.
This guide covers simple user management for JBoss EAP using the add-user script, which is a utility for adding new users to the properties files for out-of-the-box authentication. For more advanced authentication and authorization options, such as LDAP or Role-Based Access Control (RBAC), see the Core Management Authentication section of the JBoss EAP
3.2.1. Adding a Management User
Run the add-user utility script and follow the prompts.
$ EAP_HOME/bin/add-user.sh
For Windows Server, use the EAP_HOME\bin\add-user.bat script.
Press ENTER to select the default option a to add a management user.
This user will be added to the ManagementRealm and will be authorized to perform management operations using the management console or management CLI. The other choice (b) adds a user to the ApplicationRealm, which is used for applications and provides no particular permissions.
Enter the desired username and password. You will be prompted to confirm the password.
By default, JBoss EAP allows weak passwords but will issue a warning. See
for details on changing this default behavior.
Enter a comma-separated list of groups to which the user belongs. If you do not want the user to belong to any groups, press ENTER to leave it blank.
Review the information and enter yes to confirm.
Determine whether this user represents a remote JBoss EAP server instance. For a basic management user, enter no.
One type of user that may need to be added to the ManagementRealm is a user representing another instance of JBoss EAP, which must be able to authenticate to join as a member of a cluster. If this is the case, then answer yes to this prompt and you will be given a hashed secret value representing the user’s password, which will need to be added to a different configuration file.
Users can also be created non-interactively by passing parameters to the add-user script. This approach is not recommended on shared systems, because the passwords will be visible in log and history files. For more information, see .
3.2.2. Running the Add-User Utility Non-Interactively
You can run the add-user script non-interactively by passing in arguments on the command line. At a minimum, the username and password must be provided.
This approach is not recommended on shared systems, because the passwords will be visible in log and history files.
Create a User Belonging to Multiple Groups
The following command adds a management user (mgmtuser1) with the guest and mgmtgroup groups.
$ EAP_HOME/bin/add-user.sh -u 'mgmtuser1' -p 'password1!' -g 'guest,mgmtgroup'Specify an Alternative Properties File
By default, user and group information created using the add-user script are stored in properties files located in the server configuration directory.
User information is stored in the following properties files:
EAP_HOME/standalone/configuration/mgmt-users.properties
EAP_HOME/domain/configuration/mgmt-users.properties
Group information is stored in the following properties files:
EAP_HOME/standalone/configuration/mgmt-groups.properties
EAP_HOME/domain/configuration/mgmt-groups.properties
These default directories and properties file names can be overridden. The following command adds a new user, specifying a different name and location for the user properties files.
$ EAP_HOME/bin/add-user.sh -u 'mgmtuser2' -p 'password1!' -sc '/path/to/standaloneconfig/' -dc '/path/to/domainconfig/' -up 'newname.properties'
The new user was added to the user properties files now located at /path/to/standaloneconfig/newname.properties and /path/to/domainconfig/newname.properties. Note that these files must already exist or you will see an error.
For a complete listing of all available add-user arguments and their purposes, use the --help argument or see the
3.2.3. Setting Add-User Utility Password Restrictions
The password restrictions for the add-user utility script can be configured using the EAP_HOME/bin/add-user.properties file.
By default, JBoss EAP allows weak passwords but will issue a warning. To reject passwords that do not meet the minimum requirements specified, set the password.restriction property to REJECT.
Additional password requirements that can be configured in the EAP_HOME/bin/add-user.properties file:
Minimum length
Minimum alphabetic characters
Minimum digits
Minimum symbols
List of forbidden passwords (such as admin)
Whether to allow a password that matches the username
3.3. Management Interfaces3.3.1. Management CLI
The management command-line interface (CLI) is a command-line administration tool for JBoss EAP.
Use the management CLI to start and stop servers, deploy and undeploy applications, configure system settings, and perform other administrative tasks. Operations can be performed in batch mode, allowing multiple tasks to be run as a group.
Many common terminal commands are available, such as ls, cd, and pwd. The management CLI also supports tab completion.
For detailed information on using the management CLI, including commands and operations, syntax, and running in batch mode, see the JBoss EAP .
Launch the Management CLI$ EAP_HOME/bin/jboss-cli.sh
For Windows Server, use the EAP_HOME\bin\jboss-cli.bat script.
Connect to a Running Serverconnect
Or you can launch the management CLI and connect in one step by using the EAP_HOME/bin/jboss-cli.sh --connect command.
Display Help
Use the following command for general help.
