Data Grid Server Guide
Deploy, secure, and manage Data Grid Server
Abstract
Red Hat Data Grid Copy linkLink copied to clipboard!
Data Grid is a high-performance, distributed in-memory data store.
- Schemaless data structure
- Flexibility to store different objects as key-value pairs.
- Grid-based data storage
- Designed to distribute and replicate data across clusters.
- Elastic scaling
- Dynamically adjust the number of nodes to meet demand without service disruption.
- Data interoperability
- Store, retrieve, and query data in the grid from different endpoints.
Data Grid documentation Copy linkLink copied to clipboard!
Documentation for Data Grid is available on the Red Hat customer portal.
Data Grid downloads Copy linkLink copied to clipboard!
Access the Data Grid Software Downloads on the Red Hat customer portal.
You must have a Red Hat account to access and download Data Grid software.
Making open source more inclusive Copy linkLink copied to clipboard!
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.
Chapter 1. Getting Started with Data Grid Server Copy linkLink copied to clipboard!
Quickly set up Data Grid Server and learn the basics.
1.1. Data Grid Server Requirements Copy linkLink copied to clipboard!
Data Grid Server requires a Java Virtual Machine. See the Data Grid Supported Configurations for details on supported versions.
1.2. Downloading Server Distributions Copy linkLink copied to clipboard!
The Data Grid server distribution is an archive of Java libraries (JAR files), configuration files, and a data directory.
Procedure
- Access the Red Hat customer portal.
- Download Red Hat Data Grid 8.1 Server from the software downloads section.
Run the
md5sumorsha256sumcommand with the server download archive as the argument, for example:sha256sum jboss-datagrid-${version}-server.zip$ sha256sum jboss-datagrid-${version}-server.zipCopy to Clipboard Copied! Toggle word wrap Toggle overflow -
Compare with the
MD5orSHA-256checksum value on the Data Grid Software Details page.
Reference
- Data Grid Server README describes the contents of the server distribution.
1.3. Installing Data Grid Server Copy linkLink copied to clipboard!
Install the Data Grid Server distribution on a host system.
Prerequisites
Download a Data Grid Server distribution archive.
Procedure
- Use any appropriate tool to extract the Data Grid Server archive to the host filesystem.
unzip redhat-datagrid-8.1.1-server.zip
$ unzip redhat-datagrid-8.1.1-server.zip
The resulting directory is your $RHDG_HOME.
1.4. Creating and Modifying Users Copy linkLink copied to clipboard!
Data Grid Server requires users to authenticate against a default property realm. Before you can access Data Grid Server, you must add credentials by creating at least one user and a password. You can also add and modify the security authorization groups to which users belong.
Procedure
-
Open a terminal in
$RHDG_HOME. -
Create and modify Data Grid users with the
usercommand.
Run help user for more details about using the command.
Creating users and passwords
Linux
bin/cli.sh user create myuser -p "qwer1234!"
$ bin/cli.sh user create myuser -p "qwer1234!"Copy to Clipboard Copied! Toggle word wrap Toggle overflow Microsoft Windows
bin\cli.bat user create myuser -p "qwer1234!"
$ bin\cli.bat user create myuser -p "qwer1234!"Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Creating users with group membership
Linux
bin/cli.sh user create myuser -p "qwer1234!" -g supervisor,reader,writer
$ bin/cli.sh user create myuser -p "qwer1234!" -g supervisor,reader,writerCopy to Clipboard Copied! Toggle word wrap Toggle overflow Microsoft Windows
bin\cli.bat user create myuser -p "qwer1234!" -g supervisor,reader,writer
$ bin\cli.bat user create myuser -p "qwer1234!" -g supervisor,reader,writerCopy to Clipboard Copied! Toggle word wrap Toggle overflow
1.5. Starting Data Grid Server Copy linkLink copied to clipboard!
Run Data Grid Server on your local host.
Prerequisites
- Create at least one Data Grid user.
Procedure
-
Open a terminal in
$RHDG_HOME. Run Data Grid Server with the
serverscript.- Linux
bin/server.sh
$ bin/server.shCopy to Clipboard Copied! Toggle word wrap Toggle overflow - Microsoft Windows
bin\server.bat
bin\server.batCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Data Grid Server is running successfully when it logs the following messages:
ISPN080004: Protocol SINGLE_PORT listening on 127.0.0.1:11222 ISPN080034: Server '...' listening on http://127.0.0.1:11222 ISPN080001: Data Grid Server <version> started in <mm>ms
ISPN080004: Protocol SINGLE_PORT listening on 127.0.0.1:11222
ISPN080034: Server '...' listening on http://127.0.0.1:11222
ISPN080001: Data Grid Server <version> started in <mm>ms
Verification
-
Open
127.0.0.1:11222/console/in any browser. - Enter your credentials at the prompt then continue to Data Grid Console.
1.6. Verifying Cluster Views Copy linkLink copied to clipboard!
Data Grid nodes on the same network automatically discover each other and form clusters.
Complete this procedure to observe cluster discovery with the MPING protocol in the default TCP stack with locally running Data Grid Server instances. If you want to adjust cluster transport for custom network requirements, see the documentation for setting up Data Grid clusters.
This procedure is intended to demonstrate the principle of cluster discovery and is not intended for production environments. Doing things like specifying a port offset on the command line is not a reliable way to configure cluster transport for production.
Prerequisites
Have one instance of Data Grid Server running.
Procedure
-
Open a terminal in
$RHDG_HOME. Copy the root directory to
server2.cp -r server server2
$ cp -r server server2Copy to Clipboard Copied! Toggle word wrap Toggle overflow Specify a port offset and the
server2directory.bin/server.sh -o 100 -s server2
$ bin/server.sh -o 100 -s server2Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
You can view cluster membership in the console at 127.0.0.1:11222/console/cluster-membership.
Data Grid also logs the following messages when nodes join clusters:
Reference
1.7. Shutting Down Data Grid Server Copy linkLink copied to clipboard!
Stop individually running servers or bring down clusters gracefully.
Procedure
- Create a CLI connection to Data Grid.
Shut down Data Grid Server in one of the following ways:
Stop all nodes in a cluster with the
shutdown clustercommand, for example:[//containers/default]> shutdown cluster
[//containers/default]> shutdown clusterCopy to Clipboard Copied! Toggle word wrap Toggle overflow This command saves cluster state to the
datafolder for each node in the cluster. If you use a cache store, theshutdown clustercommand also persists all data in the cache.Stop individual server instances with the
shutdown servercommand and the server hostname, for example:[//containers/default]> shutdown server <my_server01>
[//containers/default]> shutdown server <my_server01>Copy to Clipboard Copied! Toggle word wrap Toggle overflow
The shutdown server command does not wait for rebalancing operations to complete, which can lead to data loss if you specify multiple hostnames at the same time.
Run help shutdown for more details about using the command.
Verification
Data Grid logs the following messages when you shut down servers:
ISPN080002: Data Grid Server stopping ISPN000080: Disconnecting JGroups channel cluster ISPN000390: Persisted state, version=<$version> timestamp=YYYY-MM-DDTHH:MM:SS ISPN080003: Data Grid Server stopped
ISPN080002: Data Grid Server stopping
ISPN000080: Disconnecting JGroups channel cluster
ISPN000390: Persisted state, version=<$version> timestamp=YYYY-MM-DDTHH:MM:SS
ISPN080003: Data Grid Server stopped
1.7.1. Restarting Data Grid Clusters Copy linkLink copied to clipboard!
When you bring Data Grid clusters back online after shutting them down, you should wait for the cluster to be available before adding or removing nodes or modifying cluster state.
If you shutdown clustered nodes with the shutdown server command, you must restart each server in reverse order.
For example, if you shutdown server1 and then shutdown server2, you should first start server2 and then start server1.
If you shutdown a cluster with the shutdown cluster command, clusters become fully operational only after all nodes rejoin.
You can restart nodes in any order but the cluster remains in DEGRADED state until all nodes that were joined before shutdown are running.
1.8. Data Grid Server Filesystem Copy linkLink copied to clipboard!
Data Grid Server uses the following folders on the host filesystem under $RHDG_HOME:
See the Data Grid Server README for descriptions of the each folder in your $RHDG_HOME directory as well as system properties you can use to customize the filesystem.
1.8.1. Server Root Directory Copy linkLink copied to clipboard!
Apart from resources in the bin and docs folders, the only folder under $RHDG_HOME that you should interact with is the server root directory, which is named server by default.
You can create multiple nodes under the same $RHDG_HOME directory or in different directories, but each Data Grid Server instance must have its own server root directory. For example, a cluster of 5 nodes could have the following server root directories on the filesystem:
├── server ├── server1 ├── server2 ├── server3 └── server4
├── server
├── server1
├── server2
├── server3
└── server4
Each server root directory should contain the following folders:
├── server │ ├── conf │ ├── data │ ├── lib │ └── log
├── server
│ ├── conf
│ ├── data
│ ├── lib
│ └── log
server/conf
Holds infinispan.xml configuration files for a Data Grid Server instance.
Data Grid separates configuration into two layers:
- Dynamic
-
Create mutable cache configurations for data scalability.
Data Grid Server permanently saves the caches you create at runtime along with the cluster state that is distributed across nodes. Each joining node receives a complete cluster state that Data Grid Server synchronizes across all nodes whenever changes occur. - Static
-
Add configuration to
infinispan.xmlfor underlying server mechanisms such as cluster transport, security, and shared datasources.
server/data
Provides internal storage that Data Grid Server uses to maintain cluster state.
Never directly delete or modify content in server/data.
Modifying files such as caches.xml while the server is running can cause corruption. Deleting content can result in an incorrect state, which means clusters cannot restart after shutdown.
server/lib
Contains extension JAR files for custom filters, custom event listeners, JDBC drivers, custom ServerTask implementations, and so on.
server/log
Holds Data Grid Server log files.
Reference
- Data Grid Server README
- What is stored in the <server>/data directory used by a RHDG server (Red Hat Knowledgebase)
Chapter 2. Configuring Data Grid Server Networking Copy linkLink copied to clipboard!
Data Grid servers let you configure interfaces and ports to make endpoints available across your network.
By default, Data Grid servers multiplex endpoints to a single TCP/IP port and automatically detect protocols of inbound client requests.
2.1. Server Interfaces Copy linkLink copied to clipboard!
Data Grid servers can use different strategies for binding to IP addresses.
2.1.1. Address Strategy Copy linkLink copied to clipboard!
Uses an inet-address strategy that maps a single public interface to the IPv4 loopback address (127.0.0.1).
<interfaces>
<interface name="public">
<inet-address value="${infinispan.bind.address:127.0.0.1}"/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<inet-address value="${infinispan.bind.address:127.0.0.1}"/>
</interface>
</interfaces>
You can use the CLI -b argument or the infinispan.bind.address property to select a specific address from the command-line. See Changing the Default Bind Address.
2.1.2. Loopback Strategy Copy linkLink copied to clipboard!
Selects a loopback address.
-
IPv4 the address block
127.0.0.0/8is reserved for loopback addresses. -
IPv6 the address block
::1is the only loopback address.
<interfaces>
<interface name="public">
<loopback/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<loopback/>
</interface>
</interfaces>
2.1.3. Non-Loopback Strategy Copy linkLink copied to clipboard!
Selects a non-loopback address.
<interfaces>
<interface name="public">
<non-loopback/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<non-loopback/>
</interface>
</interfaces>
2.1.4. Network Address Strategy Copy linkLink copied to clipboard!
Selects networks based on IP address.
<interfaces>
<interface name="public">
<inet-address value="10.1.2.3"/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<inet-address value="10.1.2.3"/>
</interface>
</interfaces>
2.1.5. Any Address Strategy Copy linkLink copied to clipboard!
Selects the INADDR_ANY wildcard address. As a result Data Grid servers listen on all interfaces.
<interfaces>
<interface name="public">
<any-address/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<any-address/>
</interface>
</interfaces>
2.1.6. Link Local Strategy Copy linkLink copied to clipboard!
Selects a link-local IP address.
-
IPv4 the address block
169.254.0.0/16(169.254.0.0 – 169.254.255.255) is reserved for link-local addressing. -
IPv6 the address block
fe80::/10is reserved for link-local unicast addressing.
<interfaces>
<interface name="public">
<inet-address value="10.1.2.3"/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<inet-address value="10.1.2.3"/>
</interface>
</interfaces>
2.1.7. Site Local Strategy Copy linkLink copied to clipboard!
Selects a site-local (private) IP address.
-
IPv4 the address blocks
10.0.0.0/8,172.16.0.0/12, and192.168.0.0/16are reserved for site-local addressing. -
IPv6 the address block
fc00::/7is reserved for site-local unicast addressing.
<interfaces>
<interface name="public">
<inet-address value="10.1.2.3"/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<inet-address value="10.1.2.3"/>
</interface>
</interfaces>
2.1.8. Match Host Strategy Copy linkLink copied to clipboard!
Resolves the host name and selects one of the IP addresses that is assigned to any network interface.
