Advanced Red Hat JBoss

Enterprise Application Platform 7

Table of Contents
1. Basic operations syntax. . . . . . . . . . . . . . 1 7. Security & role-based access control. 6
2. Basic management. . . . . . . . . . . . . . . . . . 2 8. Class loading . . . . . . . . . . . . . . . . . . . . . . . 6
3. Deploying and managing operations . . 2 9. Transactions. . . . . . . . . . . . . . . . . . . . . . . . 6
4. Socket bindings. . . . . . . . . . . . . . . . . . . . . 4 10. Datasources. . . . . . . . . . . . . . . . . . . . . . . . 6
5. Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 6
6. JVM settings. . . . . . . . . . . . . . . . . . . . . . . 6

Red Hat JBoss Enterprise Application Platform 7 (JBoss EAP) is a Java EE 7-certified
application platform. It is built on a collection of open source technologies, including an
embeddable web server, messaging, clustering and high availability, and caching. It can
be a single standalone server or have multiple defined domains, with a master server for
centralized management, profiles to define configuration, and hosted servers for scale.
Using the command-line tool

Basic operations syntax

The basic structure of an operation is:

[resourceType=name]:operation(parameter=value)
• The resource type is the domain location (in a domain) and the subsystem,
meaning the profile, server, or host; this is not used in standalone
• Set explicitly to run on any resource
• Skip it to run it on the current resource
• Use a slash to run on the root resource
• Use a period-slash (./) to run on a child resource
• NOTE: Most of the examples here are for a standalone server, unless
noted otherwise
• Operation (command) name
• Any parameters to update or to be included to run the operation

Basic Management

./bin/jboss-cli.sh --connect Connect to the CLI.

./bin/standalone.sh Start a standalone EAP server.

./bin/domain.sh Start an EAP domain controller.

Ctrl + C in the terminal Stop an EAP standalone or domain

controller interactively.

1
 shutdown Stop an EAP standalone or domain
controller running in the background.

/host=master:start Start a server in a domain.

/host=master:stop Stop a server in a domain.

:suspend(timeout=60) Suspend a standalone server.

:suspend-servers(timeout=60) Suspend all servers in a domain.

/host=master/server-config=server- Suspend a single server in a managed

one:suspend(timeout=60)
domain.

/server-group=main-server-group:suspend- Suspend all servers in a server group.

servers(timeout=60)

:resume Resume a server.

./bin/add-user.sh Add a user interactively.

./bin/add-user.sh -u 'mgmtuser1' -p \\ Add a user with parameters for the
'password1!' -g 'guest,mgmtgroup'
username (-u), password (-p), and user
groups (-g).

patch apply /path/to/downloaded-patch.zip Patch a server.

shutdown --restart=true

patch apply /path/to/downloaded-patch. Patch a host in a managed domain.

zip --host=Host

shutdown --restart=true

patch rollback --patch-id=PATCH_ID Roll back a patch.

--reset-configuration=TRUE

shutdown --restart=true

Deploying and managing applications

deploy /path/to/app/application.war Deploy an application to a standalone

server.

deploy --server-groups=main-server-group Deploy an application to a domain host.

/path/to/app/application.war

Socket bindings

A socket binding associates an EAP interface with a defined port. Since there are a
variety of different ports used by a single EAP server, that collection of socket bindings
is a socket binding group. For managed servers -- where multiple servers may be on the
same host or using the same configuration -- port offsets are used to ensure unique port
assignments for each server while still using the same socket binding group configuration;
the offset adds a defined number to each port number in the socket binding group and
uses the new port numbers for the managed server.

2
 /socket-binding-group=new- Create a socket binding group.
sockets:add(default-interface=public)

/socket-binding-group=new-sockets/ Add a socket binding (port) to the group.

socket-binding=new-socket-
binding:add(port=1234)

/socket-binding-group=new-sockets/ Change the interface for the socket

socket-binding=new-socket-binding:write-
binding to something other than the
attribute(name=interface,value=unsecu
re) default for the socket binding group.