Use the following command for help on a specific command.
deploy --helpQuit the Management CLIquitView System Settings
The following command uses the read-attribute operation to display whether the example datasource is enabled.
/subsystem=datasources/data-source=ExampleDS:read-attribute(name=enabled)
"outcome" =& "success",
"result" =& true
When running in a managed domain, you must specify which profile to update by preceding the command with /profile=PROFILE_NAME.
/profile=default/subsystem=datasources/data-source=ExampleDS:read-attribute(name=enabled)
The following command uses the write-attribute operation to disable the example datasource.
/subsystem=datasources/data-source=ExampleDS:write-attribute(name=enabled,value=false)Start Servers
The management CLI can also be used to start and stop servers when running in a managed domain.
/host=HOST_NAME/server-config=server-one:start3.3.2. Management Console
The management console is a web-based administration tool for JBoss EAP.
Use the management console to start and stop servers, deploy and undeploy applications, tune system settings, and make persistent modifications to the server configuration. The management console also has the ability to perform administrative tasks, with live notifications when any changes performed by the current user require the server instance to be restarted or reloaded.
In a managed domain, server instances and server groups in the same domain can be centrally managed from the management console of the domain controller.
For a JBoss EAP instance running on the local host using the default management port, the management console can be accessed through a web browser at . You will need to authenticate with a user that has permissions to access the management console.
The management console provides the following tabs for navigating and managing your JBoss EAP standalone server or managed domain.
Learn how to accomplish several common configuration and management tasks. Take a tour to become familiar with the JBoss EAP management console.
Deployments
Add, remove, and enable deployments. In a managed domain, assign deployments to server groups.
Configuration
Configure available subsystems, which provide capabilities such as web services, messaging, or high availability. In a managed domain, manage the profiles that contain different subsystem configurations.
View runtime information, such as server status, JVM usage, and server logs. In a managed domain, manage your hosts, server groups, and servers.
Access Control
Assign roles to users and groups when using Role-Based Access Control.
Apply patches to your JBoss EAP instances.
To take a tour of the updated management console, click the Take a Tour link on the management console home page.
To view details about the form fields, click the Need Help? link.
To view the message history of configuration actions you have performed, click the Messages link in the top-right of the management console.
3.3.2.1. Enable/Disable Management Console
You can enable or disable the management console by setting the console-enabled boolean attribute of /core-service=management/management-interface=http-interface resource. For master host in domain mode, /host=master/core-service=management/management-interface=http-interface.
For example, to enable:
/core-service=management/management-interface=http-interface:write-attribute(name=console-enabled,value=true)
For example, to disable:
/core-service=management/management-interface=http-interface:write-attribute(name=console-enabled,value=false)3.3.2.2. Change the Language of the Management Console
By default, the language settings of the management console is English. You can choose to use one of the following languages instead:
German (de)
Simplified Chinese (zh-Hans)
Brazilian Portuguese (pt-BR)
French (fr)
Spanish (es)
Japanese (ja)
To Change the Language of the Management Console
Log in to the management console.
Click the Settings link in the lower-right corner of the management console.
Select the required language from the Locale selection box.
Select Save. A confirmation box informs you that you need to reload the application.
Click Confirm. The system refreshes your web browser automatically to use the selected locale.
3.4. Management APIs3.4.1. HTTP API
The HTTP API endpoint is the entry point for management clients that rely on the HTTP protocol to integrate with the JBoss EAP management layer.
The HTTP API is used by the JBoss EAP management console but offers integration capabilities for other clients as well. By default, the HTTP API is accessible at http://HOST_NAME:9990/management. This URL will display the raw attributes and values exposed to the API.
Read Resources
While you can read, write, or perform other operations using the HTTP POST method, you can perform some read operations using a GET request. The HTTP GET method uses the following URL format.
http://HOST_NAME:9990/management/PATH_TO_RESOURCE?operation=OPERATION&PARAMETER=VALUE
Be sure to replace all of the replaceable values with those that are appropriate for your request. The following values are the available options for the OPERATION replaceable value:
The following example URLs show how to perform read operations using the HTTP API.
Example: Read All Attributes and Values for a Resource
http://HOST_NAME:9990/management/subsystem/undertow/server/default-server/http-listener/default
This displays all attributes and their values for the default HTTP listener.
The default operation is read-resource.
Example: Read the Value of an Attribute for a Resource
http://HOST_NAME:9990/management/subsystem/datasources/data-source/ExampleDS?operation=attribute&name=enabled
This reads the value of the enabled attribute for the ExampleDS datasource.