Data Grid servers enumerate all available operating system interfaces to locate IP addresses resolved from the host name in your configuration.
<interfaces>
<interface name="public">
<match-host value="my_host_name"/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<match-host value="my_host_name"/>
</interface>
</interfaces>
2.1.9. Match Interface Strategy Copy linkLink copied to clipboard!
Selects an IP address assigned to a network interface that matches a regular expression.
Data Grid servers enumerate all available operating system interfaces to locate the interface name in your configuration.
Use regular expressions with this strategy for additional flexibility.
<interfaces>
<interface name="public">
<match-interface value="eth0"/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<match-interface value="eth0"/>
</interface>
</interfaces>
2.1.10. Match Address Strategy Copy linkLink copied to clipboard!
Similar to inet-address but selects an IP address using a regular expression.
Data Grid servers enumerate all available operating system interfaces to locate the IP address in your configuration.
Use regular expressions with this strategy for additional flexibility.
<interfaces>
<interface name="public">
<match-address value="132\..*"/>
</interface>
</interfaces>
<interfaces>
<interface name="public">
<match-address value="132\..*"/>
</interface>
</interfaces>
2.1.11. Fallback Strategy Copy linkLink copied to clipboard!
Interface configurations can include multiple strategies. Data Grid servers try each strategy in the declared order.
For example, with the following configuration, Data Grid servers first attempt to match a host, then an IP address, and then fall back to the INADDR_ANY wildcard address:
2.1.12. Changing the Default Bind Address for Data Grid Servers Copy linkLink copied to clipboard!
You can use the server -b switch or the infinispan.bind.address system property to bind to a different address.
For example, bind the public interface to 127.0.0.2 as follows:
- Linux
bin/server.sh -b 127.0.0.2
$ bin/server.sh -b 127.0.0.2
- Windows
bin\server.bat -b 127.0.0.2
bin\server.bat -b 127.0.0.2
2.2. Socket Bindings Copy linkLink copied to clipboard!
Socket bindings map endpoint connectors to server interfaces and ports.
By default, Data Grid servers provide the following socket bindings:
<socket-bindings default-interface="public" port-offset="${infinispan.socket.binding.port-offset:0}">
<socket-binding name="default" port="${infinispan.bind.port:11222}"/>
<socket-binding name="memcached" port="11221"/>
</socket-bindings>
<socket-bindings default-interface="public" port-offset="${infinispan.socket.binding.port-offset:0}">
<socket-binding name="default" port="${infinispan.bind.port:11222}"/>
<socket-binding name="memcached" port="11221"/>
</socket-bindings>
-
socket-bindingsdeclares the default interface and port offset. -
defaultbinds to hotrod and rest connectors to the default port11222. memcachedbinds the memcached connector to port11221.NoteThe memcached endpoint is disabled by default.
To override the default interface for socket-binding declarations, specify the interface attribute.
For example, you add an interface declaration named "private":
You can then specify interface="private" in a socket-binding declaration to bind to the private IP address, as follows:
<socket-bindings default-interface="public" port-offset="${infinispan.socket.binding.port-offset:0}">
...
<socket-binding name="private_binding" interface="private" port="1234"/>
</socket-bindings>
<socket-bindings default-interface="public" port-offset="${infinispan.socket.binding.port-offset:0}">
...
<socket-binding name="private_binding" interface="private" port="1234"/>
</socket-bindings>
2.2.1. Specifying Port Offsets Copy linkLink copied to clipboard!
Configure port offsets with Data Grid servers when running multiple instances on the same host. The default port offset is 0.
Use the -o switch with the Data Grid CLI or the infinispan.socket.binding.port-offset system property to set port offsets.
For example, start a server instance with an offset of 100 as follows. With the default configuration, this results in the Data Grid server listening on port 11322.
- Linux
bin/server.sh -o 100
$ bin/server.sh -o 100
- Windows
bin\server.bat -o 100
bin\server.bat -o 100
2.3. Data Grid Protocol Handling Copy linkLink copied to clipboard!
Data Grid servers use a router connector to expose multiple protocols over the same TCP port, 11222. Using a single port for multiple protocols simplifies configuration and management and increases security by reducing the attack surface for unauthorized users.
Data Grid servers handle HTTP/1.1, HTTP/2, and Hot Rod protocol requests via port 11222 as follows:
- HTTP/1.1 upgrade headers
-
Client requests can include the
HTTP/1.1 upgradeheader field to initiate HTTP/1.1 connections with Data Grid servers. Client applications can then send theUpgrade: protocolheader field, whereprotocolis a Data Grid server endpoint. - Application-Layer Protocol Negotiation (ALPN)/Transport Layer Security (TLS)
- Client applications specify Server Name Indication (SNI) mappings for Data Grid server endpoints to negotiate protocols in a secure manner.
- Automatic Hot Rod detection
- Client requests that include Hot Rod headers automatically route to Hot Rod endpoints if the single port router configuration includes Hot Rod.
2.3.1. Configuring Clients for ALPN Copy linkLink copied to clipboard!
Configure clients to provide ALPN messages for protocol negotiation during TLS handshakes with Data Grid servers.
Prerequisites
- Enable Data Grid server endpoints with encryption.
Procedure
Provide your client application with the appropriate libraries to handle ALPN/TLS exchanges with Data Grid servers.
NoteData Grid uses Wildfly OpenSSL bindings for Java.
- Configure clients with trust stores as appropriate.
Programmatically
Hot Rod client properties
infinispan.client.hotrod.server_list = 127.0.0.1:11222 infinispan.client.hotrod.use_ssl = true infinispan.client.hotrod.trust_store_file_name = truststore.pkcs12 infinispan.client.hotrod.trust_store_password = trust_store_password
infinispan.client.hotrod.server_list = 127.0.0.1:11222
infinispan.client.hotrod.use_ssl = true
infinispan.client.hotrod.trust_store_file_name = truststore.pkcs12
infinispan.client.hotrod.trust_store_password = trust_store_password
Chapter 3. Configuring Data Grid Server Endpoints Copy linkLink copied to clipboard!
Data Grid servers provide listener endpoints that handle requests from remote client applications.
3.1. Data Grid Endpoints Copy linkLink copied to clipboard!
Data Grid endpoints expose the CacheManager interface over different connector protocols so you can remotely access data and perform operations to manage and maintain Data Grid clusters.
You can define multiple endpoint connectors on different socket bindings.
3.1.1. Hot Rod Copy linkLink copied to clipboard!
Hot Rod is a binary TCP client-server protocol designed to provide faster data access and improved performance in comparison to text-based protocols.
Data Grid provides Hot Rod client libraries in Java, C++, C#, Node.js and other programming languages.
Topology state transfer
Data Grid uses topology caches to provide clients with cluster views. Topology caches contain entries that map internal JGroups transport addresses to exposed Hot Rod endpoints.
When client send requests, Data Grid servers compare the topology ID in request headers with the topology ID from the cache. Data Grid servers send new topology views if client have older topology IDs.
Cluster topology views allow Hot Rod clients to immediately detect when nodes join and leave, which enables dynamic load balancing and failover.
In distributed cache modes, the consistent hashing algorithm also makes it possible to route Hot Rod client requests directly to primary owners.
3.1.2. REST Copy linkLink copied to clipboard!
Reference
Data Grid exposes a RESTful interface that allows HTTP clients to access data, monitor and maintain clusters, and perform administrative operations.
You can use standard HTTP load balancers to provide clients with load balancing and failover capabilities. However, HTTP load balancers maintain static cluster views and require manual updates when cluster topology changes occur.
3.1.3. Protocol Comparison Copy linkLink copied to clipboard!
| Hot Rod | HTTP / REST | |
|---|---|---|
| Topology-aware | Y | N |
| Hash-aware | Y | N |
| Encryption | Y | Y |
| Authentication | Y | Y |
| Conditional ops | Y | Y |
| Bulk ops | Y | N |
| Transactions | Y | N |
| Listeners | Y | N |
| Query | Y | Y |
| Execution | Y | N |
| Cross-site failover | Y | N |
3.2. Endpoint Connectors Copy linkLink copied to clipboard!
You configure Data Grid server endpoints with connector declarations that specify socket bindings, authentication mechanisms, and encryption configuration.
The default endpoint connector configuration is as follows:
<endpoints socket-binding="default"> <hotrod-connector name="hotrod"/> <rest-connector name="rest"/> <memcached-connector socket-binding="memcached"/> </endpoints>
<endpoints socket-binding="default">
<hotrod-connector name="hotrod"/>
<rest-connector name="rest"/>
<memcached-connector socket-binding="memcached"/>
</endpoints>
-
endpointscontains endpoint connector declarations and defines global configuration for endpoints such as default socket bindings, security realms, and whether clients must present valid TLS certificates. -
<hotrod-connector name="hotrod"/>declares a Hot Rod connector. -
<rest-connector name="rest"/>declares a Hot Rod connector. -
<memcached-connector socket-binding="memcached"/>declares a Memcached connector that uses the memcached socket binding.
Reference
urn:infinispan:server schema provides all available endpoint configuration.
3.2.1. Hot Rod Connectors Copy linkLink copied to clipboard!
Hot Rod connector declarations enable Hot Rod servers.
-
name="hotrod"logically names the Hot Rod connector. -
topology-state-transfertunes the state transfer operations that provide Hot Rod clients with cluster topology. -
authenticationconfigures SASL authentication mechanisms. -
encryptionconfigures TLS settings for client connections.
Reference
urn:infinispan:server schema provides all available Hot Rod connector configuration.
3.2.2. REST Connectors Copy linkLink copied to clipboard!
REST connector declarations enable REST servers.
-
name="rest"logically names the REST connector. -
authenticationconfigures authentication mechanisms. -
cors-rulesspecifies CORS (Cross Origin Resource Sharing) rules for cross-domain requests. -
encryptionconfigures TLS settings for client connections.
Reference
urn:infinispan:server schema provides all available REST connector configuration.
3.3. Data Grid Server Ports and Protocols Copy linkLink copied to clipboard!
Data Grid Server exposes endpoints on your network for remote client access.
| Port | Protocol | Description |
|---|---|---|
|
| TCP | Hot Rod and REST endpoint |
|
| TCP | Memcached endpoint, which is disabled by default. |
3.3.1. Configuring Network Firewalls for Remote Connections Copy linkLink copied to clipboard!
Adjust any firewall rules to allow traffic between the server and external clients.
Procedure
On Red Hat Enterprise Linux (RHEL) workstations, for example, you can allow traffic to port 11222 with firewalld as follows:
firewall-cmd --add-port=11222/tcp --permanent success firewall-cmd --list-ports | grep 11222 11222/tcp
# firewall-cmd --add-port=11222/tcp --permanent
success
# firewall-cmd --list-ports | grep 11222
11222/tcp
To configure firewall rules that apply across a network, you can use the nftables utility.
Chapter 4. Securing Access to Data Grid Servers Copy linkLink copied to clipboard!
Configure authentication and encryption mechanisms to secure access to Data Grid servers and protect your data.
4.1. Defining Data Grid Server Security Realms Copy linkLink copied to clipboard!
Security realms provide identity, encryption, authentication, and authorization information to Data Grid server endpoints.
4.1.1. Property Realms Copy linkLink copied to clipboard!
Property realms use property files to define users and groups.
users.properties maps usernames to passwords in plain-text format. Passwords can also be pre-digested if you use the DIGEST-MD5 SASL mechanism or Digest HTTP mechanism.
myuser=a_password user2=another_password
myuser=a_password
user2=another_password
groups.properties maps users to roles.
myuser=supervisor,reader,writer user2=supervisor
myuser=supervisor,reader,writer
user2=supervisor
Property realm configuration
Supported authentication mechanisms
Property realms support the following authentication mechanisms:
-
SASL:
PLAIN,DIGEST-*, andSCRAM-* -
HTTP (REST):
BasicandDigest
4.1.1.1. Creating and Modifying Users Copy linkLink copied to clipboard!
Data Grid Server requires users to authenticate against a default property realm. Before you can access Data Grid Server, you must add credentials by creating at least one user and a password. You can also add and modify the security authorization groups to which users belong.
Procedure
-
Open a terminal in
$RHDG_HOME. -
Create and modify Data Grid users with the
usercommand.
Run help user for more details about using the command.
Creating users and passwords
Linux
bin/cli.sh user create myuser -p "qwer1234!"
$ bin/cli.sh user create myuser -p "qwer1234!"Copy to Clipboard Copied! Toggle word wrap Toggle overflow Microsoft Windows
bin\cli.bat user create myuser -p "qwer1234!"