/host=master/server-config=server- Set the port offset for a server within

two/:write-attribute(name=socket-
a host. The offset allows the server to
binding-port-offset,value=250)
inherit the socket binding group settings
and then to offset the port values so there
are no conflicts with other servers on the
host.
This is only set for a managed server.

Logging

GET http://localhost:9990/management/ Read the server.log using REST.

subsystem/logging/log-file/server.
log?operation=attribute&name=stream&use
StreamAsResponse

/subsystem=logging/log-file=server. Read the server.log using the CLI.

log:read-log-file

/subsystem=logging/ Set the log level.

root-logger=ROOT:write-
attribute(name=level,value=LEVEL)

/subsystem=logging/periodic-rotating- Add a log handler, set its attributes, and

file-handler=PERIODIC_HANDLER_
assign it to a logger. There are several
NAME:add(file={path=FILE_PATH,relative-
to=RELATIVE_TO_PATH},suffix=SUFFIX) different kinds of log handlers; this
example uses a rotating file handler.
/subsystem=logging/
periodic-rotating-file-
handler=PERIODIC_HANDLER_NAME:write-
attribute(name=level,value=LEVEL)

/subsystem=logging/logger=CATEGORY:add-
handler(name=PERIODIC_HANDLER_NAME)

/subsystem=logging/pattern- Enable the pattern formatting for the log

formatter=PATTERN_FORMATTER_
file.
NAME:add(pattern=PATTERN_STRING)

/subsystem=logging/pattern- Change the pattern format.

formatter=PATTERN_FORMATTER_NAME:write-
attribute(name=color-map,value="LEVEL:C
OLOR,LEVEL:COLOR")

/core-service=management/access=audit/ Configure audit logging for a standalone

logger=audit-log:write-attribute(name=e
server.
nabled,value=true)

/host=HOST_NAME/core-service=management/ Configure audit logging for a domain

access=audit/logger=audit-log:write-att
controller.
ribute(name=enabled,value=true)

3
 /subsystem=logging/ Enable transaction logging.
logger=com.arjuna:write-
attribute(name=level,value=VALUE)

JVM settings

The default JVM settings are defined in the standalone.conf or domain.conf file for the
app server. These settings can be configured directly in the configuration file or using the
command-line tools.
JAVA_OPTS="-Xms64m -Xmx512m Set the default heap settings in the
-XX:MaxMetaspaceSize=256m
configuration file.
-Djava.net.preferIPv4Stack=true"JAVA_
OPTS="$JAVA_OPTS
-Djboss.modules.system.pkgs=$JBOSS_
MODULES_SYSTEM_PKGS
-Djava.awt.headless=true"

/host=HOST_NAME/jvm=production_jvm:add Set the default heap settings for a domain

(
host.
heap-size=2048m,
max-heap-size=2048m,
max-permgen-size=512m,
stack-size=1024k,
jvm-options=["-XX:-UseParallelGC"]
)

/host=HOST_NAME/jvm=default:write- Set the heap size for a host and all

attribute(name=heap-size,value="1024m")
associated servers.

/server-group=groupName/ Set the heap size for a server group.

jvm=default:write-attribute(name=heap-
size,value="1024m")

/host=HOST_NAME/server- Set the heap size for a single server.

config=server-one/jvm=default:write-
attribute(name=heap-size,value="1024m")

/host=HOST_NAME/server- Set a server to use the default JVM

config=server-one/
settings for the domain.
jvm=production_jvm:add()

/host=HOST_NAME/jvm=default:add- Enable IPv6 and update the interfaces

jvm-option(jvm-option="-Djava.net.
to use IPv6. This changes the default
preferIPv4Stack=false")
/host=HOST_NAME/jvm=default:add- settings for a domain host.
jvm-option(jvm-option="-Djava.net.
preferIPv6Addresses=true")
/host=HOST_NAME/
interface=management:write-
attribute(name=inet-
address,value="${jboss.bind.address.
management:[::1]}")

/host=HOST_NAME/jvm=default:add-jvm- Enable 64-bit settings. This changes the

option(jvm-option="-d64")
default settings for a domain host.

