1

I want to monitor my Geonetwork 2.10.4 from the load balancer with the URL www.example.com/geonetwork/monitor/healthcheck (slow) or www.example.com/geonetwork/criticalhealthcheck (fast). When I access these URLs, I need to log in. The load balancer cannot do this. Therefore I want to whitelist the URLs for the load balancer.

The documentation of Geonetwork 2.10.4 contains the following text.

"By default the /monitor/* urls are protected and may only be accessed by an ‘’administrator” or ‘’monitor’‘, however it is possible in the web.xml to provide a whitelist of URLs or IP addresses of monitoring servers that are permitted to access the monitoring data without needing an administration account."

Unfortunately, it doesn't say how to do that.

Removing/commenting the following text from web.xml

<!-- Only allow administrators or localhost access to the monitoring metrics -->
<filter>
    <filter-name>MetricsRegistryInitializerFilter</filter-name>
    <filter-class>org.fao.geonet.monitor.webapp.MetricsRegistryInitializerFilter</filter-class>
</filter>

results in the Tomcat error

Jul 18, 2018 12:00:36 PM org.apache.catalina.core.ContainerBase addChildInternal
SEVERE: ContainerBase.addChild: start:
org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/geonetwork]]
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:154)
        at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
        at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877)
        at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:632)
        at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:1073)
        at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1857)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:473)
        at java.util.concurrent.FutureTask.run(FutureTask.java:262)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1152)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:622)
        at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.IllegalArgumentException: Filter mapping specifies an unknown filter name MetricsRegistryInitializerFilter
        at org.apache.catalina.core.StandardContext.validateFilterMap(StandardContext.java:3111)
        at org.apache.catalina.core.StandardContext.addFilterMap(StandardContext.java:3076)
        at org.apache.catalina.deploy.WebXml.configureContext(WebXml.java:1265)
        at org.apache.catalina.startup.ContextConfig.webConfig(ContextConfig.java:1331)
        at org.apache.catalina.startup.ContextConfig.configureStart(ContextConfig.java:863)
        at org.apache.catalina.startup.ContextConfig.lifecycleEvent(ContextConfig.java:371)
        at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
        at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:90)
        at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5401)
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
        ... 10 more

Jul 18, 2018 12:00:36 PM org.apache.catalina.startup.HostConfig deployWAR
SEVERE: Error deploying web application archive /var/lib/tomcat7/webapps/geonetwork.war
java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/geonetwork]]
        at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:904)
        at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877)
        at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:632)
        at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:1073)
        at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1857)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:473)
        at java.util.concurrent.FutureTask.run(FutureTask.java:262)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1152)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:622)
        at java.lang.Thread.run(Thread.java:748)

https://geonetwork-opensource.org/manuals/2.10.4/eng/users/admin/monitoring/index.html

Improve this question

1 Answer 1

Reset to default
1

That's a line from a previous version, 2.8.x where you could configure this filter in web.xml. 

<!-- Only allow administrators or localhost access to the monitoring metrics -->
<filter>
    <filter-name>MonitorSecurityFilter</filter-name>
    <filter-class>org.fao.geonet.monitor.MonitorSecurityFilter</filter-class>
    <init-param>
         <!--
         White-list is comma seperated list of trusted source that can call monitor.
         For example nagios server -->
        <param-name>white-list</param-name>
        <param-value>localhost</param-value>
    </init-param>
</filter>

...

<filter-mapping>
    <filter-name>MonitorSecurityFilter</filter-name>
    <url-pattern>/monitor/*</url-pattern>
</filter-mapping>

Unfortunately MonitorSecurityFilter is not available in 2.10.x anymore since it has been removed in favor of Spring Security. In 2.10.4 you will need to modify some rules in config-security-mapping.xml from

<sec:intercept-url pattern="/monitor/.*" access="hasRole('Monitor')"></sec:intercept-url>
<sec:intercept-url pattern="/monitor" access="hasRole('Monitor')"></sec:intercept-url>
<sec:intercept-url pattern="/\w*healthcheck" access="hasRole('Monitor')"></sec:intercept-url>

to

<sec:intercept-url pattern="/monitor/.*" access="permitAll"></sec:intercept-url>
<sec:intercept-url pattern="/monitor" access="permitAll"></sec:intercept-url>
<sec:intercept-url pattern="/\w*healthcheck" access="permitAll"></sec:intercept-url>

If you want to allow specific hosts you could use Spring Security's Web Security Expressions, for example

<sec:intercept-url pattern="/monitor/.*" access="hasIpAddress('192.168.1.0/24')"></sec:intercept-url>
Improve this answer
1
  • LGTM. :) YMMD. :)
    – qräbnö
    Commented Aug 7, 2018 at 10:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.