作者:fbysss
msn:[email protected] 
blog:blog.csdn.net/fbysss
宣告：本文由fbysss原創，轉載請註明出處
關鍵字：tomcat監控 probe

一、簡介

psi-probe是lambdaprobe的一個分支版本，用於對Tomcat進行監控，比tomcat的manager強大很多。

psi就是一個形如叉子的符號Ψ，希臘字母的第23個字母，用來代表fork。

為啥需要分支呢，因為lambdaprobe已經多年沒有更新（大致在2006年就停止釋出新版本了）。

二、下載地址

三、安裝

1.解壓，將probe.war放進webapps目錄。

2.修改CATALINA_HOME/conf/tomcat-users.xml

（許可權配置參考如下，由於首先保證可執行，許可權沒有特別細分，僅供參考）

<tomcat-users>
<!--
  NOTE:  By default, no user is included in the "manager-gui" role required
  to operate the "/manager/html" web application.  If you wish to use this app,
  you must define such a user - the username and password are arbitrary.
-->
<!--
  NOTE:  The sample user and role entries below are wrapped in a comment
  and thus are ignored when reading this file. Do not forget to remove
  <!.. ..> that surrounds them.
-->
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <role rolename="manager-gui"/>
  <role rolename="manager-script"/>
  <role rolename="manager-jmx"/>
  <role rolename="manager-status"/>
  <role rolename="poweruser"/>
  <role rolename="probeuser"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>

  <user username="sss" password="sss" roles="manager-gui"/>
  <user username="fbysss" password="sss" roles="manager-script,manager-jmx,manager-status,poweruser,probeuser"/>
</tomcat-users>

四、注意事項

1.不要忘記檔案中的<!---->，預設是註釋的，需要去掉

2.tomcat6.0.30以上，角色manager一分為四，manager仍保留但不建議使用，因為那樣容易遭到CSRF攻擊。詳見下面的描述：

Note that for Tomcat 6.0.30 onwards, the roles required to use the manager application were changed from the single manager role to add the following four roles. (The manager role is still available but should not be used as it avoids the CSRF protection). You will need to assign the role(s) required for the functionality you wish to access. manager-gui - allows access to the HTML GUI and the status pages manager-script - allows access to the text interface and the status pages manager-jmx - allows access to the JMX proxy and the status pages manager-status - allows access to the status pages only The HTML interface is protected against CSRF but the text and JMX interfaces are not. To maintain the CSRF protection: users with the manager-gui role should not be granted either the manager-script or manager-jmx roles. if the text or jmx interfaces are accessed through a browser (e.g. for testing since these interfaces are intended for tools not humans) then the browser must be closed afterwards to terminate the session.

如果配置不對，就會出現403的錯誤，連tomcat的manager都進不了，更不用說probe了。

3.lambdaprobe是不支援tomcat6.0.30的。所以最好使用psi-probe。

4.在配置tomcat-users.xml時，還需要加入poweruser等角色，才可以正常使用，不然也是403Forbidden。

5.如果要檢視System Information，需要在catalina.sh中加入如下語句：

JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote"

windows版本：catalina.bat中加入SET JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.jmxremote

五、許可權控制

probe有 probeuser、poweruser、poweruserplus、manager（針對不同tomcat版本）等角色，對應可操作的功能如下表：

特別注意一點：表格裡面的X表示擁有許可權，也就是說，manager的許可權是最大的，什麼都能操作（不推薦配置）。

Features by Role

六、效果圖