$ bin\cli.bat user create myuser -p "qwer1234!"Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Creating users with group membership
Linux
bin/cli.sh user create myuser -p "qwer1234!" -g supervisor,reader,writer
$ bin/cli.sh user create myuser -p "qwer1234!" -g supervisor,reader,writerCopy to Clipboard Copied! Toggle word wrap Toggle overflow Microsoft Windows
bin\cli.bat user create myuser -p "qwer1234!" -g supervisor,reader,writer
$ bin\cli.bat user create myuser -p "qwer1234!" -g supervisor,reader,writerCopy to Clipboard Copied! Toggle word wrap Toggle overflow
4.1.2. LDAP Realms Copy linkLink copied to clipboard!
LDAP realms connect to LDAP servers, such as OpenLDAP, Red Hat Directory Server, Apache Directory Server, or Microsoft Active Directory, to authenticate users and obtain membership information.
LDAP servers can have different entry layouts, depending on the type of server and deployment. For this reason, LDAP realm configuration is complex. It is beyond the scope of this document to provide examples for all possibile configurations.
LDAP realm configuration
- 1
- Names the LDAP realm.
- 2
- Specifies the LDAP server connection URL.
- 3
- Specifies a principal and credentials to connect to the LDAP server.Important
The principal for LDAP connections must have necessary privileges to perform LDAP queries and access specific attributes.
- 4
- Optionally tunes LDAP server connections by specifying connection timeouts and so on.
- 5
- Verifies user credentials. Data Grid attempts to connect to the LDAP server using the configured credentials. Alternatively, you can use the
user-password-mapperelement that specifies a password. - 6
- Maps LDAP entries to identities. The
rdn-identifierspecifies an LDAP attribute that finds the user entry based on a provided identifier, which is typically a username; for example, theuidorsAMAccountNameattribute. - 7
- Defines a starting context that limits searches to the LDAP subtree that contains the user entries.
- 8
- Retrieves all the groups of which the user is a member. There are typically two ways in which membership information is stored:
-
Under group entries that usually have class
groupOfNamesin thememberattribute. In this case, you can use an attribute filter as in the preceding example configuration. This filter searches for entries that match the supplied filter, which locates groups with amemberattribute equal to the user’s DN. The filter then extracts the group entry’s CN as specified byfrom, and adds it to the user’sRoles. In the user entry in the
memberOfattribute. In this case you should use an attribute reference such as the following:<attribute-reference reference="memberOf" from="cn" to="Roles" />This reference gets all
memberOfattributes from the user’s entry, extracts the CN as specified byfrom, and adds them to the user’sRoles.
-
Under group entries that usually have class
Supported authentication mechanisms
LDAP realms support the following authentication mechanisms directly:
-
SASL:
PLAIN,DIGEST-*, andSCRAM-* -
HTTP (REST):
BasicandDigest
4.1.2.1. LDAP Realm Principal Rewriting Copy linkLink copied to clipboard!
Some SASL authentication mechanisms, such as GSSAPI, GS2-KRB5 and Negotiate, supply a username that needs to be cleaned up before you can use it to search LDAP servers.
- 1
- Defines a rewriter that extracts the username from the principal using a regular expression.
4.1.3. Trust Store Realms Copy linkLink copied to clipboard!
Trust store realms use keystores that contain the public certificates of all clients that are allowed to connect to Data Grid server.
Supported authentication mechanisms
Trust store realms work with client-certificate authentication mechanisms:
-
SASL:
EXTERNAL -
HTTP (REST):
CLIENT_CERT
4.1.4. Token Realms Copy linkLink copied to clipboard!
Token realms use external services to validate tokens and require providers that are compatible with RFC-7662 (OAuth2 Token Introspection), such as Red Hat SSO.
Supported authentication mechanisms
Token realms support the following authentication mechanisms:
-
SASL:
OAUTHBEARER -
HTTP (REST):
Bearer
4.2. Creating Data Grid Server Identities Copy linkLink copied to clipboard!
Server identities are defined within security realms and enable Data Grid servers to prove their identity to clients.
4.2.1. Setting Up SSL Identities Copy linkLink copied to clipboard!
SSL identities use keystores that contain either a certificate or chain of certificates.
If security realms contain SSL identities, Data Grid servers automatically enable encryption for the endpoints that use those security realms.
Procedure
Create a keystore for Data Grid server.
ImportantData Grid server supports the following keystore formats: JKS, JCEKS, PKCS12, BKS, BCFKS and UBER.
In production environments, server certificates should be signed by a trusted Certificate Authority, either Root or Intermediate CA.
-
Add the keystore to the
$ISPN_HOME/server/confdirectory. -
Add a
server-identitiesdefinition to the Data Grid server security realm. - Specify the name of the keystore along with the password and alias.
4.2.1.1. SSL Identity Configuration Copy linkLink copied to clipboard!
The following example configures an SSL identity for Data Grid server:
- 1
- Defines identities for Data Grid server.
- 2
- Configures an SSL identity for Data Grid server.
- 3
- Names a keystore that contains Data Grid server SSL certificates.
- 4
- Specifies that the keystore is relative to the
server/confdirectory in$ISPN_HOME. - 5
- Specifies a keystore password.
- 6
- Specifies a keystore alias.
4.2.1.2. Automatically Generating Keystores Copy linkLink copied to clipboard!
Configure Data Grid servers to automatically generate keystores at startup.
Automatically generated keystores:
- Should not be used in production environments.
- Are generated whenever necessary; for example, while obtaining the first connection from a client.
- Contain certificates that you can use directly in Hot Rod clients.
Procedure
-
Include the
generate-self-signed-certificate-hostattribute for thekeystoreelement in the server configuration. - Specify a hostname for the server certificate as the value.
SSL server identity with a generated keystore
- 1
- generates a keystore using
localhost
4.2.1.3. Tuning SSL Protocols and Cipher Suites Copy linkLink copied to clipboard!
You can configure the SSL engine, via the Data Grid server SSL identity, to use specific protocols and ciphers.
You must ensure that you set the correct ciphers for the protocol features you want to use; for example HTTP/2 ALPN.
Procedure
-
Add the
engineelement to your Data Grid server SSL identity. -
Configure the SSL engine with the
enabled-protocolsandenabled-ciphersuitesattributes.
SSL engine configuration
4.2.2. Setting Up Kerberos Identities Copy linkLink copied to clipboard!
Kerberos identities use keytab files that contain service principal names and encrypted keys, derived from Kerberos passwords.
keytab files can contain both user and service account principals. However, Data Grid servers use service account principals only. As a result, Data Grid servers can provide identity to clients and allow clients to authenticate with Kerberos servers.
In most cases, you create unique principals for the Hot Rod and REST connectors. For example, you have a "datagrid" server in the "INFINISPAN.ORG" domain. In this case you should create the following service principals:
-
hotrod/datagrid@INFINISPAN.ORGidentifies the Hot Rod service. -
HTTP/datagrid@INFINISPAN.ORGidentifies the REST service.
Procedure
Create keytab files for the Hot Rod and REST services.
- Linux
ktutil ktutil: addent -password -p datagrid@INFINISPAN.ORG -k 1 -e aes256-cts Password for datagrid@INFINISPAN.ORG: [enter your password] ktutil: wkt http.keytab ktutil: quit
$ ktutil ktutil: addent -password -p datagrid@INFINISPAN.ORG -k 1 -e aes256-cts Password for datagrid@INFINISPAN.ORG: [enter your password] ktutil: wkt http.keytab ktutil: quitCopy to Clipboard Copied! Toggle word wrap Toggle overflow - Microsoft Windows
ktpass -princ HTTP/datagrid@INFINISPAN.ORG -pass * -mapuser INFINISPAN\USER_NAME ktab -k http.keytab -a HTTP/datagrid@INFINISPAN.ORG
$ ktpass -princ HTTP/datagrid@INFINISPAN.ORG -pass * -mapuser INFINISPAN\USER_NAME $ ktab -k http.keytab -a HTTP/datagrid@INFINISPAN.ORGCopy to Clipboard Copied! Toggle word wrap Toggle overflow
-
Copy the keytab files to the
$ISPN_HOME/server/confdirectory. -
Add a
server-identitiesdefinition to the Data Grid server security realm. - Specify the location of keytab files that provide service principals to Hot Rod and REST connectors.
- Name the Kerberos service principals.
4.2.2.1. Kerberos Identity Configuration Copy linkLink copied to clipboard!
The following example configures Kerberos identities for Data Grid server:
- 1
- Defines identities for Data Grid server.
- 2
- Specifies a keytab file that provides a Kerberos identity for the Hot Rod connector.
- 3
- Names the Kerberos service principal for the Hot Rod connector.
- 4
- Specifies that the keytab file must exist when Data Grid server starts.
- 5
- Specifies a keytab file that provides a Kerberos identity for the REST connector.
- 6
- Names the Kerberos service principal for the REST connector.
4.3. Configuring Endpoint Authentication Mechanisms Copy linkLink copied to clipboard!
Configure Hot Rod and REST connectors with SASL or HTTP authentication mechanisms to authenticate with clients.
Data Grid servers require user authentication to access the command line interface (CLI) and console as well as the Hot Rod and REST endpoints. Data Grid servers also automatically configure authentication mechanisms based on the security realms that you define.
4.3.1. Data Grid Server Authentication Copy linkLink copied to clipboard!
Data Grid servers automatically configure authentication mechanisms based on the security realm that you assign to endpoints.
SASL Authentication Mechanisms
The following SASL authentication mechanisms apply to Hot Rod endpoints:
| Security Realm | SASL Authentication Mechanism |
|---|---|
| Property Realms and LDAP Realms | SCRAM-*, DIGEST-*, CRAM-MD5 |
| Token Realms | OAUTHBEARER |
| Trust Realms | EXTERNAL |
| Kerberos Identities | GSSAPI, GS2-KRB5 |
| SSL/TLS Identities | PLAIN |
HTTP Authentication Mechanisms
The following HTTP authentication mechanisms apply to REST endpoints:
| Security Realm | HTTP Authentication Mechanism |
|---|---|
| Property Realms and LDAP Realms | DIGEST |
| Token Realms | BEARER_TOKEN |
| Trust Realms | CLIENT_CERT |
| Kerberos Identities | SPNEGO |
| SSL/TLS Identities | BASIC |
Default Configuration
Data Grid servers provide a security realm named "default" that uses a property realm with plain text credentials defined in $RHDG_HOME/server/ conf/users.properties, as shown in the following snippet:
The endpoints configuration assigns the "default" security realm to the Hot Rod and REST connectors, as follows:
<endpoints socket-binding="default" security-realm="default"> <hotrod-connector name="hotrod"/> <rest-connector name="rest"/> </endpoints>
<endpoints socket-binding="default" security-realm="default">
<hotrod-connector name="hotrod"/>
<rest-connector name="rest"/>
</endpoints>
As a result of the preceding configuration, Data Grid servers require authentication with a mechanism that the property realm supports.
4.3.2. Manually Configuring Hot Rod Authentication Copy linkLink copied to clipboard!
Explicitly configure Hot Rod connector authentication to override the default SASL authentication mechanisms that Data Grid servers use for security realms.
Procedure
-
Add an
authenticationdefinition to the Hot Rod connector configuration. - Specify which Data Grid security realm the Hot Rod connector uses for authentication.
- Specify the SASL authentication mechanisms for the Hot Rod endpoint to use.
- Configure SASL authentication properties as appropriate.
4.3.2.1. Hot Rod Authentication Configuration Copy linkLink copied to clipboard!
Hot Rod connector with SCRAM, DIGEST, and PLAIN authentication
Hot Rod connector with Kerberos authentication
4.3.2.2. Hot Rod Endpoint Authentication Mechanisms Copy linkLink copied to clipboard!
Data Grid supports the following SASL authentications mechanisms with the Hot Rod connector:
| Authentication mechanism | Description | Related details |
|---|---|---|
|
|
Uses credentials in plain-text format. You should use |
Similar to the |
|
|
Uses hashing algorithms and nonce values. Hot Rod connectors support |
Similar to the |
|
|
Uses salt values in addition to hashing algorithms and nonce values. Hot Rod connectors support |
Similar to the |
|
|
Uses Kerberos tickets and requires a Kerberos Domain Controller. You must add a corresponding |
Similar to the |
|
|
Uses Kerberos tickets and requires a Kerberos Domain Controller. You must add a corresponding |
Similar to the |
|
| Uses client certificates. |
Similar to the |
|
|
Uses OAuth tokens and requires a |
Similar to the |
4.3.2.3. SASL Quality of Protection (QoP) Copy linkLink copied to clipboard!
If SASL mechanisms support integrity and privacy protection settings, you can add them to your Hot Rod connector configuration with the qop attribute.
| QoP setting | Description |
|---|---|
|
| Authentication only. |
|
| Authentication with integrity protection. |
|
| Authentication with integrity and privacy protection. |
4.3.2.4. SASL Policies Copy linkLink copied to clipboard!
SASL policies let you control which authentication mechanisms Hot Rod connectors can use.
| Policy | Description | Default value |
|---|---|---|
|
| Use only SASL mechanisms that support forward secrecy between sessions. This means that breaking into one session does not automatically provide information for breaking into future sessions. | false |
|
| Use only SASL mechanisms that require client credentials. | false |
|
| Do not use SASL mechanisms that are susceptible to simple plain passive attacks. | false |
|
| Do not use SASL mechanisms that are susceptible to active, non-dictionary, attacks. | false |
|
| Do not use SASL mechanisms that are susceptible to passive dictionary attacks. | false |
|
| Do not use SASL mechanisms that accept anonymous logins. | true |
Data Grid cache authorization restricts access to caches based on roles and permissions. If you configure cache authorization, you can then set <no-anonymous value=false /> to allow anonymous login and delegate access logic to cache authorization.