You can use the HTTP POST method to update configuration values or perform other operations using the HTTP API. You must provide authentication for these operations.
The following examples show how to update resources using the HTTP API.
Example: Update the Value of an Attribute for a Resource
$ curl --digest http://HOST_NAME:9990/management --header "Content-Type: application/json" -u USERNAME:PASSWORD -d '{"operation":"write-attribute", "address":["subsystem","datasources","data-source","ExampleDS"], "name":"enabled", "value":"false", "json.pretty":"1"}'
This updates the value of the enabled attribute for the ExampleDS datasource to false.
Example: Issue an Operation to the Server
$ curl --digest http://localhost:9990/management --header "Content-Type: application/json" -u USERNAME:PASSWORD -d '{"operation":"reload"}'
This reloads the server.
for information on how to deploy applications to JBoss EAP using the HTTP API.
3.4.2. Native API
The native API endpoint is the entry point for management clients that rely on the native protocol to integrate with the JBoss EAP management layer. The native API is used by the JBoss EAP management CLI but offers integration capabilities for other clients as well.
The following Java code shows an example of how to execute management operations from Java code using the native API.
You must add the required JBoss EAP libraries, found in the EAP_HOME/bin/client/jboss-cli-client.jar file, to your class path.
Example: Using the Native API to Read Resources
// Create the management client
ModelControllerClient client = ModelControllerClient.Factory.create("localhost", 9990);
// Create the operation request
ModelNode op = new ModelNode();
// Set the operation
op.get("operation").set("read-resource");
// Set the address
ModelNode address = op.get("address");
address.add("subsystem", "undertow");
address.add("server", "default-server");
address.add("http-listener", "default");
// Execute the operation and manipulate the result
ModelNode returnVal = client.execute(op);
System.out.println("Outcome: " + returnVal.get("outcome").toString());
System.out.println("Result: " + returnVal.get("result").toString());
// Close the client
client.close();
3.5. Configuration Data3.5.1. Standalone Server Configuration Files
The standalone configuration files are located in the EAP_HOME/standalone/configuration/ directory. A separate file exists for each of the four predefined profiles (default, ha, full, full-ha).
Table 3.1. Standalone Configuration FilesConfiguration FilePurpose
standalone.xml
This standalone configuration file is the default configuration that is used when you start your standalone server. It contains all information about the server, including subsystems, networking, deployments, socket bindings, and other configurable details. It does not provide the subsystems necessary for messaging or high availability.
standalone-ha.xml
This standalone configuration file includes all of the default subsystems and adds the modcluster and jgroups subsystems for high availability. It does not provide the subsystems necessary for messaging.
standalone-full.xml
This standalone configuration file includes all of the default subsystems and adds the messaging-activemq and iiop-openjdk subsystems. It does not provide the subsystems necessary for high availability.
standalone-full-ha.xml
This standalone configuration file includes support for every possible subsystem, including those for messaging and high availability.
By default, starting JBoss EAP as a standalone server uses the standalone.xml file. To start JBoss EAP with a different configuration, use the --server-config argument. For example,
$ EAP_HOME/bin/standalone.sh --server-config=standalone-full.xml3.5.2. Managed Domain Configuration Files
The managed domain configuration files are located in the EAP_HOME/domain/configuration/ directory.
Table 3.2. Managed Domain Configuration FilesConfiguration FilePurpose
domain.xml
This is the main configuration file for a managed domain. Only the domain master reads this file. This file contains the configurations for all of the profiles (default, ha, full, full-ha).
This file includes configuration details specific to a physical host in a managed domain, such as network interfaces, socket bindings, the name of the host, and other host-specific details. The host.xml file includes all of the features of both host-master.xml and host-slave.xml, which are described below.
host-master.xml
This file includes only the configuration details necessary to run a server as the master domain controller.
host-slave.xml
This file includes only the configuration details necessary to run a server as a managed domain host controller.
By default, starting JBoss EAP in a managed domain uses the host.xml file. To start JBoss EAP with a different configuration, use the --host-config argument. For example,
$ EAP_HOME/bin/domain.sh --host-config=host-master.xml3.5.3. Backing Up Configuration Data
In order to later restore the JBoss EAP server configuration, items in the following locations should be backed up:
EAP_HOME/standalone/configuration/
Back up the entire directory to save user data, server configuration, and logging settings for standalone servers.
EAP_HOME/domain/configuration/
Back up the entire directory to save user and profile data, domain and host configuration, and logging settings for managed domains.
