Admin Console
The operations console for a data lake node. View status, metrics, logs, diagnostics, settings, backups, and workers in one screen via browser; execute authorized pd commands; and serve a health API to external monitoring systems (Grafana, Prometheus, Zabbix) on the same address.
| Item | Value |
|---|---|
| Backend module | plantpulse-datalake-admin-api (until 2026-09-03: plantpulse-monitor) |
| Where it runs | plantpulse-datalake container — master and worker nodes alike |
| Address (TLS) | https://<server-ip>:4950/ |
| Address (plaintext) | http://<server-ip>:4949/ — same console, same API |
| Login | PP_DATALAKE_ADMIN_USER (default admin) / PP_DATALAKE_ADMIN_PASSWORD |
| Default language | English. Append ?lang=ko for Korean |
Access
Point your browser to one of two addresses. Same console, different scheme.
https://<server-ip>:4950/?lang=ko # TLS — 권장
http://<server-ip>:4949/?lang=ko # 평문 — 4950 으로 리다이렉트하지 않습니다
Login password and session cookies flow in the clear. On untrusted networks, always use 4950. Port 4949 exists by design, not by accident — self-signed certificate warnings actually prevent operators from accessing some deployments.
If you connect via TLS, you may see a self-signed certificate warning. Instructions for replacing it with a real certificate are in Security Settings.
Login
The login screen displays this node's name and role (master / worker). When you have multiple nodes open, use this to confirm which box you're in.
| Variable | Default | Description |
|---|---|---|
PP_DATALAKE_ADMIN_USER | admin | Login username |
PP_DATALAKE_ADMIN_PASSWORD | Builds from 2026-09-05 onward: development default; before that: empty | If empty, the console will not open |
PP_DATALAKE_ADMIN_API_KEY | None | X-API-Key used when machines call the logs endpoint |
For instructions on changing or setting the password for the first time, see Web UI Login Accounts — Admin Console.
This means PP_DATALAKE_ADMIN_PASSWORD is empty. Only the console fails to start; the data lake boots normally. It is not a fault but a commissioning omission. Set a value and restart.
Screen Layout — Rail and Sidebar
A narrow vertical strip on the left is the rail, showing eight groups as icons. The rail shows icons only — hover over them for tooltips with names.
Select a group to expand its screens in the sidebar. However, groups with only one screen have no sidebar — there is nothing to choose, so why take up space?
The rail's order mirrors how people ask about incidents — "Is something wrong now?" → "Where?" → "What is true?" → "Who do we tell?" → "What do we change?" → "Commands?" → "Other views?" → "What happened?"
| Group | Area | Screen | Answers |
|---|---|---|---|
| Overview | — | Dashboard | Is something wrong right now? |
| Topology | — | Topology (tabs: Data Flow, Nodes) | Where in the pipeline is the block? Does data flow through the rest? |
| Observe | Status | Status, Metrics | Current verdict and trends over the past hour to week |
| Resources | Storage | Volumes, WAL, replication slots, store size | |
| Activity | Events, Logs, Diagnostics, Jobs | What happened — event journal, service logs, pd doctor, backup and archive job history | |
| Alarms | — | Alarms | Who to notify, and when |
| Operate | Settings | Settings | Diff between template and render result, template editing and rollback |
| Maintenance | Upgrade, Workers | Version per module, what to change on cluster workers | |
| Backup | Backup | Backup sets, schedule editing, run and restore | |
| Commands | — | Commands | Execute authorized pd verbs from the screen |
| Tools | — | Tools | Links to other products' web UIs as cards |
| Audit | — | Audit | Who changed what in this console |
Reading the Dots on the Rail
A dot next to a group icon on the rail shows the worst state of all screens in that group.
If polling stops, a response is empty, or a component is UNKNOWN, there is no dot at all. It does not turn green. In other words, no dot and a green dot are different things. Do not read "no color" as "all is well" — it means unmeasured.
The dot in the Alarms group looks at the alarm list itself, not health.
| Dot | Meaning |
|---|---|
| FAIL | At least one alarm is sounding |
| WARN | Active alarms exist, but all are muted |
| OK | No active alarms at all |
| No dot | Alarm polling stopped — not quiet, but unmeasured |
Quiet is not normal. Mute, rule disabled, below minimum severity, suppression window, no channel — there are five reasons an alarm does not sound, and the console tells you each in a different sentence.