Hot Rod connector with SASL policy configuration
As a result of the preceding configuration, the Hot Rod connector uses the GSSAPI mechanism because it is the only mechanism that complies with all policies.
4.3.3. Manually Configuring REST Authentication Copy linkLink copied to clipboard!
Explicitly configure REST connector authentication to override the default HTTP authentication mechanisms that Data Grid servers use for security realms.
Procedure
-
Add an
authenticationdefinition to the REST connector configuration. - Specify which Data Grid security realm the REST connector uses for authentication.
- Specify the authentication mechanisms for the REST endpoint to use.
4.3.3.1. REST Authentication Configuration Copy linkLink copied to clipboard!
REST connector with BASIC and DIGEST authentication
REST connector with Kerberos authentication
4.3.3.2. REST Endpoint Authentication Mechanisms Copy linkLink copied to clipboard!
Data Grid supports the following authentications mechanisms with the REST connector:
| Authentication mechanism | Description | Related details |
|---|---|---|
|
|
Uses credentials in plain-text format. You should use |
Corresponds to the |
|
|
Uses hashing algorithms and nonce values. REST connectors support |
Corresponds to the |
|
|
Uses Kerberos tickets and requires a Kerberos Domain Controller. You must add a corresponding |
Corresponds to the |
|
|
Uses OAuth tokens and requires a |
Corresponds to the |
|
| Uses client certificates. |
Similar to the |
4.4. Disabling Data Grid Server Authentication Copy linkLink copied to clipboard!
In local development environments or on isolated networks you can configure Data Grid servers to allow unauthenticated client requests.
Procedure
-
Remove any
security-realmattributes from theendpointsconfiguration. -
Ensure that the Hot Rod and REST connectors do not include any
authenticationdefinitions.
For example, the following configuration allows unauthenticated access to Data Grid:
<endpoints socket-binding="default"> <hotrod-connector name="hotrod"/> <rest-connector name="rest"/> </endpoints>
<endpoints socket-binding="default">
<hotrod-connector name="hotrod"/>
<rest-connector name="rest"/>
</endpoints>
4.5. Configuring Data Grid Authorization Copy linkLink copied to clipboard!
Authorization restricts the ability to perform operations with Data Grid and access data. You assign users with roles that have different permission levels.
4.5.1. Data Grid Authorization Copy linkLink copied to clipboard!
Data Grid lets you configure authorization to secure Cache Managers and cache instances. When user applications or clients attempt to perform an operation on secured Cached Managers and caches, they must provide an identity with a role that has sufficient permissions to perform that operation.
For example, you configure authorization on a specific cache instance so that invoking Cache.get() requires an identity to be assigned a role with read permission while Cache.put() requires a role with write permission.
In this scenario, if a user application or client with the reader role attempts to write an entry, Data Grid denies the request and throws a security exception. If a user application or client with the writer role sends a write request, Data Grid validates authorization and issues a token for subsequent operations.
Identity to Role Mapping
Identities are security Principals of type java.security.Principal. Subjects, implemented with the javax.security.auth.Subject class, represent a group of security Principals. In other words, a Subject represents a user and all groups to which it belongs.
Data Grid uses role mappers so that security principals correspond to roles, which represent one or more permissions.
The following image illustrates how security principals map to roles:
4.5.1.1. Permissions Copy linkLink copied to clipboard!
Permissions control access to Cache Managers and caches by restricting the actions that you can perform. Permissions can also apply to specific entities such as named caches.
| Permission | Function | Description |
|---|---|---|
| CONFIGURATION |
| Defines new cache configurations. |
| LISTEN |
| Registers listeners against a Cache Manager. |
| LIFECYCLE |
| Stops the Cache Manager. |
| ALL | - | Includes all Cache Manager permissions. |
| Permission | Function | Description |
|---|---|---|
|
|
| Retrieves entries from a cache. |
| WRITE |
| Writes, replaces, removes, evicts data in a cache. |
| EXEC |
| Allows code execution against a cache. |
| LISTEN |
| Registers listeners against a cache. |
| BULK_READ |
| Executes bulk retrieve operations. |
| BULK_WRITE |
| Executes bulk write operations. |
| LIFECYCLE |
| Starts and stops a cache. |
| ADMIN |
| Allows access to underlying components and internal structures. |
| ALL | - | Includes all cache permissions. |
| ALL_READ | - | Combines the READ and BULK_READ permissions. |
| ALL_WRITE | - | Combines the WRITE and BULK_WRITE permissions. |
Combining permissions
You might need to combine permissions so that they are useful. For example, to allow "supervisors" to run stream operations but restrict "standard" users to puts and gets only, you can define the following mappings:
<role name="standard" permission="READ WRITE" /> <role name="supervisors" permission="READ WRITE EXEC BULK"/>
<role name="standard" permission="READ WRITE" />
<role name="supervisors" permission="READ WRITE EXEC BULK"/>
Reference
4.5.1.2. Role Mappers Copy linkLink copied to clipboard!
Data Grid includes a PrincipalRoleMapper API that maps security Principals in a Subject to authorization roles. There are two role mappers available by default:
- IdentityRoleMapper
Uses the Principal name as the role name.
-
Java class:
org.infinispan.security.mappers.IdentityRoleMapper -
Declarative configuration:
<identity-role-mapper />
-
Java class:
- CommonNameRoleMapper
Uses the Common Name (CN) as the role name if the Principal name is a Distinguished Name (DN). For example the
cn=managers,ou=people,dc=example,dc=comDN maps to themanagersrole.-
Java class:
org.infinispan.security.mappers.CommonRoleMapper -
Declarative configuration:
<common-name-role-mapper />
-
Java class:
You can also use custom role mappers that implement the org.infinispan.security.PrincipalRoleMapper interface. To configure custom role mappers declaratively, use: <custom-role-mapper class="my.custom.RoleMapper" />
4.5.2. Declaratively Configuring Authorization Copy linkLink copied to clipboard!
Configure authorization in your infinispan.xml file.
Procedure
-
Configure the global authorization settings in the
cache-containerthat specify a role mapper, and define a set of roles and permissions. Configure authorization for caches to restrict access based on user roles.
Copy to Clipboard Copied! Toggle word wrap Toggle overflow If you do not want to apply all roles to a cache, explicitly define the roles that are authorized for caches as follows:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Defines authorized roles for the cache. In this example, users who have the
writerrole only are not authorized for the "secured" cache. Data Grid denies any access requests from those users.
Reference
Chapter 5. Setting Up Data Grid Clusters Copy linkLink copied to clipboard!
Data Grid requires a transport layer so nodes can automatically join and leave clusters. The transport layer also enables Data Grid nodes to replicate or distribute data across the network and perform operations such as re-balancing and state transfer.
5.1. Getting Started with Default Stacks Copy linkLink copied to clipboard!
Data Grid uses JGroups protocol stacks so nodes can send each other messages on dedicated cluster channels.
Data Grid provides preconfigured JGroups stacks for UDP and TCP protocols. You can use these default stacks as a starting point for building custom cluster transport configuration that is optimized for your network requirements.
Procedure
Locate the default JGroups stacks,
default-jgroups-*.xml, in thedefault-configsdirectory inside theinfinispan-core-11.0.9.Final-redhat-00001.jarfile.The
jarfile is in the$RHDG_HOME/libdirectory.Do one of the following:
Use the
stackattribute in yourinfinispan.xmlfile.Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Uses
default-jgroups-udp.xmlfor cluster transport.
Use the
cluster-stackargument when you start the server:bin/server.sh --cluster-stack=udp
$ bin/server.sh --cluster-stack=udpCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Data Grid logs the following message to indicate which stack it uses:
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack udp
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack udp
Reference
- JGroups cluster transport configuration for Data Grid 8.x (Red Hat knowledgebase article)
5.1.1. Default JGroups Stacks Copy linkLink copied to clipboard!
Learn about default JGroups stacks that configure cluster transport.
| File name | Stack name | Description |
|---|---|---|
|
|
| Uses UDP for transport and UDP multicast for discovery. Suitable for larger clusters (over 100 nodes) or if you are using replicated caches or invalidation mode. Minimizes the number of open sockets. |
|
|
|
Uses TCP for transport and the |
|
|
|
Uses TCP for transport and |
|
|
|
Uses TCP for transport and |
|
|
|
Uses TCP for transport and |
|
|
|
Uses TCP for transport and |
Reference
5.1.2. TCP and UDP Ports for Cluster Traffic Copy linkLink copied to clipboard!
Data Grid uses the following ports for cluster transport messages:
| Default Port | Protocol | Description |
|---|---|---|
|
| TCP/UDP | JGroups cluster bind port |
|
| UDP | JGroups multicast |
Cross-Site Replication
Data Grid uses the following ports for the JGroups RELAY2 protocol:
7900- For Data Grid clusters running on OpenShift.
7800- If using UDP for traffic between nodes and TCP for traffic between clusters.
7801- If using TCP for traffic between nodes and TCP for traffic between clusters.
5.2. Customizing JGroups Stacks Copy linkLink copied to clipboard!
Adjust and tune properties to create a cluster transport configuration that works for your network requirements.
Data Grid provides attributes that let you extend the default JGroups stacks for easier configuration. You can inherit properties from the default stacks while combining, removing, and replacing other properties.
Procedure
Create a new JGroups stack declaration in your
infinispan.xmlfile.Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Creates a custom JGroups stack named "my-stack".
Add the
extendsattribute and specify a JGroups stack to inherit properties from.Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Inherits from the default TCP stack.
-
Use the
stack.combineattribute to modify properties for protocols configured in the inherited stack. Use the
stack.positionattribute to define the location for your custom stack.For example, you might evaluate using a Gossip router and symmetric encryption with the default TCP stack as follows:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Specify the stack name as the value for the
stackattribute in thetransportconfiguration.Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Configures Data Grid to use "my-stack" for cluster transport.
Check Data Grid logs to ensure it uses the stack.
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack my-stack
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack my-stackCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Reference
- JGroups cluster transport configuration for Data Grid 8.x (Red Hat knowledgebase article)
5.2.1. Inheritance Attributes Copy linkLink copied to clipboard!
When you extend a JGroups stack, inheritance attributes let you adjust protocols and properties in the stack you are extending.
-
stack.positionspecifies protocols to modify. stack.combineuses the following values to extend JGroups stacks:Expand Value Description COMBINEOverrides protocol properties.
REPLACEReplaces protocols.
INSERT_AFTERAdds a protocol into the stack after another protocol. Does not affect the protocol that you specify as the insertion point.
Protocols in JGroups stacks affect each other based on their location in the stack. For example, you should put a protocol such as
NAKACK2after theSYM_ENCRYPTorASYM_ENCRYPTprotocol so thatNAKACK2is secured.REMOVERemoves protocols from the stack.
5.3. Using JGroups System Properties Copy linkLink copied to clipboard!
Pass system properties to Data Grid at startup to tune cluster transport.
Procedure
-
Use
-D<property-name>=<property-value>arguments to set JGroups system properties as required.
For example, set a custom bind port and IP address as follows:
bin/server.sh -Djgroups.bind.port=1234 -Djgroups.bind.address=192.0.2.0
$ bin/server.sh -Djgroups.bind.port=1234 -Djgroups.bind.address=192.0.2.0
5.3.1. System Properties for JGroups Stacks Copy linkLink copied to clipboard!
Set system properties that configure JGroups cluster transport stacks.
| System Property | Description | Default Value | Required/Optional |
|---|---|---|---|
|
| Bind address for cluster transport. |
| Optional |
|
| Bind port for the socket. |
| Optional |
|
| IP address for multicast, both discovery and inter-cluster communication. The IP address must be a valid "class D" address that is suitable for IP multicast. |
| Optional |
|
| Port for the multicast socket. |
| Optional |
|
| Time-to-live (TTL) for IP multicast packets. The value defines the number of network hops a packet can make before it is dropped. | 2 | Optional |
|
| Minimum number of threads for the thread pool. | 0 | Optional |
|
| Maximum number of threads for the thread pool. | 200 | Optional |
|
| Maximum number of milliseconds to wait for join requests to succeed. | 2000 | Optional |
|
| Number of times a thread pool needs to be full before a thread dump is logged. | 10000 | Optional |
Amazon EC3
The following system properties apply only to default-jgroups-ec2.xml:
| System Property | Description | Default Value | Required/Optional |
|---|---|---|---|
|
| Amazon S3 access key for an S3 bucket. | No default value. | Optional |
|
| Amazon S3 secret key used for an S3 bucket. | No default value. | Optional |
|
| Name of the Amazon S3 bucket. The name must exist and be unique. | No default value. | Optional |
Kubernetes
The following system properties apply only to default-jgroups-kubernetes.xml:
| System Property | Description | Default Value | Required/Optional |
|---|---|---|---|
|
| Sets the DNS record that returns cluster members. | No default value. | Required |
Google Cloud Platform
The following system properties apply only to default-jgroups-google.xml:
| System Property | Description | Default Value | Required/Optional |
|---|---|---|---|
|
| Name of the Google Compute Engine bucket. The name must exist and be unique. | No default value. | Required |
5.4. Using Inline JGroups Stacks Copy linkLink copied to clipboard!
You can insert complete JGroups stack definitions into infinispan.xml files.
