📄 resin-watchdog.xtp
字号:
<document> <header> <product>resin</product> <title>Resin Watchdog</title> <type>contents</type> <description><p>For reliability and security, Resin servers are started and monitoredby a separate Resin watchdog process. The watchdog continually checksthe health ofthe Resin server and restarts the Resin instance if is becomes unresponsive.</p><p>In most cases, the watchdog reads the resin.xml and configures itselfautomatically, so no extra configuration is required. Certain specializedconfigurations like ISPs can configure the watchdog to isolate JVMsfor protection and security.</p> </description> </header><body><localtoc/><s1 title="Overview"><p>Because the watchdog runs quietly as a separate service, most ofthe time you won't need to pay attention to the watchdog at all. Thestandard configuration launches on watchdog per machine whichmonitors all the Resin JVMs on that matchine, so most sites will notneed to change any watchdog configuration.</p><p>The main management tasks where you might need to pay attention tothe watchdog is shutting it down if something is severely wrong withthe machine, and checking the watchdog logs for Resin restartevents.</p><p>The watchdog automatically restarts Resin if the Resin JVM evercrashes or exits. So if you want to stop Resin, you need to tell thewatchdog to stop the instance, or you can stop the watchdog entirely.The watchdog is typically controlled by the resin.jar mainprogram (<code>ResinBoot</code>), which has commands to start, stop,and restart Resin instances as well as reporting the watchdogstatus.</p><figure src="startup-watchdog.png"/><p>While most users will use the watchdog automatically with no extraconfiguration, ISPs and larger and complicated sites can create aspecialised watchdog.xml with a <watchdog-manager> tag to controlthe watchdog at a much finer level. The <watchdog-manager> lets anISP run the watchdog under its own control, and specify exactly thecommand-line parameters for their users' Resin instances, includingthe ability to create secure chroot instances for their users.Typically, the watchdog will run as root, while the user instanceswill run with their respective user ids.</p></s1><s1 title="command-line"><p>The watchdog is controlled on the command-line using resin.jar'smain class, <code>ResinBoot</code>. The major operations are: start, stop, restart, shutdownand status.</p><s2 title="start"><p>The "start" command starts a new Resin instance with the given server id.<code>ResinBoot</code> will first try to contact the watchdog on thecurrent machine, and start a new watchdog if necessary. The server idmust be unique for all servers defined in the resin.xml.</p><example title="Example: watchdog start">resin-3.2.x> java -jar lib/resin.jar -conf conf/test.conf -server a startResin/3.2.x started -server 'a' for watchdog at 127.0.0.1:6700</example></s2><s2 title="stop"><p>The "stop" command stops the Resin instance with the given server id.If the stopped instances is the last one managed by the watchdog, thewatchdog will automatically exit. If no <code>-server</code> is specified,the watchdog defaults to <code>-server ""</code>.</p><example title="Example: watchdog stop">resin-3.2.x> java -jar lib/resin.jar stopResin/3.2.x started -server '' for watchdog at 127.0.0.1:6600</example></s2><s2 title="status"><p>The "status" command summarizes the current Resin instances managedby the watchdog service.</p><example title="Example: watchdog status">resin-3.2.x> java -jar lib/resin.jar statusResin/3.2.x status for watchdog at 127.0.0.1:6600server '' : active password: missing user: ferg root: /home/test/resin/ conf: /etc/resin/resin.xml</example></s2></s1><s1 title="Single Resin instance"><p>This example shows a single-server site listening to thestandard HTTP port 80 and running the server as the "resin" user. In thisexample, the watchdog typically runs as root so it can bind to theprotected port 80, while the Resin instance runs as "resin" for security.</p><figure src="watchdog-single.png"/><p>Since this configuration uses the default, the watchdog listens toport 6600 for commands.</p><example title="Example: /etc/resin/resin.xml"><resin xmlns="http://caucho.com/ns/resin"><cluster id=""> <server id="app-a" address="127.0.0.1"> <user-name>resin</user-name> <group-name>resin</group-name> <http port="80"/> </server> <resin:import path="${resin.home}/conf/app-default.xml"/> <host id=""> <web-app id="" path="/var/www/htdocs"/> </host></cluster></resin></example></s1><s1 title="Single machine load balance with shared watchdog"><p>When running multiple instances of Resin on the samemachine, one watchdog-manager typically handles all the instances.The server id will select which instance to start or stop.