</code></pre><divclass="line-numbers"aria-hidden="true"><divclass="line-number"></div></div></div><p>By default, the web port of the arthas tunnel server is <code>8080</code>, and the port connected by the arthas agent is <code>7777</code>.</p><p>Once started, you can go to <ahref="http://127.0.0.1:8080/"target="_blank"rel="noopener noreferrer">http://127.0.0.1:8080/<span><svgclass="external-link-icon"xmlns="http://www.w3.org/2000/svg"aria-hidden="true"focusable="false"x="0px"y="0px"viewbox="0 0 100 100"width="15"height="15"><pathfill="currentColor"d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path><polygonfill="currentColor"points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg><spanclass="external-link-icon-sr-only">open in new window</span></span></a> and connect to the registered arthas agent via <code>agentId</code>.</p><p>Through Spring Boot's Endpoint, you can view the specific connection information: <ahref="http://127.0.0.1:8080/actuator/arthas"target="_blank"rel="noopener noreferrer">http://127.0.0.1:8080/actuator/arthas<span><svgclass="external-link-icon"xmlns="http://www.w3.org/2000/svg"aria-hidden="true"focusable="false"x="0px"y="0px"viewbox="0 0 100 100"width="15"height="15"><pathfill="currentColor"d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path><polygonfill="currentColor"points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg><spanclass="external-link-icon-sr-only">open in new window</span></span></a>, the login user name is <code>arthas</code>, and the password can be found in the log of arthas tunnel server, for example:</p><divclass="language-text ext-text line-numbers-mode"><preclass="language-text"><code>32851 [main] INFO o.s.b.a.s.s.UserDetailsServiceAutoConfiguration
Using generated security password: f1dca050-3777-48f4-a577-6367e55a78a2
</code></pre><divclass="line-numbers"aria-hidden="true"><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div></div></div><h2id="connecting-to-the-tunnel-server-when-starting-arthas"tabindex="-1"><aclass="header-anchor"href="#connecting-to-the-tunnel-server-when-starting-arthas"aria-hidden="true">#</a> Connecting to the tunnel server when starting arthas</h2><p>When starting arthas, you can use the <code>--tunnel-server</code> parameter, for example:</p><divclass="language-bash ext-sh line-numbers-mode"><preclass="language-bash"><code>as.sh --tunnel-server <spanclass="token string">'ws://127.0.0.1:7777/ws'</span>
</code></pre><divclass="line-numbers"aria-hidden="true"><divclass="line-number"></div></div></div><p>You can also use the following test address (not guaranteed to be available all the time):</p><divclass="language-bash ext-sh line-numbers-mode"><preclass="language-bash"><code>as.sh --tunnel-server <spanclass="token string">'ws://47.75.156.201:80/ws'</span>
</code></pre><divclass="line-numbers"aria-hidden="true"><divclass="line-number"></div></div></div><ul><li>You can specify the agentId by the <code>--agent-id</code> parameter. By default, a random ID is generated.</li></ul><p>After Arthas attach succeeds, the agentId will be printed, such as:</p><divclass="language-bash ext-sh line-numbers-mode"><preclass="language-bash"><code> ,---. ,------. ,--------.,--. ,--. ,---. ,---.
/ O <spanclass="token punctuation">\</span><spanclass="token operator">|</span> .--. <spanclass="token string">''</span>--. .--<spanclass="token string">'| '</span>--<spanclass="token string">' | / O \ '</span> .-<spanclass="token string">'
</code></pre><divclass="line-numbers"aria-hidden="true"><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div></div></div><p>If the connection is not connected to the tunnel server at startup, you can also obtain the agentId through the <code>session</code> command after reconnection succeeds:</p><divclass="language-bash ext-sh line-numbers-mode"><preclass="language-bash"><code><spanclass="token punctuation">[</span>arthas@86183<spanclass="token punctuation">]</span>$ session
</code></pre><divclass="line-numbers"aria-hidden="true"><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div></div></div><p>For the above example, go to <ahref="http://47.75.156.201/arthas/?port=80"target="_blank"rel="noopener noreferrer">http://47.75.156.201/arthas/?port=80<span><svgclass="external-link-icon"xmlns="http://www.w3.org/2000/svg"aria-hidden="true"focusable="false"x="0px"y="0px"viewbox="0 0 100 100"width="15"height="15"><pathfill="currentColor"d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path><polygonfill="currentColor"points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg><spanclass="external-link-icon-sr-only">open in new window</span></span></a> in the browser and input the <code>agentId</code> to connect to arthas on remote machine.