5.5. Using External JGroups Stacks Copy linkLink copied to clipboard!
Reference external files that define custom JGroups stacks in infinispan.xml files.
Procedure
Add custom JGroups stack files to the
$RHDG_HOME/server/confdirectory.Alternatively you can specify an absolute path when you declare the external stack file.
Reference the external stack file with the
stack-fileelement.Copy to Clipboard Copied! Toggle word wrap Toggle overflow
5.6. Cluster Discovery Protocols Copy linkLink copied to clipboard!
Data Grid supports different protocols that allow nodes to automatically find each other on the network and form clusters.
There are two types of discovery mechanisms that Data Grid can use:
- Generic discovery protocols that work on most networks and do not rely on external services.
-
Discovery protocols that rely on external services to store and retrieve topology information for Data Grid clusters.
For instance the DNS_PING protocol performs discovery through DNS server records.
Running Data Grid on hosted platforms requires using discovery mechanisms that are adapted to network constraints that individual cloud providers impose.
Reference
- JGroups Discovery Protocols
- JGroups cluster transport configuration for Data Grid 8.x (Red Hat knowledgebase article)
5.6.1. PING Copy linkLink copied to clipboard!
PING, or UDPPING is a generic JGroups discovery mechanism that uses dynamic multicasting with the UDP protocol.
When joining, nodes send PING requests to an IP multicast address to discover other nodes already in the Data Grid cluster. Each node responds to the PING request with a packet that contains the address of the coordinator node and its own address. C=coordinator’s address and A=own address. If no nodes respond to the PING request, the joining node becomes the coordinator node in a new cluster.
PING configuration example
<config> <PING num_discovery_runs="3"/> ... </config>
<config>
<PING num_discovery_runs="3"/>
...
</config>
Reference
5.6.2. TCPPING Copy linkLink copied to clipboard!
TCPPING is a generic JGroups discovery mechanism that uses a list of static addresses for cluster members.
With TCPPING, you manually specify the IP address or hostname of each node in the Data Grid cluster as part of the JGroups stack, rather than letting nodes discover each other dynamically.
TCPPING configuration example
- 1
- For reliable discovery, Red Hat recommends
port-range=0.
Reference
5.6.3. MPING Copy linkLink copied to clipboard!
MPING uses IP multicast to discover the initial membership of Data Grid clusters.
You can use MPING to replace TCPPING discovery with TCP stacks and use multicasing for discovery instead of static lists of initial hosts. However, you can also use MPING with UDP stacks.
MPING configuration example
Reference
5.6.4. TCPGOSSIP Copy linkLink copied to clipboard!
Gossip routers provide a centralized location on the network from which your Data Grid cluster can retrieve addresses of other nodes.
You inject the address (IP:PORT) of the Gossip router into Data Grid nodes as follows:
-
Pass the address as a system property to the JVM; for example,
-DGossipRouterAddress="10.10.2.4[12001]". - Reference that system property in the JGroups configuration file.
Gossip router configuration example
Reference
5.6.5. JDBC_PING Copy linkLink copied to clipboard!
JDBC_PING uses shared databases to store information about Data Grid clusters. This protocol supports any database that can use a JDBC connection.
Nodes write their IP addresses to the shared database so joining nodes can find the Data Grid cluster on the network. When nodes leave Data Grid clusters, they delete their IP addresses from the shared database.
JDBC_PING configuration example
Add the appropriate JDBC driver to the classpath so Data Grid can use JDBC_PING.
Reference
5.6.6. DNS_PING Copy linkLink copied to clipboard!
JGroups DNS_PING queries DNS servers to discover Data Grid cluster members in Kubernetes environments such as OKD and Red Hat OpenShift.
DNS_PING configuration example
<config> <dns.DNS_PING dns_query="myservice.myproject.svc.cluster.local" /> ... </config>
<config>
<dns.DNS_PING dns_query="myservice.myproject.svc.cluster.local" />
...
</config>
Reference
- JGroups DNS_PING
- DNS for Services and Pods (Kubernetes documentation for adding DNS entries)
5.7. Encrypting Cluster Transport Copy linkLink copied to clipboard!
Secure cluster transport so that nodes communicate with encrypted messages. You can also configure Data Grid clusters to perform certificate authentication so that only nodes with valid identities can join.
5.7.1. Data Grid Cluster Security Copy linkLink copied to clipboard!
To secure cluster traffic, you configure Data Grid nodes to encrypt JGroups message payloads with secret keys.
Data Grid nodes can obtain secret keys from either:
- The coordinator node (asymmetric encryption).
- A shared keystore (symmetric encryption).
Retrieving secret keys from coordinator nodes
You configure asymmetric encryption by adding the ASYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration. This allows Data Grid clusters to generate and distribute secret keys.
When using asymmetric encryption, you should also provide keystores so that nodes can perform certificate authentication and securely exchange secret keys. This protects your cluster from man-in-the-middle (MitM) attacks.
Asymmetric encryption secures cluster traffic as follows:
- The first node in the Data Grid cluster, the coordinator node, generates a secret key.
- A joining node performs certificate authentication with the coordinator to mutually verify identity.
- The joining node requests the secret key from the coordinator node. That request includes the public key for the joining node.
- The coordinator node encrypts the secret key with the public key and returns it to the joining node.
- The joining node decrypts and installs the secret key.
- The node joins the cluster, encrypting and decrypting messages with the secret key.
Retrieving secret keys from shared keystores
You configure symmetric encryption by adding the SYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration. This allows Data Grid clusters to obtain secret keys from keystores that you provide.
- Nodes install the secret key from a keystore on the Data Grid classpath at startup.
- Node join clusters, encrypting and decrypting messages with the secret key.
Comparison of asymmetric and symmetric encryption
ASYM_ENCRYPT with certificate authentication provides an additional layer of encryption in comparison with SYM_ENCRYPT. You provide keystores that encrypt the requests to coordinator nodes for the secret key. Data Grid automatically generates that secret key and handles cluster traffic, while letting you specify when to generate secret keys. For example, you can configure clusters to generate new secret keys when nodes leave. This ensures that nodes cannot bypass certificate authentication and join with old keys.
SYM_ENCRYPT, on the other hand, is faster than ASYM_ENCRYPT because nodes do not need to exchange keys with the cluster coordinator. A potential drawback to SYM_ENCRYPT is that there is no configuration to automatically generate new secret keys when cluster membership changes. Users are responsible for generating and distributing the secret keys that nodes use to encrypt cluster traffic.
5.7.2. Configuring Cluster Transport with Asymmetric Encryption Copy linkLink copied to clipboard!
Configure Data Grid clusters to generate and distribute secret keys that encrypt JGroups messages.
Procedure
- Create a keystore with certificate chains that enables Data Grid to verify node identity.
Place the keystore on the classpath for each node in the cluster.
For Data Grid Server, you put the keystore in the $RHDG_HOME directory.
Add the
SSL_KEY_EXCHANGEandASYM_ENCRYPTprotocols to a JGroups stack in your Data Grid configuration, as in the following example:Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack for Data Grid.
- 2
- Names the keystore that nodes use to perform certificate authentication.
- 3
- Specifies the keystore password.
- 4
- Uses the
stack.combineandstack.positionattributes to insertSSL_KEY_EXCHANGEinto the default TCP stack after theVERIFY_SUSPECTprotocol. - 5
- Specifies the length of the secret key that the coordinator node generates. The default value is
2048. - 6
- Specifies the cipher engine the coordinator node uses to generate secret keys. The default value is
RSA. - 7
- Configures Data Grid to generate and distribute a new secret key when the coordinator node changes.
- 8
- Configures Data Grid to generate and distribute a new secret key when nodes leave.
- 9
- Configures Data Grid nodes to use the
SSL_KEY_EXCHANGEprotocol for certificate authentication. - 10
- Uses the
stack.combineandstack.positionattributes to insertASYM_ENCRYPTinto the default TCP stack after theSSL_KEY_EXCHANGEprotocol. - 11
- Configures the Data Grid cluster to use the secure JGroups stack.
Verification
When you start your Data Grid cluster, the following log message indicates that the cluster is using the secure JGroups stack:
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack <encrypted_stack_name>
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack <encrypted_stack_name>
Data Grid nodes can join the cluster only if they use ASYM_ENCRYPT and can obtain the secret key from the coordinator node. Otherwise the following message is written to Data Grid logs:
[org.jgroups.protocols.ASYM_ENCRYPT] <hostname>: received message without encrypt header from <hostname>; dropping it
[org.jgroups.protocols.ASYM_ENCRYPT] <hostname>: received message without encrypt header from <hostname>; dropping it
Reference
The example ASYM_ENCRYPT configuration in this procedure shows commonly used parameters. Refer to JGroups documentation for the full set of available parameters.
5.7.3. Configuring Cluster Transport with Symmetric Encryption Copy linkLink copied to clipboard!
Configure Data Grid clusters to encrypt JGroups messages with secret keys from keystores that you provide.
Procedure
- Create a keystore that contains a secret key.
Place the keystore on the classpath for each node in the cluster.
For Data Grid Server, you put the keystore in the $RHDG_HOME directory.
Add the
SYM_ENCRYPTprotocol to a JGroups stack in your Data Grid configuration, as in the following example:Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack for Data Grid.
- 2
- Names the keystore from which nodes obtain secret keys.
- 3
- Specifies the keystore type. JGroups uses JCEKS by default.
- 4
- Specifies the keystore password.
- 5
- Specifies the secret key password.
- 6
- Specifies the secret key alias.
- 7
- Uses the
stack.combineandstack.positionattributes to insertSYM_ENCRYPTinto the default TCP stack after theVERIFY_SUSPECTprotocol. - 8
- Configures the Data Grid cluster to use the secure JGroups stack.
Verification
When you start your Data Grid cluster, the following log message indicates that the cluster is using the secure JGroups stack:
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack <encrypted_stack_name>
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack <encrypted_stack_name>
Data Grid nodes can join the cluster only if they use SYM_ENCRYPT and can obtain the secret key from the shared keystore. Otherwise the following message is written to Data Grid logs:
[org.jgroups.protocols.SYM_ENCRYPT] <hostname>: received message without encrypt header from <hostname>; dropping it
[org.jgroups.protocols.SYM_ENCRYPT] <hostname>: received message without encrypt header from <hostname>; dropping it
Reference
The example SYM_ENCRYPT configuration in this procedure shows commonly used parameters. Refer to JGroups documentation for the full set of available parameters.
Chapter 6. Remotely Creating Data Grid Caches Copy linkLink copied to clipboard!
Add caches to Data Grid Server so you can store data.
6.1. Cache Configuration with Data Grid Server Copy linkLink copied to clipboard!
Caches configure the data container on Data Grid Server.
You create caches at run-time by adding definitions based on org.infinispan templates or Data Grid configuration through the console, the Command Line Interface (CLI), the Hot Rod endpoint, or the REST endpoint.
When you create caches at run-time, Data Grid Server replicates your cache definitions across the cluster.
Configuration that you declare directly in infinispan.xml is not automatically synchronized across Data Grid clusters. In this case you should use configuration management tooling, such as Ansible or Chef, to ensure that configuration is propagated to all nodes in your cluster.
6.2. Default Cache Manager Copy linkLink copied to clipboard!
Data Grid Server provides a default Cache Manager configuration. When you start Data Grid Server, it instantiates the Cache Manager so you can remotely create caches at run-time.
Default Cache Manager
- 1
- Creates a Cache Manager named "default".
- 2
- Exports Cache Manager statistics through the
metricsendpoint. - 3
- Adds a JGroups cluster transport that allows Data Grid servers to automatically discover each other and form clusters.
- 4
- Uses the default TCP stack for cluster traffic.
- 5
- Individual name for the node, must be unique across the cluster. Uses a unified hostname by default.
Examining the Cache Manager
After you start Data Grid Server and add user credentials, you can access the default Cache Manager through the Command Line Interface (CLI) or REST endpoint as follows:
CLI: Use the
describecommand in the default container.[//containers/default]> describe
[//containers/default]> describeCopy to Clipboard Copied! Toggle word wrap Toggle overflow -
REST: Navigate to
<server_hostname>:11222/rest/v2/cache-managers/default/in any browser.
6.3. Creating Caches with the Data Grid Console Copy linkLink copied to clipboard!
Dynamically add caches from templates or configuration files through the Data Grid console.