</p><p>In this example, there is one web-tier server acting as a load-balancerand two app-tier servers handling the backend data, all on a single machine.A site might want multiple app-tier servers for more reliable maintenanceand upgrades. While one server is down, traffic can be handled by a secondserver.</p><p>The example uses default watchdog configuration from the standard resin.xmlfile. The watchdog process and <code>ResinBoot</code> will both readthe resin.xml file for the server configuration, so there's no explicitwatchdog configuration necessary. The watchdog detects thatmultiple servers are running on the same machine and manages all of themautomatically.</p><figure src="watchdog-multiple.png"/><example title="Example: /etc/resin/resin.xml"><resin xmlns="http://caucho.com/ns/resin"><cluster id="app-tier"> <server-default> <user-name>resin</user-name> <group-name>resin</group-name> </server-default> <server id="app-a" address="192.168.1.10" port="6810"/> <server id="app-b" address="192.168.1.10" port="6811"/> <host id=""> <web-app id="" path="/var/www/htdocs"/> </host></cluster><cluster id="web-tier"> <server-default> <user-name>resin</user-name> <group-name>resin</group-name> </server-default> <server id="web-a" address="192.168.1.10" port="6800"> <http port="80"/> </server> <host id=""> <web-app id=""> <rewrite-redirect> <load-balance regexp="" cluster="app-tier"/> </rewrite-redirect> </web-app> </host></cluster></resin></example></s1><s1 title="Single machine load balance with distinct watchdog"><p>In some cases, it's best to let each Resin instance have its ownwatchdog, for example when multiple users are sharing the samemachine. Each <server> block configures a separate <watchdog-port>.Because the watchdog will read the resin.xml and use the <server> blockmatching the <code>-server id</code> command-line argument, each watchdogwill start with it's own port.</p><example title="Example: /etc/resin/resin.xml"><resin xmlns="http://caucho.com/ns/resin"><cluster id="app-tier"> <server-default> <user-name>resin</user-name> <group-name>resin</group-name> </server-default> <server id="app-a" address="192.168.1.10" port="6810"> <watchdog-port>6700</watchdog-port> <http port="8080"/> </server> <server id="app-b" address="192.168.1.10" port="6811"> <watchdog-port>6701</watchdog-port> <http port="8081"/> </server> <host id=""> <web-app id="" path="/var/www/htdocs"/> </host></cluster></resin></example><p>In the previous example, starting Resin with <code>-server app-a</code>will start a watchdog at port 6700. Starting Resinwith <code>-server app-b</code> will start the watchdog at port 6701.</p><example title="Example: starting app-b with watchdog-port=6701">resin-3.2.x> java -jar lib/resin.jar -server app-b start</example></s1><s1 title="ISP watchdog management"><p>In a situation like an ISP, you may wish to have a separateconfiguration file for the watchdog, which launches Resin instancesfor different users. In this case, you will want to make surethe watchdog.xml is not readable by the users, and make sure toset a management user (see <a href="resin-security.xtp">resin-security</a>).</p><ul><li>Start and restart the user's Resin JVM</li><li>Set JVM parameters and Java executable</li><li>Set the Resin instance root-directory</li><li>setuid user-name and group-name</li><li>Set the resin.xml configuration (must be readable by the user)</li><li>Open protected ports like port 80</li><li>Optional chroot for additional security</li></ul><p>The watchdog will launch the Resin instance with the given user as asetuid. It will also open any necessary protected ports, e.g. port 80.</p><example title="Example: /etc/resin/watchdog.xml"><resin xmlns="http://caucho.com/ns/resin"><management> <user name="harry" password="MD5HASH=="/></management><watchdog-manager> <watchdog-default> <jvm-arg>-Xmx256m</jvm-arg> </watchdog-default> <watchdog id="user_1"> <user-name>user_1</user-name> <group-name>group_1</group-name> <resin-xml>/home/user_1/conf/resin.xml</resin-conf> <resin-root>/home/user_1/www</resin-root> <open-port address="192.168.1.10" port="80"/> </watchdog> ... <watchdog id="user_n"> <user-name>user_n</user-name> <group-name>group_n</group-name> <resin-conf>/home/user_n/conf/resin.xml</resin-conf> <resin-root>/home/user_n/www</resin-root> <open-port address="192.168.1.240" port="80"/> </watchdog></watchdog-manager></resin></example></s1><s1 title="Management/JMX"><p>The watchdog publishes the watchdog instances to JMX with the JMX name"resin:type=Watchdog,name=a". With a JMX monitoring tool like jconsole,you can view and manage the watchdog instances.</p></s1> </body></document>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -