Skip to main content

Port and Service Management (Operator Guide)

This page guides you through procedures to inspect port status and troubleshoot issues in a running PlantPulse deployment. For a complete port catalog, refer to the Installation Guide – Port Configuration page.

Daily Inspection Checklist​

1. Service Status Inspection​

status.sh — Stack Status Overview (Host)​

First, view the stack status from the host. It summarizes service list, container state, health, and volumes. The exit code is binding — 0 is normal, 2 is abnormal, so you can use it directly in monitoring automation.

cd /opt/kopens/plantpulse-platform-docker/bin
./status.sh
A one-shot Exited (0) succeeds by design

plantpulse-certs is a one-shot that bakes certificates and exits, so Exited (0) is the normal outcome. Compose explicitly disables health checks for this container (healthcheck: disable), so the health field in docker ps is also empty — judge by exit code status.sh.

Module Port Occupancy (Inside Data Lake Container)​

To view port occupancy, PID, CPU, and memory (PSS) of infrastructure components, use status.sh inside the data lake container.

cd /opt/kopens/plantpulse-platform-docker/bin
./shell.sh
/opt/kopens/plantpulse-platform/plantpulse-datalake-cli/bin/pd status

Example output:

==============================================================================================================
 PLANTPULSE PLATFORM - ALL SERVICE STATUS
==============================================================================================================

<SYSTEM RESOURCE OVERVIEW>
  CPU LOAD (AVG)         :   12.3% (48 cores)
  MEMORY USAGE           :   65.2% (123.1G / 188.7G)
  DATA DISK USAGE        :   45.8% (2.2T / 4.8T)

<SERVICE STATUS BY PORT>
  SERVICE                 | PORT  | STATUS  | PID    | CPU   | MEMORY (PSS)
  PP_MESSAGING[KAFKA]     | 9092  | RUNNING | 12345  |  2.3% |   8.5G ( 4.5%)
  PP_STORAGE[CASSANDRA]   | 9042  | RUNNING | 12567  |  5.1% |  16.2G ( 8.6%)
  PP_SERVER               | 80    | RUNNING | 12890  |  1.2% |   4.8G ( 2.5%)
  ...

<SERVICE SUMMARY>
  TOTAL SERVICES         : 25 RUNNING / 0 STOPPED
  TOTAL CPU (SUM)        :  42.3%
  TOTAL MEMORY (PSS)     :  78.5% (148.0G)

ops-check.sh — Health + Recent Critical Logs​

./ops-check.sh

Automatically performs the following:

  • Confirms HTTPS health endpoint (https://127.0.0.1:4950/api/health) responses
  • Collects recent critical / fatal log messages
  • Measures response time per module

External Health Checks (Monitoring System Integration)​

# 호스트 / 외부에서 — 4950 이 유일하게 publish 되는 헬스 포트입니다
curl -kfsS https://[HOST]:4950/api/health | jq

# 컨테이너 안에서 — 어떤 구성에서도 동작합니다
docker exec plantpulse-datalake curl -kfsS https://127.0.0.1:4950/api/health | jq
Ports 4949 and 4950 are the same console

Console and health API are served on both ports — 4950 (HTTPS) and 4949 (plaintext HTTP). Same console, same API, only the scheme differs. Port 4949 no longer redirects to 4950.

4949 is plaintext — login passwords and session cookies flow in the clear. For untrusted networks, use 4950. Port 4949 exists as an option for environments where self-signed certificate warnings actually stop operators.

2. Quick Diagnosis by Port​

PortModuleQuick Check
80 / 443 / 7443servercurl -fsS http://[HOST]/api/v5/ping
9042Cassandrapd node status cluster status
5432PostgreSQLpd node psql then SELECT 1;
6379Valkeyredis-cli -a $PP_REDIS_PASSWORD ping
9000MinIOcurl -fsS http://[HOST]:9000/minio/health/live
9092Kafkakafka-broker-api-versions.sh --bootstrap-server [HOST]:9092
1883MQTTmosquitto_pub -h [HOST] -p 1883 -u mq -P $PP_MQ_PASSWORD -t test -m hi
7400CEPcurl -fsS -H "X-API-Key: $PP_CEP_API_KEY" http://[HOST]:7400/api/v1/status
5500Data Gatewaycurl -fsS http://[HOST]:5500/api/health (anonymous readiness — 200 only when UP)
7800TSEcurl -fsS http://[HOST]:7800/api/health
7077Spark Mastercurl -fsS http://[HOST]:4440/json/ | jq .workers
10000Kyuubibeeline -u "jdbc:hive2://[HOST]:10000" -e "SELECT 1"
19001Gravitinocurl -fsS -u gravitino:$PP_GRAVITINO_PASSWORD http://[HOST]:19001/api/metalakes
7233Temporaltemporal --address [HOST]:7233 namespace list
8380Kestracurl -fsS -u admin@plantpulse.io:$PP_KESTRA_ADMIN_PASSWORD http://[HOST]:8380/api/v1/flows
11004OPC-UAConnect via UaExpert or similar opc.tcp://[HOST]:11004
10210HA Daemoncurl -fsS http://[HOST]:10210/api/health
4950monitorcurl -kfsS https://[HOST]:4950/api/health | jq .status
Which container publishes which

80 · 443 · 1883 · 1884 are published by plantpulse-proxy, 11004 · 11005 by the OPC-UA plugin, 10210 by the HA container, and the rest by plantpulse-datalake. Four apps (server-web · batch-web · warehouse · aasx) do not expose host ports; check them via ./status.sh · ./logs.sh <컨테이너> → Port Configuration

Tools like pd node status · pd node psql live inside the data lake container (enter via ./shell.sh).