4
Security and role-based access control

<jboss-cli xmlns="urn:jboss:cli:2.0"> Configure the JBoss CLI to use SSL. This

<default-protocol use-legacy-
is set in the jboss-cli.xml configuration file.
override="true">remote+https</default-
protocol> Set these properties:
<!-- The default controller to connect
to when 'connect' command is executed • default-protocol to remote+https
w/o arguments -->
• protocol to remote+https
<default-controller>
<protocol>remote+https</protocol> • port to 9993
<host>localhost</host>
<port>9993</port>
</default-controller>

/core-service=management/ Create a security realm.

security-realm=ManagementRealmHTTPS:add

/core-service=management/security- Set authentication properties for a

realm=ManagementRealmHTTPS/authenticatio
security realm.
n=properties:add(path=https-mgmt-users.
properties,relative-to=jboss.server.
config.dir)

/core-service=management/management- Set which security realm to use.

interface=http-interface:write-
attribute(name=security-
realm,value=ManagementRealmHTTPS)

/core-service=management/security- Add a keystore to the realm configuration.

realm=ManagementRealmHTTPS/server-
identity=ssl:add(keystore-path=identity.
jks,keystore-relative-to=jboss.server.
config.dir,keystore-password=password1,
alias=appserver)

/core-service=management/ Enable role-based access control.

access=authorization:write-
attribute(name=provider, value=rbac)

/core-service=management/ Set the permission policy for

access=authorization:write-
authorization.
attribute(name=permission-combination-
policy, value=POLICYNAME)

/core-service=management/ List configured roles.

access=authorization:read-children-
names(child-type=role-mapping)
{
"outcome" => "success",
"result" => [
"Administrator",
"Deployer",
"Maintainer",
"Monitor",
"Operator",
"SuperUser"
]
}

/core-service=management/ Create a role.

access=authorization/
role-mapping=ROLENAME:add

/core-service=management/ Add a group to a role.

access=authorization/
role-mapping=ROLENAME/
include=ALIAS:add(name=GROUPNAME,
type=GROUP)

5
 /core-service=management/ Show the role mappings for a given role.
access=authorization/
role-mapping=ROLENAME:read-
resource(recursive=true)
{
"outcome" => "success",
"result" => {
"include-all" => false,
"exclude" => undefined,
"include" => {
"user-theboss" => {
"name" => "theboss",
"realm" => undefined,
"type" => "USER"
},
"user-harold" => {
"name" => "harold",
"realm" => undefined,
"type" => "USER"
},
"group-SysOps" => {
"name" => "SysOps",
"realm" => undefined,
"type" => "GROUP"
}
}
}
}

Class loading

Classes are defined through modules. The classes available to deployments are loaded
by explicitly defining what modules and dependencies are required. There are two
types of modules: static and dynamic. Static modules are in the modules/ directory in
the app server. All APIs, including the Java EE APIs, are included as static modules.
Dynamic modules are loaded by the app server for each JAR or WAR deployment or EAR
subdeployment. These dynamic modules can define dependencies on other modules and
can themselves be defined as dependencies.

module add --name=MODULE_NAME Create a custom class module.

--resources=PATH_TO_RESOURCE
--dependencies=DEPENDENCIES

/subsystem=ee:write- Define a list of global modules to include

attribute(name=global-
as dependencies for all deployments.
modules,value=[{name=MODULE_
NAME_1},{name=MODULE_NAME_2}]

Transactions

/subsystem=transactions/:write- Enable statistics.

attribute(name=statistics-
enabled,value=true)

/subsystem=transactions/:write- Set default timeout.

attribute(name=default-
timeout,value=300)

6
 /subsystem=logging/ Set the transaction log level for a
logger=com.arjuna:write-
standalone server.
attribute(name=level,value=VALUE)

/profile=default/subsystem=logging/ Set the transaction log level for a

logger=com.arjuna:write-
managed domain.
attribute(name=level,value=VALUE)

/profile=default/subsystem=transactions/ Refresh the transactions log. For

log-store=log-store/:probe
a standalone server, remove the /
profile=default argument.