EAP_HOME/modules/
Back up any custom modules.
EAP_HOME/welcome-content/
Back up any custom welcome content.
EAP_HOME/bin/
Back up any custom scripts or startup configuration files.
3.5.4. Configuration File Snapshots
To assist in the maintenance and management of the server, JBoss EAP creates a timestamped version of the original configuration file at the time of startup. Any additional configuration changes made by management operations will result in the original file being automatically backed up, and a working copy of the instance being preserved for reference and rollback. Additionally, configuration snapshots can be taken, which are point-in-time copies of the current server configuration. These snapshots can be saved and loaded by an administrator.
The following examples use the standalone.xml file, but the same process applies to the domain.xml and host.xml files.
Take a Snapshot
Use the management CLI to take a snapshot of the current configurations.
:take-snapshot
"outcome" =& "success",
"result" =& "EAP_HOME/standalone/configuration/standalone_xml_history/snapshot/109702standalone.xml"
}List Snapshots
Use the management CLI to list all snapshots that have been taken.
:list-snapshots
"outcome" =& "success",
"result" =& {
"directory" =& "EAP_HOME/standalone/configuration/standalone_xml_history/snapshot",
"names" =& [
"109702standalone.xml",
"715958standalone.xml"
}Delete a Snapshot
Use the management CLI to delete a snapshot.
:delete-snapshot(name=109702standalone.xml)Start the Server with a Snapshot
The server can be started using a snapshot or an automatically-saved version of the configuration.
Navigate to the EAP_HOME/standalone/configuration/standalone_xml_history directory and identify the snapshot or saved configuration file to be loaded.
Start the server and point to the selected configuration file. Pass in the file path relative to the configuration directory, EAP_HOME/standalone/configuration/.
$ EAP_HOME/bin/standalone.sh --server-config=standalone_xml_history/snapshot/109702standalone.xml
When running in a managed domain, use the --host-config argument instead to specify the configuration file.
3.5.5. View Configuration Changes
JBoss EAP 7 provides the ability to track configuration changes made to the running system. This allows administrators to view a history of configuration changes made by other authorized users.
Changes are stored in memory and are not persisted between server restarts. This feature is not a replacement for .
To enable to tracking of configuration changes, use the following management CLI command. You can specify how many entries to store using the max-history attribute.
/core-service=management/service=configuration-changes:add(max-history=10)
To view the list of most recent configuration changes, use the following management CLI command.
/core-service=management/service=configuration-changes:list-changes
This will list each configuration change made, with the date, origin, outcome, and operation details. For example, the below output from the list-changes command shows configuration changes, with the most recent displayed first.
"outcome" =& "success",
"result" =& [
"operation-date" =& "T18:37:00.354Z",
"access-mechanism" =& "NATIVE",
"remote-address" =& "127.0.0.1/127.0.0.1",
"outcome" =& "success",
"operations" =& [{
"address" =& [],
"operation" =& "reload",
"operation-headers" =& {
"caller-type" =& "user",
"access-mechanism" =& "NATIVE"
"operation-date" =& "T18:34:16.859Z",
"access-mechanism" =& "NATIVE",
"remote-address" =& "127.0.0.1/127.0.0.1",
"outcome" =& "success",
"operations" =& [{
"address" =& [
("subsystem" =& "datasources"),
("data-source" =& "ExampleDS")
"operation" =& "write-attribute",
"name" =& "enabled",
"value" =& false,
"operation-headers" =& {
"caller-type" =& "user",
"access-mechanism" =& "NATIVE"
"operation-date" =& "T18:24:11.670Z",
"access-mechanism" =& "HTTP",
"remote-address" =& "127.0.0.1/127.0.0.1",
"outcome" =& "success",
"operations" =& [{
"operation" =& "remove",
"address" =& [
("subsystem" =& "messaging-activemq"),
("server" =& "default"),
("jms-queue" =& "ExpiryQueue")
"operation-headers" =& {"access-mechanism" =& "HTTP"}
This example lists the details of three operations performed that impacted the configuration:
Reloading the server from the management CLI.
Disabling the ExampleDS datasource from the management CLI.
Removing the ExpiryQueue queue from the management console.
3.5.6. Property Replacement
JBoss EAP allows you to use expressions to define replaceable properties in place of literal values in the configuration. Expressions use the format ${PARAMETER:DEFAULT_VALUE}. If the specified parameter is set, then the parameter’s value will be used. Otherwise, the default value provided will be used.
The supported sources for resolving expressions are system properties, environment variables, and the vault. For deployments only, the source can be properties listed in a META-INF/jboss.properties file in the deployment archive. For deployment types that support subdeployments, the resolution is scoped to all subdeployments if the properties file is in the outer deployment, for example the EAR. If the properties file is in the subdeployment, then the resolution is scoped just to that subdeployment.
The example below from the standalone.xml configuration file sets the inet-address for the public interface to 127.0.0.1 unless the jboss.bind.address parameter is set.
&interface name="public"&
&inet-address value="${jboss.bind.address:127.0.0.1}"/&
&/interface&
The jboss.bind.address parameter can be set when starting EAP as a standalone server with the following command:
$ EAP_HOME/bin/standalone.sh -Djboss.bind.address=IP_ADDRESSNested Expressions
Expressions can be nested, which allows for more advanced use of expressions in place of fixed values. The format of a nested expression is like that of a normal expression, but one expression is embedded in the other, for example:
${SYSTEM_VALUE_1${SYSTEM_VALUE_2}}
Nested expressions are evaluated recursively, so the inner expression is first evaluated, then the outer expression is evaluated. Expressions may also be recursive, where an expression resolves to another expression, which is then resolved. Nested expressions are permitted anywhere that expressions are permitted, with the exception of management CLI commands.
An example of where a nested expression might be used is if the password used in a datasource definition is masked. The configuration for the datasource might have the following line:
&password&${VAULT::ds_ExampleDS::password::1}&/password&
The value of ds_ExampleDS could be replaced with a system property (datasource_name) using a nested expression. The configuration for the datasource could instead have the following line:
&password&${VAULT::${datasource_name}::password::1}&/password&
JBoss EAP would first evaluate the expression ${datasource_name}, then input this to the larger expression and evaluate the resulting expression. The advantage of this configuration is that the name of the datasource is abstracted from the fixed configuration.
Descriptor-Based Property Replacement
Application configuration, such as datasource connection parameters, typically varies between development, testing, and production environments. This variance is sometimes accommodated by build system scripts, as the Java EE specification does not contain a method to externalize these configurations. With JBoss EAP, you can use descriptor-based property replacement to manage configuration externally.
Descriptor-based property replacement substitutes properties based on descriptors, allowing you to remove assumptions about the environment from the application and the build chain. Environment-specific configurations can be specified in deployment descriptors rather than annotations or build system scripts. You can provide configuration in files or as parameters at the command line.
There are several flags in the ee subsystem that control whether property replacement is applied.
JBoss-specific descriptor replacement is controlled by the jboss-descriptor-property-replacement flag and is enabled by default. When enabled, properties can be replaced in the following deployment descriptors:
jboss-ejb3.xml
jboss-app.xml
jboss-web.xml
The following management CLI command can be used to enable or disable property replacement in JBoss-specific descriptors:
/subsystem=ee:write-attribute(name="jboss-descriptor-property-replacement",value=VALUE)
Java EE descriptor replacement controlled by the spec-descriptor-property-replacement flag and is disabled by default. When enabled, properties can be replaced in the following deployment descriptors:
ejb-jar.xml
persistence.xml
application.xml
The following management CLI command can be used to enable or disable property replacement in Java EE descriptors:
/subsystem=ee:write-attribute(name="spec-descriptor-property-replacement",value=VALUE)3.6. File System Paths
JBoss EAP uses logical names for file system paths. Other areas of the configuration can then reference the paths using their logical name, avoiding the need to use absolute paths for each instance and allowing specific host configurations to resolve to universal logical names.
For example, the default logging subsystem configuration declares jboss.server.log.dir as the logical name for the server log directory.
Example: Relative Path Example for the Server Log Directory
&file relative-to="jboss.server.log.dir" path="server.log"/&
JBoss EAP automatically provides a number of standard paths without any need for the user to configure them in a configuration file.
Table 3.3. Standard PathsPropertyDescription
java.ext.dirs
The Java development kit extension directory paths.