3. Port Conflict Diagnosis​

Check Occupying Process​

# 특정 포트
ss -tlnp | grep ":<port> "
sudo lsof -i :<port>

# 일괄 (PlantPulse 모든 핵심 포트)
ss -tlnp | grep -E ':(80|443|1883|1884|3000|4000|4950|5432|5500|6379|7077|7233|7400|7443|7800|8233|8380|9000|9042|9092|10000|10210|11004|19001)\s'

Resolve Conflicts​

SituationAction
External service occupies portMove external service to a different port
Orphaned previous PlantPulse process remainsIf native on host, pkill -ef plantpulse. If container-side, bin/down.sh then verify with docker ps -a
Default port unavailable by company policyHost-exposed ports are controlled by compose/docker-compose.yml in ports:. Change the mapping, then bin/restart.sh

4. Firewall Operations​

List Current Allow Rules​

# RHEL/Rocky/Oracle (firewalld)
sudo firewall-cmd --list-ports
sudo firewall-cmd --list-rich-rules
sudo firewall-cmd --list-services

# Ubuntu (ufw)
sudo ufw status numbered
sudo ufw status verbose

Add New Port During Operations​

# firewalld
sudo firewall-cmd --permanent --add-port=<port>/tcp
sudo firewall-cmd --reload

# ufw
sudo ufw allow <port>/tcp

Allow Only New Source IP​

# firewalld rich rule
sudo firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.10.0/24 port port=9042 protocol=tcp accept"
sudo firewall-cmd --reload

# ufw
sudo ufw allow from 192.168.10.0/24 to any port 9042

5. JMX Port Operations​

JMX ports (6199~7899) should allow only monitoring / control node IPs. To connect with JConsole / VisualVM:

# SSH 터널로 안전하게 접속 (권장)
ssh -L 7099:127.0.0.1:7099 root@[HOST]

# 로컬에서
jconsole 127.0.0.1:7099

For detailed JMX port mapping, see Installation: Port Configuration – JMX.

6. Common Issues​

SymptomRoot CauseFirst Action
Some containers unhealthyDependent container down / resource exhaustion./status.sh on host → if app, docker compose … restart <서비스>; if infrastructure, restart-<module>.sh inside container
Port LISTEN but health failsBoot incomplete / backend dependencies not readyUse ./stack-verify-boot.sh to check readiness. Clean install takes 15–18 minutes to stabilize
Entire stack downStack is stopped./up.sh on host (waits until ready, 0 = usable)
address already in useExternal process occupies itFollow Port Conflict Diagnosis above
No external access (internal works)Host firewall or cloud SGCheck firewall-cmd --list-ports and cloud SG
TLS handshake fails (TimeoutException only)Certificate SAN mismatchVerify PP_TLS_SAN_DNS / PP_TLS_SAN_IPS. Certificate is baked by plantpulse-certs one-shot → Security Configuration
Real-time updates dropFirewall/proxy idle timeoutRaise proxy_read_timeout on upstream proxy. Real-time push goes through 443

7. Operations Automation​

Health Check Cron​

# /etc/cron.d/plantpulse-health  (호스트에서)
*/5 * * * * root /opt/kopens/plantpulse-platform-docker/bin/ops-check.sh >> /var/log/plantpulse-ops.log 2>&1

For exit-code-based judgment, status.sh is cleaner — 0 = healthy / 2 = unhealthy is the binding contract.

*/5 * * * * root /opt/kopens/plantpulse-platform-docker/bin/status.sh >/dev/null 2>&1 || logger -t plantpulse "status.sh reported unhealthy"

Prometheus / Grafana Integration​

Configure Prometheus to scrape the /metrics endpoint exposed by plantpulse-monitor.

# prometheus.yml
scrape_configs:
  - job_name: plantpulse
    scheme: https
    tls_config:
      insecure_skip_verify: true    # 자체 서명 CA 를 쓰는 경우
    static_configs:
      - targets: ['[HOST]:4950']
Scraping via 4950 is recommended

Port 4949 also exposes the same API but in plaintext. Use 4949 if you're on a private network and certificate validation is a burden; otherwise use 4950.

Grafana dashboards can leverage pre-configured boards on plantpulse-timeseries/dashboard/ (port 3000), or connect the same data source to an external Grafana.