</p><p><imgsrc="/images/arthas-tunnel-server.png"alt=""></p><h2id="best-practices"tabindex="-1"><aclass="header-anchor"href="#best-practices"aria-hidden="true">#</a> Best practices</h2><divclass="custom-container warning"><pclass="custom-container-title">WARNING</p><p>Note that the agentId must be unique, otherwise it will conflict on the tunnel server and not work properly.</p></div><p>If the arthas agent is configured with <code>appName</code>, the generated agentId will be prefixed with <code>appName</code>.</p><p>For example, if you add the startup parameter <code>as.sh --tunnel-server 'ws://127.0.0.1:7777/ws' --app-name demoapp</code>, the generated agentId might be <code>demoapp_URJZ5L48RPBR2ALI5K4V</code>.</p><p>Tunnel server will use <code>_</code> as a delimiter to extract <code>appName</code>, which is convenient to manage by application.</p><divclass="custom-container tip"><pclass="custom-container-title">TIP</p><p>Alternatively, you can configure <code>appName</code> in <code>arthas.properties</code> in the unzipped arthas directory, or in <code>application.properties</code> of the spring boot application.</p></div><h2id="tunnel-server-management-page"tabindex="-1"><aclass="header-anchor"href="#tunnel-server-management-page"aria-hidden="true">#</a> Tunnel Server Management Page</h2><divclass="custom-container tip"><pclass="custom-container-title">TIP</p><p>Need to configure <code>arthas.enable-detail-pages=true</code> in <code>application.properties</code> of spring boot</p><p><strong>Attention, opening admin pages is risky! There is no security blocking function on the management page, you must add security measures by yourself.</strong></p></div><p>Start the tunnel-server locally, then use <code>as.sh</code> attach, and specify the application name <code>--app-name test</code>:</p><divclass="language-text ext-text line-numbers-mode"><preclass="language-text"><code>$ as.sh --tunnel-server 'ws://127.0.0.1:7777/ws' --app-name test
</code></pre><divclass="line-numbers"aria-hidden="true"><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div><divclass="line-number"></div></div></div><p>Then visit tunnel-server, you can see a list of all connected applications:</p><p><ahref="http://localhost:8080/apps.html"target="_blank"rel="noopener noreferrer">http://localhost:8080/apps.html<span><svgclass="external-link-icon"xmlns="http://www.w3.org/2000/svg"aria-hidden="true"focusable="false"x="0px"y="0px"viewbox="0 0 100 100"width="15"height="15"><pathfill="currentColor"d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path><polygonfill="currentColor"points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg><spanclass="external-link-icon-sr-only">open in new window</span></span></a></p><p><imgsrc="/images/tunnel-server-apps.png"alt=""></p><p>Then open the details, you can see a list of all connected agents:</p><p><ahref="http://localhost:8080/agents.html?app=test"target="_blank"rel="noopener noreferrer">http://localhost:8080/agents.html?app=test<span><svgclass="external-link-icon"xmlns="http://www.w3.org/2000/svg"aria-hidden="true"focusable="false"x="0px"y="0px"viewbox="0 0 100 100"width="15"height="15"><pathfill="currentColor"d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path><polygonfill="currentColor"points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg><spanclass="external-link-icon-sr-only">open in new window</span></span></a></p><p><imgsrc="/images/tunnel-server-agents.png"alt=""></p><h2id="security-and-privilege-management"tabindex="-1"><aclass="header-anchor"href="#security-and-privilege-management"aria-hidden="true">#</a> Security and Privilege Management</h2><divclass="custom-container tip"><pclass="custom-container-title">TIP</p><p><strong>It is strongly recommended not to expose the tunnel server directly to the public network.</strong></p></div><p>Currently tunnel server does not have special permission management</p><ol><li>Users need to develop by themselves and authenticate the app name.</li><li>If the management page is opened, security measures need to be added.</li></ol><h2id="cluster-management"tabindex="-1"><aclass="header-anchor"href="#cluster-management"aria-hidden="true">#</a> Cluster Management</h2><p>If you want to deploy multiple tunnel servers, you can use nginx for forwarding and redis to store agent information.</p><p>Nginx needs to configure sticky session to ensure that the user's web socket is connected to the same back-end tunnel server. The simple configuration method is to use <code>ip_hash</code>.</p><h2id="how-arthas-tunnel-server-works"tabindex="-1"><aclass="header-anchor"href="#how-arthas-tunnel-server-works"aria-hidden="true">#</a> How arthas tunnel server works</h2><divclass="language-text ext-text line-numbers-mode"><preclass="language-text"><code>browser <-> arthas tunnel server <-> arthas tunnel client <-> arthas agent