The Java installation directory
jboss.controller.temp.dir
A common alias for standalone servers and managed domains. The directory to be used for temporary file storage. Equivalent to jboss.domain.temp.dir in a managed domain, and jboss.server.temp.dir on a standalone server.
jboss.domain.base.dir
The base directory for domain content.
jboss.domain.config.dir
The directory that contains the domain configuration.
jboss.domain.data.dir
The directory that the domain will use for persistent data file storage.
jboss.domain.log.dir
The directory that the domain will use for persistent log file storage.
jboss.domain.temp.dir
The directory that the domain will use for temporary file storage.
jboss.domain.deployment.dir
The directory that the domain will use for storing deployed content.
jboss.domain.servers.dir
The directory that the domain will use for storing outputs of the managed domain instances.
jboss.home.dir
The root directory of the JBoss EAP distribution.
jboss.server.base.dir
The base directory for standalone server content.
jboss.server.config.dir
The directory that contains the standalone server configuration.
jboss.server.data.dir
The directory the standalone server will use for persistent data file storage.
jboss.server.log.dir
The directory the standalone server will use for log file storage.
jboss.server.temp.dir
The directory the standalone server will use for temporary file storage.
jboss.server.deploy.dir
The directory that the standalone server will use for storing deployed content.
The user’s current working directory.
The user home directory.
3.6.1. Override a Standard Path
You can override the default locations of the standard paths that begin with jboss.server.* or jboss.domain.*. This can be done in one of two ways:
Pass in the command-line argument when you start the server. For example:
$ EAP_HOME/bin/standalone.sh -Djboss.server.log.dir=/var/log
Modify the JAVA_OPTS variable in the server configuration file (standalone.conf or domain.conf). For example:
JAVA_OPTS="$JAVA_OPTS -Djboss.server.log.dir=/var/log"Overriding a Managed Domain’s Standard Paths
In this example, the objective is to store domain files in the /opt/jboss_eap/domain_data directory, and give each top-level directory a custom name. The default directory grouping, by-server, is used.
Log files are to be stored in the all_logs subdirectory
Data files are to be stored in the all_data subdirectory
Temporary files are to be stored in the all_temp subdirectory
Servers' files are to be stored in the all_servers subdirectory
To achieve this configuration, you would override several system properties when starting JBoss EAP.
$ EAP_HOME/bin/domain.sh -Djboss.domain.temp.dir=/opt/jboss_eap/domain_data/all_temp -Djboss.domain.log.dir=/opt/jboss_eap/domain_data/all_logs -Djboss.domain.data.dir=/opt/jboss_eap/domain_data/all_data -Djboss.domain.servers.dir=/opt/jboss_eap/domain_data/all_servers
The resulting path structure will be as follows:
/opt/jboss_eap/domain_data/
├── all_data
├── all_logs
├── all_servers
├── server-one
├── data
├── log
└── tmp
└── server-two
├── data
├── log
└── tmp
└── all_temp3.6.2. Add a Custom Path
You can add a custom file system path using the management CLI or the management console.
From the management CLI, you can add a new path using the following management CLI command.
/path=my.custom.path:add(path=/my/custom/path)
From the management console, you can configure file system paths by navigating to the Configuration tab and selecting Paths. From there, you can add, modify, and remove paths.
You can then use this custom path in your configuration. For example, the below log handler uses a custom path for its relative path.
&subsystem xmlns="urn:jboss:domain:logging:3.0"&
&periodic-rotating-file-handler name="FILE" autoflush="true"&
&formatter&
&named-formatter name="PATTERN"/&
&/formatter&
&file relative-to="my.custom.path" path="server.log"/&
&suffix value=".yyyy-MM-dd"/&
&append value="true"/&
&/periodic-rotating-file-handler&
&/subsystem&3.6.3. Directory Grouping
In a managed domain, each server’s files are stored in the EAP_HOME/domain directory. You can specify how to organize the subdirectories for servers using the host controller’s directory-grouping attribute. Directories can be grouped either by server or by type. By default, directories are grouped by server.
Directory Grouping by Server
By default, directories are grouped by server. If your administration is server-centric, this configuration is recommended. For example, it allows backups and log file handling to be configured per server instance.
If JBoss EAP is installed using the ZIP installation method, the default directory structure (grouped by server) will be as follows.
EAP_HOME/domain
└─ servers
├── server-one
├── data
├── tmp
└── log
└── server-two
├── data
├── tmp
└── log
To group domain directories by server, enter the following management CLI command:
/host=HOST_NAME:write-attribute(name=directory-grouping,value=by-server)
This will update the host controller’s host.xml configuration file:
&servers directory-grouping="by-server"&
&server name="server-one" group="main-server-group"/&
&server name="server-two" group="main-server-group" auto-start="true"&
&socket-bindings port-offset="150"/&
&/servers&Directory Grouping by Type
Instead of grouping directories by server, you can instead group by file type. If your administration is file type-centric, this configuration is recommended. For example, this would allow you to easily back up only data files.