/subsystem=transactions/log-store=log- View the transactions log for a standalone

store:read-children-names(child-
server.
type=transactions)

/host=master/server=server-one/ View the transactions log for a server

subsystem=transactions/log-store=log-
within a managed domain.
store:read-children-names(child-
type=transactions)

/profile=default/subsystem=transactions/ View the attributes for a specific

log-store=log-store/
transaction.
transactions=0\:ffff7f000001\:-
b66efc2\:4f9e6f8f\:9:read-resource

/host=master/server=server-one/ View all prepared transactions.

subsystem=transactions/log-store=log-
store:read-children-names(child-
type=transactions)

/profile=default/subsystem=transactions/ Delete a transaction.

log-store=log-store/
transactions=0\:ffff7f000001\:-
b66efc2\:4f9e6f8f\:9:delete

/profile=default/subsystem=transactions/ Recover a transaction.

log-store=log-store/
transactions=0\:ffff7f000001\:-
b66efc2\:4f9e6f8f\:9/
participants=2:recover

/subsystem=datasources/data- Set a non-XA datasource to use JTA.

source=DATASOURCE_NAME:write-
attribute(name=jta,value=true)

reload

Datasources

module add --name=MODULE_NAME Add and register a new module. For a

--resources=PATH_TO_JDBC_JAR
managed domain, also specify the profile
--dependencies=DEPENDENCIES
to which to register the module.
connect

/profile=PROFILE_NAME
/subsystem=datasources/jdbc-
driver=DRIVER_NAME:add(driver-
name=DRIVER_NAME,driver-module-
name=MODULE_NAME,driver-xa-datasource-
class-name=XA_DATASOURCE_CLASS_NAME,
driver-class-name=DRIVER_CLASS_NAME)

7
 data-source add Add a new non-XA datasource. For a
--name=DATASOURCE_NAME
managed domain, also specify the profile
--jndi-name=JNDI_NAME
--driver-name=DRIVER_NAME with which to use the datasource.
--connection-url=CONNECTION_URL
--profile=PROFILE_NAME

xa-data-source add Add a new XA datasource.

--name=XA_DATASOURCE_NAME
--jndi-name=JNDI_NAME
--driver-name=DRIVER_NAME
--xa-datasource-class=XA_DATASOURCE_CLASS
--xa-datasource-properties={"ServerNam
e"=>"HOSTNAME","DatabaseName"=>"DATABA
SE_NAME"}

/subsystem=datasources/xa-data- Change a datasource property. This can be

source=XA_DATASOURCE_NAME/xa-datasource-
done for both XA and non-XA datasources;
properties=ServerName:add(value=HOSTNA
ME) this example is for setting the server
name for an XA datasource.

/host=HOSTNAME/server=SERVER_NAME/ Test the connection to a datasource. For

subsystem=datasources/data-
a managed domain, specify the host and
source=DATASOURCE_NAME:test-connection-
in-pool server name (as shown).

/subsystem=datasources/data- Enable statistics for pools. This is shown

source=ExampleDS/statistics=pool:write-
for a standalone server; for a managed
attribute(name=statistics-
enabled,value=true) domain, specify the host and server.

/subsystem=datasources/data- Enable statistics for JDBC runtime. This

source=ExampleDS/statistics=jdbc:write-
is shown for a standalone server; for a
attribute(name=statistics-
enabled,value=true) managed domain, specify the host and
server.

/subsystem=datasources/data- View the pool statistics. This is shown

source=ExampleDS/statistics=pool:read-
for a standalone server; for a managed
resource(include-runtime=true)
{ domain, specify the host and server.
"outcome" => "success",
"result" => {
"ActiveCount" => 1,
"AvailableCount" => 20,
"AverageBlockingTime" => 0L,
"AverageCreationTime" => 122L,
"AverageGetTime" => 128L,
"AveragePoolTime" => 0L,
"AverageUsageTime" => 0L,
"BlockingFailureCount" => 0,
"CreatedCount" => 1,
"DestroyedCount" => 0,
"IdleCount" => 1,
...
}

About the author

DEON BALLARD is a middleware marketing writer for Red
Hat and writes for and edits the Middleware Blog. She has
previously worked as a journalist, designer, and as a technical
writer for identity management and security, cloud and
virtualization, system management, and middleware software

 @JBoss
 http://middlewareblog.redhat.com