Prerequisites
Create a user and start at least one Data Grid server instance.
Procedure
-
Navigate to
<server_hostname>:11222/console/in any browser. - Log in to the console.
- Open the Data Container view.
- Select Create Cache and then add a cache from a template or with Data Grid configuration in XML or JSON format.
- Return to the Data Container view and verify your Data Grid cache.
6.4. Creating Caches with the Data Grid Command Line Interface (CLI) Copy linkLink copied to clipboard!
Use the Data Grid CLI to add caches from templates or configuration files in XML or JSON format.
Prerequisites
Create a user and start at least one Data Grid server instance.
Procedure
- Create a CLI connection to Data Grid.
Add cache definitions with the
create cachecommand.Add a cache definition from an XML or JSON file with the
--fileoption.[//containers/default]> create cache --file=configuration.xml mycache
[//containers/default]> create cache --file=configuration.xml mycacheCopy to Clipboard Copied! Toggle word wrap Toggle overflow Add a cache definition from a template with the
--templateoption.[//containers/default]> create cache --template=org.infinispan.DIST_SYNC mycache
[//containers/default]> create cache --template=org.infinispan.DIST_SYNC mycacheCopy to Clipboard Copied! Toggle word wrap Toggle overflow TipPress the tab key after the
--template=argument to list available cache templates.
Verify the cache exists with the
lscommand.[//containers/default]> ls caches mycache
[//containers/default]> ls caches mycacheCopy to Clipboard Copied! Toggle word wrap Toggle overflow Retrieve the cache configuration with the
describecommand.[//containers/default]> describe caches/mycache
[//containers/default]> describe caches/mycacheCopy to Clipboard Copied! Toggle word wrap Toggle overflow
6.5. Creating Caches with Hot Rod Clients Copy linkLink copied to clipboard!
Programmatically create caches on Data Grid Server through the RemoteCacheManager API.
The following procedure demonstrates programmatic cache creation with the Hot Rod Java client. However Hot Rod clients are available in different languages such as Javascript or C++.
Prerequisites
- Create a user and start at least one Data Grid server instance.
- Get the Hot Rod Java client.
Procedure
Configure your client with the
ConfigurationBuilderclass.Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Use the
XMLStringConfigurationclass to add cache definitions in XML format. Call the
getOrCreateCache()method to add the cache if it already exists or create it if not.Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create caches with
org.infinispantemplates as in the following example with thecreateCache()invocation:private void createCacheWithTemplate() { manager.administration().createCache("myCache", "org.infinispan.DIST_SYNC"); System.out.println("Cache created."); }private void createCacheWithTemplate() { manager.administration().createCache("myCache", "org.infinispan.DIST_SYNC"); System.out.println("Cache created."); }Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Next Steps
Try some working code examples that show you how to create remote caches with the Hot Rod Java client. Visit the Data Grid Tutorials.
6.6. Creating Data Grid Caches with HTTP Clients Copy linkLink copied to clipboard!
Add cache definitions to Data Grid servers through the REST endpoint with any suitable HTTP client.
Prerequisites
Create a user and start at least one Data Grid server instance.
Procedure
-
Create caches with
POSTrequests to/rest/v2/caches/$cacheName.
Use XML or JSON configuration by including it in the request payload.
POST /rest/v2/caches/mycache
POST /rest/v2/caches/mycache
Use the ?template= parameter to create caches from org.infinispan templates.
POST /rest/v2/caches/mycache?template=org.infinispan.DIST_SYNC
POST /rest/v2/caches/mycache?template=org.infinispan.DIST_SYNC
6.7. Data Grid Configuration Copy linkLink copied to clipboard!
Data Grid configuration in XML and JSON format.
6.7.1. XML Configuration Copy linkLink copied to clipboard!
Data Grid configuration in XML format must conform to the schema and include:
-
<infinispan>root element. -
<cache-container>definition.
Example XML Configuration
6.7.2. JSON Configuration Copy linkLink copied to clipboard!
Data Grid configuration in JSON format:
- Requires the cache definition only.
Must follow the structure of an XML configuration.
- XML elements become JSON objects.
- XML attributes become JSON fields.
Example JSON Configuration
Chapter 7. Configuring Data Grid Server Datasources Copy linkLink copied to clipboard!
Create managed datasources to optimize connection pooling and performance for database connections.
You can specify database connection properties as part of a JDBC cache store configuration. However you must do this for each cache definition, which duplicates configuration and wastes resources by creating multiple distinct connection pools.
By using shared, managed datasources, you centralize connection configuration and pooling for more efficient usage.
7.1. Datasource Configuration for JDBC Cache Stores Copy linkLink copied to clipboard!
Data Grid server configuration for datasources is composed of two sections:
-
A
connection factorythat defines how to connect to the database. -
A
connection poolthat defines how to pool and reuse connections.
- 1
- Defines a datasource name, JNDI name, and whether to enable statistics collection.
- 2
- Specifies the JDBC driver that creates connections. Place driver JARs in the
server/libdirectory. - 3
- Specifies a username for the connection.
- 4
- Specifies a corresponding password for the connection.
- 5
- Specifies the JDBC URL specific to the driver in use.
- 6
- Adds a query that verifies new connections.
- 7
- Configures one of the transaction isolation levels for the connection:
NONE,READ_UNCOMMITTED,READ_COMMITTED,REPEATABLE_READ,SERIALIZABLE. - 8
- Sets optional JDBC driver-specific connection properties.
- 9
- Defines the initial number of connections the pool contains.
- 10
- Sets the maximum number of connections in the pool.
- 11
- Sets the minimum number of connections the pool should contain.
- 12
- Specifies the time, in milliseconds, between background validation runs.
- 13
- Specifies the time, in minutes, a connections can remain idle before it is removed.
- 14
- Specifies the amount of time, in milliseconds, to block while waiting for a connection, after which an exception is thrown.
- 15
- Specifies the time, in milliseconds, a connection can be held before a leak warning occurs.
7.2. Using Datasources in JDBC Cache Stores Copy linkLink copied to clipboard!
Use a shared, managed datasource in your JDBC cache store configuration instead of specifying individual connection properties for each cache definition.
Prerequisites
Create a managed datasource for JDBC cache stores in your Data Grid server configuration.
Procedure
- Reference the JNDI name of the datasource in the JDBC cache store configuration of your cache configuration, as in the following example:
- 1
- Specifies the JNDI name that you provided for the datasource connection in your Data Grid server configuration.
Chapter 8. Remotely Executing Server-Side Tasks Copy linkLink copied to clipboard!
Define and add tasks to Data Grid servers that you can invoke from the Data Grid command line interface, REST API, or from Hot Rod clients.
You can implement tasks as custom Java classes or define scripts in languages such as JavaScript.
8.1. Creating Server Tasks Copy linkLink copied to clipboard!
Create custom task implementations and add them to Data Grid servers.
8.1.1. Server Tasks Copy linkLink copied to clipboard!
Data Grid server tasks are classes that extend the org.infinispan.tasks.ServerTask interface and generally include the following method calls:
setTaskContext()- Allows access to execution context information including task parameters, cache references on which tasks are executed, and so on. In most cases, implementations store this information locally and use it when tasks are actually executed.
getName()- Returns unique names for tasks. Clients invoke tasks with these names.
getExecutionMode()Returns the execution mode for tasks.
-
TaskExecutionMode.ONE_NODEonly the node that handles the request executes the script. Although scripts can still invoke clustered operations. -
TaskExecutionMode.ALL_NODESData Grid uses clustered executors to run scripts across nodes. For example, server tasks that invoke stream processing need to be executed on a single node because stream processing is distributed to all nodes.
-
call()-
Computes a result. This method is defined in the
java.util.concurrent.Callableinterface and is invoked with server tasks.
Server task implementations must adhere to service loader pattern requirements. For example, implementations must have a zero-argument constructors.
The following HelloTask class implementation provides an example task that has one parameter:
8.1.2. Deploying Server Tasks to Data Grid Servers Copy linkLink copied to clipboard!
Add your custom server task classes to Data Grid servers.
Prerequisites
Stop any running Data Grid servers. Data Grid does not support runtime deployment of custom classes.
Procedure
- Package your server task implementation in a JAR file.
Add a
META-INF/services/org.infinispan.tasks.ServerTaskfile that contains the fully qualified names of server tasks, for example:example.HelloTask
example.HelloTaskCopy to Clipboard Copied! Toggle word wrap Toggle overflow -
Copy the JAR file to the
$RHDG_HOME/server/libdirectory of your Data Grid server. - Add your classes to the deserialization whitelist in your Data Grid configuration. Alternatively set the whitelist using system properties.
8.2. Creating Server Scripts Copy linkLink copied to clipboard!
Create custom scripts and add them to Data Grid servers.
8.2.1. Server Scripts Copy linkLink copied to clipboard!
Data Grid server scripting is based on the javax.script API and is compatible with any JVM-based ScriptEngine implementation.
Hello World Script Example
The following is a simple example that runs on a single Data Grid server, has one parameter, and uses JavaScript:
// mode=local,language=javascript,parameters=[greetee] "Hello " + greetee
// mode=local,language=javascript,parameters=[greetee]
"Hello " + greetee
When you run the preceding script, you pass a value for the greetee parameter and Data Grid returns "Hello ${value}".
8.2.1.1. Script Metadata Copy linkLink copied to clipboard!
Metadata provides additional information about scripts that Data Grid servers use when running scripts.
Script metadata are property=value pairs that you add to comments in the first lines of scripts, such as the following example:
// name=test, language=javascript // mode=local, parameters=[a,b,c]
// name=test, language=javascript
// mode=local, parameters=[a,b,c]
-
Use comment styles that match the scripting language (
//,;;,#). -
Separate
property=valuepairs with commas. - Separate values with single (') or double (") quote characters.
| Property | Description |
|---|---|
|
| Defines the exection mode and has the following values:
|
|
| Specifies the ScriptEngine that executes the script. |
|
| Specifies filename extensions as an alternative method to set the ScriptEngine. |
|
| Specifies roles that users must have to execute scripts. |
|
| Specifies an array of valid parameter names for this script. Invocations which specify parameters not included in this list cause exceptions. |
|
| Optionally sets the MediaType (MIME type) for storing data as well as parameter and return values. This property is useful for remote clients that support particular data formats only.
Currently you can set only |
8.2.1.2. Script Bindings Copy linkLink copied to clipboard!
Data Grid exposes internal objects as bindings for script execution.
| Binding | Description |
|---|---|
|
| Specifies the cache against which the script is run. |
|
| Specifies the marshaller to use for serializing data to the cache. |
|
|
Specifies the |
|
| Specifies the instance of the script manager that runs the script. You can use this binding to run other scripts from a script. |
8.2.1.3. Script Parameters Copy linkLink copied to clipboard!
Data Grid lets you pass named parameters as bindings for running scripts.
Parameters are name,value pairs, where name is a string and value is any value that the marshaller can interpret.
The following example script has two parameters, multiplicand and multiplier. The script takes the value of multiplicand and multiplies it with the value of multiplier.
// mode=local,language=javascript multiplicand * multiplier
// mode=local,language=javascript
multiplicand * multiplier
When you run the preceding script, Data Grid responds with the result of the expression evaluation.
8.2.2. Adding Scripts to Data Grid Servers Copy linkLink copied to clipboard!
Use the command line interface to add scripts to Data Grid servers.
Prerequisites
Data Grid Server stores scripts in the ___script_cache cache. If you enable cache authorization, users require the ___script_manager role to access ___script_cache.
Procedure
Define scripts as required.
For example, create a file named
multiplication.jsthat runs on a single Data Grid server, has two parameters, and uses JavaScript to multiply a given value:// mode=local,language=javascript multiplicand * multiplier
// mode=local,language=javascript multiplicand * multiplierCopy to Clipboard Copied! Toggle word wrap Toggle overflow - Create a CLI connection to Data Grid.
Use the
taskcommand to upload scripts, as in the following example:[//containers/default]> task upload --file=multiplication.js multiplication
[//containers/default]> task upload --file=multiplication.js multiplicationCopy to Clipboard Copied! Toggle word wrap Toggle overflow Verify that your scripts are available.
[//containers/default]> ls tasks multiplication
[//containers/default]> ls tasks multiplicationCopy to Clipboard Copied! Toggle word wrap Toggle overflow
8.2.3. Programmatically Creating Scripts Copy linkLink copied to clipboard!
Add scripts with the Hot Rod RemoteCache interface as in the following example:
RemoteCache<String, String> scriptCache = cacheManager.getCache("___script_cache");
scriptCache.put("multiplication.js",
"// mode=local,language=javascript\n" +
"multiplicand * multiplier\n");
RemoteCache<String, String> scriptCache = cacheManager.getCache("___script_cache");
scriptCache.put("multiplication.js",
"// mode=local,language=javascript\n" +
"multiplicand * multiplier\n");
Reference
8.3. Running Server-Side Tasks and Scripts Copy linkLink copied to clipboard!
Execute tasks and custom scripts on Data Grid servers.
8.3.1. Running Tasks and Scripts Copy linkLink copied to clipboard!
Use the command line interface to run tasks and scripts on Data Grid clusters.
Procedure
- Create a CLI connection to Data Grid.
Use the
taskcommand to run tasks and scripts, as in the following examples:Execute a script named
multipler.jsand specify two parameters:[//containers/default]> task exec multipler.js -Pmultiplicand=10 -Pmultiplier=20 200.0
[//containers/default]> task exec multipler.js -Pmultiplicand=10 -Pmultiplier=20 200.0Copy to Clipboard Copied! Toggle word wrap Toggle overflow Execute a task named
@@cache@namesto retrieve a list of all available caches://containers/default]> task exec @@cache@names ["___protobuf_metadata","mycache","___script_cache"]
//containers/default]> task exec @@cache@names ["___protobuf_metadata","mycache","___script_cache"]Copy to Clipboard Copied! Toggle word wrap Toggle overflow
8.3.2. Programmatically Running Scripts Copy linkLink copied to clipboard!
Call the execute() method to run scripts with the Hot Rod RemoteCache interface, as in the following example:
Reference
8.3.3. Programmatically Running Tasks Copy linkLink copied to clipboard!
Call the execute() method to run tasks with the Hot Rod RemoteCache interface, as in the following example:
Reference
Chapter 9. Monitoring Data Grid Servers Copy linkLink copied to clipboard!
9.1. Working with Data Grid Server Logs Copy linkLink copied to clipboard!
Data Grid uses Apache Log4j 2 to provide configurable logging mechanisms that capture details about the environment and record cache operations for troubleshooting purposes and root cause analysis.
9.1.1. Data Grid Log Files Copy linkLink copied to clipboard!
Data Grid writes log messages to the following directory:$RHDG_HOME/${infinispan.server.root}/log
server.log-
Messages in human readable format, including boot logs that relate to the server startup.
Data Grid creates this file by default when you launch servers. server.log.json-
Messages in JSON format that let you parse and analyze Data Grid logs.
Data Grid creates this file when you enable theJSON-FILEappender.
9.1.2. Configuring Data Grid Log Properties Copy linkLink copied to clipboard!
You configure Data Grid logs with log4j2.xml, which is described in the Log4j 2 manual.
Procedure
-
Open
$RHDG_HOME/${infinispan.server.root}/conf/log4j2.xmlwith any text editor. - Change logging configuration as appropriate.
-
Save and close
log4j2.xml.
9.1.2.1. Log Levels Copy linkLink copied to clipboard!
Log levels indicate the nature and severity of messages.
| Log level | Description |
|---|---|
|
| Fine-grained debug messages, capturing the flow of individual requests through the application. |
|
| Messages for general debugging, not related to an individual request. |
|
| Messages about the overall progress of applications, including lifecycle events. |
|
| Events that can lead to error or degrade performance. |
|
| Error conditions that might prevent operations or activites from being successful but do not prevent applications from running. |
|
| Events that could cause critical service failure and application shutdown. |
In addition to the levels of individual messages presented above, the configuration allows two more values: ALL to include all messages, and OFF to exclude all messages.
9.1.2.2. Data Grid Log Categories Copy linkLink copied to clipboard!
Data Grid provides categories for INFO, WARN, ERROR, FATAL level messages that organize logs by functional area.
org.infinispan.CLUSTER- Messages specific to Data Grid clustering that include state transfer operations, rebalancing events, partitioning, and so on.
org.infinispan.CONFIG- Messages specific to Data Grid configuration.
org.infinispan.CONTAINER- Messages specific to the data container that include expiration and eviction operations, cache listener notifications, transactions, and so on.
org.infinispan.PERSISTENCE- Messages specific to cache loaders and stores.
org.infinispan.SECURITY- Messages specific to Data Grid security.
org.infinispan.SERVER- Messages specific to Data Grid servers.
org.infinispan.XSITE- Messages specific to cross-site replication operations.
9.1.2.3. Log Appenders Copy linkLink copied to clipboard!
Log appenders define how Data Grid records log messages.
- CONSOLE
-
Write log messages to the host standard out (
stdout) or standard error (stderr) stream.
Uses theorg.apache.logging.log4j.core.appender.ConsoleAppenderclass by default. - FILE
-
Write log messages to a file.
Uses theorg.apache.logging.log4j.core.appender.RollingFileAppenderclass by default. - JSON-FILE
-
Write log messages to a file in JSON format.
Uses theorg.apache.logging.log4j.core.appender.RollingFileAppenderclass by default.
9.1.2.4. Log Patterns Copy linkLink copied to clipboard!
The CONSOLE and FILE appenders use a PatternLayout to format the log messages according to a pattern.
An example is the default pattern in the FILE appender:%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p (%t) [%c{1}] %m%throwable%n
-
%d{yyyy-MM-dd HH:mm:ss,SSS}adds the current time and date. -
%-5pspecifies the log level, aligned to the right. -
%tadds the name of the current thread. -
%c{1}adds the short name of the logging category. -
%madds the log message. -
%throwableadds the exception stack trace. -
%nadds a new line.
Patterns are fully described in the PatternLayout documentation .
9.1.2.5. Enabling and Configuring the JSON Log Handler Copy linkLink copied to clipboard!
Data Grid provides a JSON log handler to write messages in JSON format.
Prerequisites
Ensure that Data Grid is not running. You cannot dynamically enable log handlers.
Procedure
-
Open
$RHDG_HOME/${infinispan.server.root}/conf/log4j2.xmlwith any text editor. Uncomment the
JSON-FILEappender and comment out theFILEappender:<!--<AppenderRef ref="FILE"/>--> <AppenderRef ref="JSON-FILE"/><!--<AppenderRef ref="FILE"/>--> <AppenderRef ref="JSON-FILE"/>Copy to Clipboard Copied! Toggle word wrap Toggle overflow - Optionally configure the JSON appender and layout.
-
Save and close
logging.properties.
When you start Data Grid, it writes each log message as a JSON map in the following file:$RHDG_HOME/${infinispan.server.root}/log/server.log.json
9.1.3. Access Logs Copy linkLink copied to clipboard!
Hot Rod and REST endpoints can record all inbound client requests as log entries with the following categories:
-
org.infinispan.HOTROD_ACCESS_LOGlogging category for the Hot Rod endpoint. -
org.infinispan.REST_ACCESS_LOGlogging category for the REST endpoint.
9.1.3.1. Enabling Access Logs Copy linkLink copied to clipboard!
Access logs for Hot Rod and REST endpoints are disabled by default. To enable either logging category, set the level to TRACE in the Data Grid logging configuration, as in the following example:
<Logger name="org.infinispan.HOTROD_ACCESS_LOG" additivity="false" level="TRACE"> <AppenderRef ref="HR-ACCESS-FILE"/> </Logger>
<Logger name="org.infinispan.HOTROD_ACCESS_LOG" additivity="false" level="TRACE">
<AppenderRef ref="HR-ACCESS-FILE"/>
</Logger>
9.1.3.2. Access Log Properties Copy linkLink copied to clipboard!
The default format for access logs is as follows:
%X{address} %X{user} [%d{dd/MMM/yyyy:HH:mm:ss Z}] "%X{method} %m
%X{protocol}" %X{status} %X{requestSize} %X{responseSize} %X{duration}%n
%X{address} %X{user} [%d{dd/MMM/yyyy:HH:mm:ss Z}] "%X{method} %m
%X{protocol}" %X{status} %X{requestSize} %X{responseSize} %X{duration}%n
The preceding format creates log entries such as the following:
127.0.0.1 - [DD/MM/YYYY:HH:MM:SS +0000] "PUT /rest/v2/caches/default/key HTTP/1.1" 404 5 77 10
Logging properties use the %X{name} notation and let you modify the format of access logs. The following are the default logging properties:
| Property | Description |
|---|---|
|
|
Either the |
|
| Principal name, if using authentication. |
|
|
Method used. |
|
|
Protocol used. |
|
|
An HTTP status code for the REST endpoint. |
|
| Size, in bytes, of the request. |
|
| Size, in bytes, of the response. |
|
| Number of milliseconds that the server took to handle the request. |
Use the header name prefixed with h: to log headers that were included in requests; for example, %X{h:User-Agent}.
9.2. Configuring Statistics, Metrics, and JMX Copy linkLink copied to clipboard!
Enable statistics that Data Grid exports to a MicroProfile Metrics endpoint or via JMX MBeans. You can also register JMX MBeans to perform management operations.
9.2.1. Enabling Data Grid Statistics Copy linkLink copied to clipboard!
Data Grid lets you enable statistics for Cache Managers and caches. However, enabling statistics for a Cache Manager does not enable statistics for the caches that it controls. You must explicitly enable statistics for your caches.
Data Grid server enables statistics for Cache Managers by default.
Procedure
- Enable statistics declaratively or programmatically.
Declaratively
<cache-container statistics="true"> <local-cache name="mycache" statistics="true"/> </cache-container>
<cache-container statistics="true">
<local-cache name="mycache" statistics="true"/>
</cache-container>
Programmatically
9.2.2. Enabling Data Grid Metrics Copy linkLink copied to clipboard!
Configure Data Grid to export gauges and histograms.
Procedure
- Configure metrics declaratively or programmatically.
Declaratively
<cache-container statistics="true"> <metrics gauges="true" histograms="true" /> </cache-container>
<cache-container statistics="true">
<metrics gauges="true" histograms="true" />
</cache-container>
Programmatically
GlobalConfiguration globalConfig = new GlobalConfigurationBuilder() .statistics().enable() .metrics().gauges(true).histograms(true) .build();
GlobalConfiguration globalConfig = new GlobalConfigurationBuilder()
.statistics().enable()
.metrics().gauges(true).histograms(true)
.build();
9.2.3. Collecting Data Grid Metrics Copy linkLink copied to clipboard!
Collect Data Grid metrics with monitoring tools such as Prometheus.
Prerequisites
-
Enable statistics. If you do not enable statistics, Data Grid provides
0and-1values for metrics. - Optionally enable histograms. By default Data Grid generates gauges but not histograms.
Procedure
Get metrics in Prometheus (OpenMetrics) format:
curl -v http://localhost:11222/metrics
$ curl -v http://localhost:11222/metricsCopy to Clipboard Copied! Toggle word wrap Toggle overflow Get metrics in MicroProfile JSON format:
curl --header "Accept: application/json" http://localhost:11222/metrics
$ curl --header "Accept: application/json" http://localhost:11222/metricsCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Next steps
Configure monitoring applications to collect Data Grid metrics. For example, add the following to prometheus.yml:
static_configs:
- targets: ['localhost:11222']
static_configs:
- targets: ['localhost:11222']
Reference
- Prometheus Configuration
- Enabling Data Grid Statistics
9.2.4. Configuring Data Grid to Register JMX MBeans Copy linkLink copied to clipboard!
Data Grid can register JMX MBeans that you can use to collect statistics and perform administrative operations. However, you must enable statistics separately to JMX otherwise Data Grid provides 0 values for all statistic attributes.
Procedure
- Enable JMX declaratively or programmatically.
Declaratively
<cache-container> <jmx enabled="true" /> </cache-container>
<cache-container>
<jmx enabled="true" />
</cache-container>
- 1
- Registers Data Grid JMX MBeans.
Programmatically
GlobalConfiguration globalConfig = new GlobalConfigurationBuilder() .jmx().enable() .build();
GlobalConfiguration globalConfig = new GlobalConfigurationBuilder()
.jmx().enable()
.build();
- 1
- Registers Data Grid JMX MBeans.
9.2.4.1. Data Grid MBeans Copy linkLink copied to clipboard!
Data Grid exposes JMX MBeans that represent manageable resources.
org.infinispan:type=Cache- Attributes and operations available for cache instances.
org.infinispan:type=CacheManager- Attributes and operations available for cache managers, including Data Grid cache and cluster health statistics.
For a complete list of available JMX MBeans along with descriptions and available operations and attributes, see the Data Grid JMX Components documentation.
Reference
9.3. Retrieving Server Health Statistics Copy linkLink copied to clipboard!
Monitor the health of your Data Grid clusters in the following ways:
-
Programmatically with
embeddedCacheManager.getHealth()method calls. - JMX MBeans
- Data Grid REST Server
9.3.1. Accessing the Health API via JMX Copy linkLink copied to clipboard!
Retrieve Data Grid cluster health statistics via JMX.
Procedure
Connect to Data Grid server using any JMX capable tool such as JConsole and navigate to the following object:
org.infinispan:type=CacheManager,name="default",component=CacheContainerHealth
org.infinispan:type=CacheManager,name="default",component=CacheContainerHealthCopy to Clipboard Copied! Toggle word wrap Toggle overflow - Select available MBeans to retrieve cluster health statistics.
9.3.2. Accessing the Health API via REST Copy linkLink copied to clipboard!
Get Data Grid cluster health via the REST API.