If JBoss EAP is installed using the ZIP installation method and the domain’s files are grouped by type, the directory structure will be as follows.
EAP_HOME/domain
├── data
└── servers
├── server-one
└── server-two
├── log
└── servers
├── server-one
└── server-two
└── tmp
└── servers
├── server-one
└── server-two
To group domain directories by type, enter the following management CLI command:
/host=HOST_NAME:write-attribute(name=directory-grouping,value=by-type)
This will update the host controller’s host.xml configuration file:
&servers directory-grouping="by-type"&
&server name="server-one" group="main-server-group"/&
&server name="server-two" group="main-server-group" auto-start="true"&
&socket-bindings port-offset="150"/&
&/servers&3.7. System Properties
You can use Java system properties to configure many JBoss EAP options, as well as set any name-value pair for use within the application server.
System properties can be used to override default values in the JBoss EAP configuration. For example, the following XML configuration for the public interface bind address shows that it can be set by the jboss.bind.address system property, but if the system property is not provided, it will default to 127.0.0.1.
&inet-address value="${jboss.bind.address:127.0.0.1}"/&
There are a few ways you can set system properties in JBoss EAP, including:
If you use a JBoss EAP managed domain, system properties can be applied to either the whole domain, a specific server group, a specific host and all its server instances, or just to one specific server instance. As with most other JBoss EAP domain settings, a system property set at a more specific level will override a more abstract one. See the
chapter for more information.
Passing a System Property to the Startup Script
You can pass a system property to the JBoss EAP startup script by using the -D argument. For example:
$ EAP_HOME/bin/standalone.sh -Djboss.bind.address=192.168.1.2
This method of setting the system property is especially useful for JBoss EAP options that need to be set before JBoss EAP starts.
Setting a System Property Using the Management CLI
Using the management CLI, you can set a system property using the following syntax:
/system-property=PROPERTY_NAME:add(value=PROPERTY_VALUE)
For example:
/system-property=jboss.bind.address:add(value=192.168.1.2)
When setting system properties using the management CLI, some JBoss EAP options, including the above example of jboss.bind.address, will only take effect after the next server restart.
For a managed domain, the above example configures a system property for the entire domain, but you can also set or override system properties at more specific levels of the domain configuration.
Setting a System Property Using the Management Console
For a standalone JBoss EAP server, you can configure system properties in the management console under the Configuration tab. Select System Properties, and click the View button.
For a managed domain:
Domain-level system properties can be set in the Configuration tab. Select System Properties, and click the View button.
Server group, and server-level system properties can be set in the Runtime tab. Select the server group or server you want to configure, click the View button next to the server group or server name, and select the System Properties tab.
Host-level system properties can be set in the Runtime tab. Select the host you want to configure, then using the drop-down menu next to the host name, select Properties.
Setting a System Property Using JAVA_OPTS
System properties can also be configured using the JAVA_OPTS environment variable. There are many ways to modify JAVA_OPTS, but JBoss EAP provides a configuration file for setting JAVA_OPTS that is used by the JBoss EAP process.
For a standalone server, this file is EAP_HOME/bin/standalone.conf, or for a managed domain, it is EAP_HOME/bin/domain.conf. For Microsoft Windows systems these files have a .bat extension.
For an RPM installation, the
is the preferred location to modify JAVA_OPTS to configure system properties. For more information, see .
Add your system property definition to JAVA_OPTS in the relevant configuration file. The examples below demonstrate setting the bind address on a Red Hat Enterprise Linux system.
For standalone.conf, add your JAVA_OPTS system property definition at the end of the file. For example:
# Set the bind address
JAVA_OPTS="$JAVA_OPTS -Djboss.bind.address=192.168.1.2"
For domain.conf, JAVA_OPTS must be set before the process controller JAVA_OPTS setting. For example:
# Set the bind address
JAVA_OPTS="$JAVA_OPTS -Djboss.bind.address=192.168.1.2"
# The ProcessController process uses its own set of java options
if [ "x$PROCESS_CONTROLLER_JAVA_OPTS" = "x" ]; then
...3.8. Management Audit Logging
You can enable audit logging for the management interfaces, which will log all operations performed using the management console, management CLI, or custom application that uses the Management API. Audit log entries are stored in JSON format. By default, audit logging is disabled.
You can configure audit logging to output to a
Login and logout events cannot be audited as there is no authenticated session in JBoss EAP. Instead, audit messages are logged when an operation is received from the user.
Standalone Server Audit Logging
Though disabled by default, the default audit logging configuration writes to a file.
&audit-log&
&formatters&
&json-formatter name="json-formatter"/&
&/formatters&
&handlers&
&file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/&
&/handlers&
&logger log-boot="true" log-read-only="false" enabled="false"&
&handlers&
&handler name="file"/&
&/handlers&
&/audit-log&
This configuration can be read using the following management CLI command.
/core-service=management/access=audit:read-resource(recursive=true)
to enable audit logging for a standalone server.
Managed Domain Audit Logging
Though disabled by default, the default audit logging configuration writes a file for each host and for each server.
&audit-log&
&formatters&
&json-formatter name="json-formatter"/&
&/formatters&
&handlers&
&file-handler name="host-file" formatter="json-formatter" relative-to="jboss.domain.data.dir" path="audit-log.log"/&
&file-handler name="server-file" formatter="json-formatter" relative-to="jboss.server.data.dir" path="audit-log.log"/&
&/handlers&
&logger log-boot="true" log-read-only="false" enabled="false"&
&handlers&
&handler name="host-file"/&
&/handlers&
&server-logger log-boot="true" log-read-only="false" enabled="false"&
&handlers&
&handler name="server-file"/&
&/handlers&
&/server-logger&
&/audit-log&
This configuration can be read using the following management CLI command.
/host=HOST_NAME/core-service=management/access=audit:read-resource(recursive=true)
to enable audit logging for a managed domain.
3.8.1. Enable Management Audit Logging
JBoss EAP is preconfigured with file handlers for audit logging, though audit logging is disabled by default. The management CLI command to enable audit logging depends on whether you are running as a standalone server or in a managed domain. See
for file handler attributes.
To set up syslog audit logging, see .
Enable Standalone Server Audit Logging
Audit logging can be enabled using the following command.
/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)
By default, this will write the audit log to EAP_HOME/standalone/data/audit-log.log.
Enable Managed Domain Audit Logging
The default audit logging configuration for a managed domain is preconfigured to write an audit log for each host and each server.
Audit logging for each host can be enabled using the following command.
/host=HOST_NAME/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)
By default, this will write the audit logs to EAP_HOME/domain/data/audit-log.log.
Audit logging for each server can be enabled using the following command.
/host=HOST_NAME/core-service=management/access=audit/server-logger=audit-log:write-attribute(name=enabled,value=true)
By default, this will write the audit logs to EAP_HOME/domain/servers/SERVER_NAME/data/audit-log.log
3.8.2. Send Management Audit Logging to a Syslog Server
A syslog handler specifies the parameters by which audit log entries are sent to a syslog server, specifically the syslog server’s host name and the port on which the syslog server is listening. Sending audit logging to a syslog server provides more security options than logging to a local file or local syslog server. Multiple syslog handlers can be defined and be active at the same time.
By default, audit logging is preconfigured to output to a file when enabled. Use the following steps to set up and enable audit logging to a syslog server. See
for syslog handler attributes.
Add a syslog handler.
Create the syslog handler, specifying the host and port of the syslog server. In a managed domain, you must precede the /core-service commands with /host=HOST_NAME.
/core-service=management/access=audit/syslog-handler=SYSLOG_HANDLER_NAME:add(formatter=json-formatter)
/core-service=management/access=audit/syslog-handler=SYSLOG_HANDLER_NAME/protocol=udp:add(host=HOST_NAME,port=PORT)
The parameters to pass in differ depending on the protocol specified.
To configure the handler to use TLS to communicate securely with the syslog server, you must also configure the authentication, for example:
/core-service=management/access=audit/syslog-handler=SYSLOG_HANDLER_NAME/protocol=tls/authentication=truststore:add(keystore-path=PATH_TO_TRUSTSTORE,keystore-password=TRUSTSTORE_PASSWORD)
Add a reference to the syslog handler.
In a managed domain, you must precede this command with /host=HOST_NAME.
/core-service=management/access=audit/logger=audit-log/handler=SYSLOG_HANDLER_NAME:add
Enable audit logging.
to enable audit logging.
Enabling audit logging to a syslog server in JBoss EAP will not work unless logging is enabled in the operating system as well.
For more information on rsyslog configurations on Red Hat Enterprise Linux, see the Basic Configuration of Rsyslog section of the System Administrator’s Guide for Red Hat Enterprise Linux at
3.8.3. Read Audit Log Entries
Audit log entries output to files are best viewed with a text viewer, while those output to a syslog server are best viewed using a syslog viewer application.
Using a tex