Procedure
Invoke a
GETrequest to retrieve cluster health.GET /rest/v2/cache-managers/{cacheManagerName}/healthGET /rest/v2/cache-managers/{cacheManagerName}/healthCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Data Grid responds with a JSON document such as the following:
Get cache manager status as follows:
GET /rest/v2/cache-managers/{cacheManagerName}/health/status
GET /rest/v2/cache-managers/{cacheManagerName}/health/status
Reference
See the REST v2 (version 2) API documentation for more information.
Chapter 10. Performing Rolling Upgrades for Data Grid Servers Copy linkLink copied to clipboard!
Perform rolling upgrades of your Data Grid clusters to change between versions without downtime or data loss. Rolling upgrades migrate both your Data Grid servers and your data to the target version over Hot Rod.
10.1. Setting Up Target Clusters Copy linkLink copied to clipboard!
Create a cluster that runs the target Data Grid version and uses a remote cache store to load data from the source cluster.
Prerequisites
- Install a Data Grid cluster with the target upgrade version.
Ensure the network properties for the target cluster do not overlap with those for the source cluster. You should specify unique names for the target and source clusters in the JGroups transport configuration. Depending on your environment you can also use different network interfaces and specify port offsets to keep the target and source clusters separate.
Procedure
Add a
RemoteCacheStoreon the target cluster for each cache you want to migrate from the source cluster.Remote cache stores use the Hot Rod protocol to retrieve data from remote Data Grid clusters. When you add the remote cache store to the target cluster, it can lazily load data from the source cluster to handle client requests.
Switch clients over to the target cluster so it starts handling all requests.
- Update client configuration with the location of the target cluster.
- Restart clients.
10.1.1. Remote Cache Stores for Rolling Upgrades Copy linkLink copied to clipboard!
You must use specific remote cache store configuration to perform rolling upgrades, as follows:
- 1
- Disables passivation. Remote cache stores for rolling upgrades must disable passivation.
- 2
- Matches the name of a cache in the source cluster. Target clusters load data from this cache using the remote cache store.
- 3
- Matches the Hot Rod protocol version of the source cluster.
2.5is the minimum version and is suitable for any upgrade paths. You do not need to set another Hot Rod version. - 4
- Ensures that entries are wrapped in a suitable format for the Hot Rod protocol.
- 5
- Stores data in the remote cache store in raw format. This ensures that clients can use data directly from the remote cache store.
- 6
- Disables segmentation for the remote cache store. You should enable segmentation for remote cache stores only if the number of segments in the target cluster matches the number of segements for the cache in the source cluster.
- 7
- Points to the location of the source cluster.
10.2. Synchronizing Data to Target Clusters Copy linkLink copied to clipboard!
When your target cluster is running and handling client requests using a remote cache store to load data on demand, you can synchronize data from the source cluster to the target cluster.
This operation reads data from the source cluster and writes it to the target cluster. Data migrates to all nodes in the target cluster in parallel, with each node receiving a subset of the data. You must perform the synchronization for each cache in your Data Grid configuration.
Procedure
Start the synchronization operation for each cache in your Data Grid configuration that you want to migrate to the target cluster.
Use the Data Grid REST API and invoke
POSTrequests with the?action=sync- dataparameter. For example, to synchronize data in a cache named "myCache" from a source cluster to a target cluster, do the following:POST /v2/caches/myCache?action=sync-data
POST /v2/caches/myCache?action=sync-dataCopy to Clipboard Copied! Toggle word wrap Toggle overflow When the operation completes, Data Grid responds with the total number of entries copied to the target cluster.
Alternatively, you can use JMX by invoking
synchronizeData(migratorName=hotrod)on theRollingUpgradeManagerMBean.Disconnect each node in the target cluster from the source cluster.
For example, to disconnect the "myCache" cache from the source cluster, invoke the following
POSTrequest:POST /v2/caches/myCache?action=disconnect-source
POST /v2/caches/myCache?action=disconnect-sourceCopy to Clipboard Copied! Toggle word wrap Toggle overflow To use JMX, invoke
disconnectSource(migratorName=hotrod)on theRollingUpgradeManagerMBean.
Next steps
After you synchronize all data from the source cluster, the rolling upgrade process is complete. You can now decommission the source cluster.
Chapter 11. Troubleshooting Data Grid Servers Copy linkLink copied to clipboard!
Gather diagnostic information about Data Grid server deployments and perform troubleshooting steps to resolve issues.
11.1. Getting Diagnostic Reports for Data Grid Servers Copy linkLink copied to clipboard!
Data Grid servers provide aggregated reports in tar.gz archives that contain diagnostic information about both the Data Grid server and the host. The report provides details about CPU, memory, open files, network sockets and routing, threads, in addition to configuration and log files.
Procedure
- Create a CLI connection to Data Grid.
Use the
server reportcommand to download atar.gzarchive:[//containers/default]> server report Downloaded report 'infinispan-<hostname>-<timestamp>-report.tar.gz'
[//containers/default]> server report Downloaded report 'infinispan-<hostname>-<timestamp>-report.tar.gz'Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Move the
tar.gzfile to a suitable location on your filesystem. -
Extract the
tar.gzfile with any archiving tool.
11.2. Changing Data Grid Server Logging Configuration at Runtime Copy linkLink copied to clipboard!
Modify the logging configuration for Data Grid servers at runtime to temporarily adjust logging to troubleshoot issues and perform root cause analysis.
Modifying the logging configuration through the CLI is a runtime-only operation, which means that changes:
-
Are not saved to the
log4j2.xmlfile. Restarting server nodes or the entire cluster resets the logging configuration to the default properties in thelog4j2.xmlfile. - Apply only to the nodes in the cluster when you invoke the CLI. Nodes that join the cluster after you change the logging configuration use the default properties.
Procedure
- Create a CLI connection to Data Grid.
Use the
loggingto make the required adjustments.- List all appenders defined on the server:
[//containers/default]> logging list-appenders
[//containers/default]> logging list-appenders
The preceding command returns:
- List all logger configurations defined on the server:
[//containers/default]> logging list-loggers
[//containers/default]> logging list-loggers
The preceding command returns:
-
Add and modify logger configurations with the
setsubcommand
For example, the following command sets the logging level for the org.infinispan package to DEBUG:
[//containers/default]> logging set --level=DEBUG org.infinispan
[//containers/default]> logging set --level=DEBUG org.infinispan
-
Remove existing logger configurations with the
removesubcommand.
For example, the following command removes the org.infinispan logger configuration, which means the root configuration is used instead:
[//containers/default]> logging remove org.infinispan
[//containers/default]> logging remove org.infinispan
11.3. Resource Statistics Copy linkLink copied to clipboard!
You can inspect server-collected statistics for some of the resources within a Data Grid server using the stats command.
Use the stats command either from the context of a resource which collects statistics (containers, caches) or with a path to such a resource:
Chapter 12. Reference Copy linkLink copied to clipboard!
12.1. Data Grid Server 8.1.1 Readme Copy linkLink copied to clipboard!
Information about the Data Grid Server 11.0.9.Final-redhat-00001 distribution.
12.1.1. Requirements Copy linkLink copied to clipboard!
Data Grid Server requires JDK 11 or later.
12.1.2. Starting servers Copy linkLink copied to clipboard!
Use the server script to run Data Grid Server instances.
Unix / Linux
$RHDG_HOME/bin/server.sh
$RHDG_HOME/bin/server.sh
Windows
$RHDG_HOME\bin\server.bat
$RHDG_HOME\bin\server.bat
Include the --help or -h option to view command arguments.
12.1.3. Stopping servers Copy linkLink copied to clipboard!
Use the shutdown command with the CLI to perform a graceful shutdown.
Alternatively, enter Ctrl-C from the terminal to interrupt the server process or kill it via the TERM signal.
12.1.4. Configuration Copy linkLink copied to clipboard!
Server configuration extends Data Grid configuration with the following server-specific elements:
cache-container- Defines cache containers for managing cache lifecycles.
endpoints- Enables and configures endpoint connectors for client protocols.
security- Configures endpoint security realms.
socket-bindings- Maps endpoint connectors to interfaces and ports.
The default configuration file is $RHDG_HOME/server/conf/infinispan.xml.
Use different configuration files with the -c argument, as in the following example that starts a server without clustering capabilities:
Unix / Linux
$RHDG_HOME/bin/server.sh -c infinispan-local.xml
$RHDG_HOME/bin/server.sh -c infinispan-local.xml
Windows
$RHDG_HOME\bin\server.bat -c infinispan-local.xml
$RHDG_HOME\bin\server.bat -c infinispan-local.xml
12.1.5. Bind address Copy linkLink copied to clipboard!
Data Grid Server binds to the loopback IP address localhost on your network by default.
Use the -b argument to set a different IP address, as in the following example that binds to all network interfaces:
Unix / Linux
$RHDG_HOME/bin/server.sh -b 0.0.0.0
$RHDG_HOME/bin/server.sh -b 0.0.0.0
Windows
$RHDG_HOME\bin\server.bat -b 0.0.0.0
$RHDG_HOME\bin\server.bat -b 0.0.0.0
12.1.6. Bind port Copy linkLink copied to clipboard!
Data Grid Server listens on port 11222 by default.
Use the -p argument to set an alternative port:
Unix / Linux
$RHDG_HOME/bin/server.sh -p 30000
$RHDG_HOME/bin/server.sh -p 30000
Windows
$RHDG_HOME\bin\server.bat -p 30000
$RHDG_HOME\bin\server.bat -p 30000
12.1.7. Clustering address Copy linkLink copied to clipboard!
Data Grid Server configuration defines cluster transport so multiple instances on the same network discover each other and automatically form clusters.
Use the -k argument to change the IP address for cluster traffic:
Unix / Linux
$RHDG_HOME/bin/server.sh -k 192.168.1.100
$RHDG_HOME/bin/server.sh -k 192.168.1.100
Windows
$RHDG_HOME\bin\server.bat -k 192.168.1.100
$RHDG_HOME\bin\server.bat -k 192.168.1.100
12.1.8. Cluster stacks Copy linkLink copied to clipboard!
JGroups stacks configure the protocols for cluster transport. Data Grid Server uses the tcp stack by default.
Use alternative cluster stacks with the -j argument, as in the following example that uses UDP for cluster transport:
Unix / Linux
$RHDG_HOME/bin/server.sh -j udp
$RHDG_HOME/bin/server.sh -j udp
Windows
$RHDG_HOME\bin\server.bat -j udp
$RHDG_HOME\bin\server.bat -j udp
12.1.9. Authentication Copy linkLink copied to clipboard!
Data Grid Server requires authentication.
Create a username and password with the CLI as follows:
Unix / Linux
$RHDG_HOME/bin/cli.sh user create username -p "qwer1234!"
$RHDG_HOME/bin/cli.sh user create username -p "qwer1234!"
Windows
$RHDG_HOME\bin\cli.bat user create username -p "qwer1234!"
$RHDG_HOME\bin\cli.bat user create username -p "qwer1234!"
12.1.10. Server home directory Copy linkLink copied to clipboard!
Data Grid Server uses infinispan.server.home.path to locate the contents of the server distribution on the host filesystem.
The server home directory, referred to as $RHDG_HOME, contains the following folders:
| Folder | Description |
|---|---|
|
| Contains scripts to start servers and CLI. |
|
|
Contains |
|
| Provides configuration examples, schemas, component licenses, and other resources. |
|
|
Contains |
|
| Provides a root folder for Data Grid Server instances. |
|
| Contains static resources for Data Grid Console. |
12.1.11. Server root directory Copy linkLink copied to clipboard!
Data Grid Server uses infinispan.server.root.path to locate configuration files and data for Data Grid Server instances.
You can create multiple server root folders in the same directory or in different directories and then specify the locations with the -s or --server-root argument, as in the following example:
Unix / Linux
$RHDG_HOME/bin/server.sh -s server2
$RHDG_HOME/bin/server.sh -s server2
Windows
$RHDG_HOME\bin\server.bat -s server2
$RHDG_HOME\bin\server.bat -s server2
Each server root directory contains the following folders:
├── server │ ├── conf │ ├── data │ ├── lib │ └── log
├── server
│ ├── conf
│ ├── data
│ ├── lib
│ └── log
| Folder | Description | System property override |
|---|---|---|
|
| Contains server configuration files. |
|
|
| Contains data files organized by container name. |
|
|
|
Contains server extension files. |
|
|
| Contains server log files. |
|
12.1.12. Logging Copy linkLink copied to clipboard!
Configure Data Grid Server logging with the log4j2.xml file in the server/conf folder.
Use the --logging-config=<path_to_logfile> argument to use custom paths, as follows:
Unix / Linux
$RHDG_HOME/bin/server.sh --logging-config=/path/to/log4j2.xml
$RHDG_HOME/bin/server.sh --logging-config=/path/to/log4j2.xml
To ensure custom paths take effect, do not use the ~ shortcut.
Windows
$RHDG_HOME\bin\server.bat --logging-config=path\to\log4j2.xml
$RHDG_HOME\bin\server.bat --logging-config=path\to\log4j2.xml