What to Know About Each Screen
| Screen | What to Know |
|---|---|
| Topology | The two tabs are two views of the same system — data flow (MQTT → Kafka → consumers) and nodes (master, workers). When the dashboard says "something is wrong," look here to find which segment. |
| Status → Components | Tap a row to enter component details. Same row as the pd status table, refreshed every 15 seconds. A few seconds of STOPPED right after startup is a window. |
| Logs | Shows only files declared by pd logs --list. Logs from app containers (server, batch, warehouse) are not here — use the host's logs.sh. |
| Diagnostics | Result of pd doctor. The "Run checks" button triggers another run immediately. It processes one at a time; if "busy" appears, wait a moment and tap again. |
| Jobs | History of backup, archive, and maintenance jobs in one place. The Backup screen shows backups separately. |
| Settings | "What changes if I render now?" (pd config diff) and "Is my template different from the image default?" (pd config diff --templates). Edit the template on-screen, and revisions are kept for rollback. The source of truth for values (passwords, addresses) is still the host → Changing settings |
| Upgrade | PlantPulse version and commit per module. Reads /etc/plantpulse-modules.json baked into the image. |
| Workers | Shows commands for what must change on cluster workers; does not run them. Execution is on the host → Cluster installation |
| Backup | Set list, timer schedule, running jobs. "Schedule editor" invokes pd backup schedule set → Backup and restore |
| Commands | Only pd verbs on the server's allow list can run (the list appears on-screen). Other commands go to the container shell → pd CLI |
| Tools | Collects web UIs from other products as cards that open in a new tab. The host in the address follows the host you are now connected to, so no matter which box you open from, you get that box's tools. Cards for services not on this node do not render. |
| Audit | Who changed what in this console. Worker nodes have no audit store, so it always shows "not readable" — not a quiet week, but unmeasured. |
Screens not yet providing data show themselves as empty while noting that emptiness is not the same as "all clear." Do not read a blank screen as normal.
Tool Screen Cards
| Card | Address | What |
|---|---|---|
| CEP | https://<호스트>:7401/ | EQL rules and events they matched |
| Grafana | https://<호스트>:3000/ | Dashboard for time series data |
| Timeseries Engine | https://<호스트>:7801/ | Management UI for the engine itself, not time series data |
| Spark | http://<호스트>:4440/ | Spark master, workers, and running applications |
| Temporal | http://<호스트>:8233/ | Workflow runs and history |
| Kestra | https://<호스트>:8380/ | Data pipelines — flows, runs, logs |
| MinIO | http://<호스트>:9001/ | Object storage — buckets, objects, access keys |
| Data Gateway | https://<호스트>:5501/ | SQL execution console. The old SQL tool card has merged into this one (2026-09-07). |
Screens with TLS twin ports link to the TLS side. Because this console runs on TLS (4950), it does not hand out plaintext addresses.
How Often the Console Calls pd
Console screens do not run pd on every request. The backend's collection loop runs it one at a time and caches the last document; screens read that cache.
| Verb | Interval |
|---|---|
pd status --json, pd logs --list | 15 seconds |
pd node status --json, pd storage --json | 30 seconds |
pd flow --json, pd config diff --json, pd env --json | 60 seconds |
pd doctor --json, pd retention --json, pd config diff --templates --json | 300 seconds |
At these intervals, about 46 of every 60 seconds are spent running pd. So pd status being occasionally slow on the box where the console is open is normal.
Health API
Every screen the console draws sits on top of /api/*, and the console reads /api/openapi.json to show you the full list and schema as an API table.
curl -kfsS https://<server-ip>:4950/api/health | jq # TLS
curl -fsS http://<server-ip>:4949/api/health | jq # 평문 — 같은 API
docker exec plantpulse-datalake curl -kfsS https://127.0.0.1:4950/api/health | jq # 컨테이너 안 — 어떤 구성에서도
curl -kfsS https://<server-ip>:4950/api/services | jq # 서비스 목록과 상태
Host status.sh, ops-check.sh, doctor.sh, and stack-verify-boot.sh all read this /api/health. /api/health answers without authentication; all other APIs require a login session or X-API-Key (for the logs endpoint).
Prometheus Integration
Scrape https://<server-ip>:4950/metrics. If it is self-signed CA, enable insecure_skip_verify. Connect it as a data source in the platform's bundled Grafana (3000) or an external Grafana.
Common Issues
| Symptom | Cause | Fix |
|---|---|---|
| Console will not open; "not configured" | PP_DATALAKE_ADMIN_PASSWORD is empty | Web UI Login Accounts |
| 4949 works but 4950 does not | Certificate issue | Check browser warning or Security Settings to replace the certificate |
| Health endpoint unresponsive | Data lake container problem | From the host: status.sh → logs.sh plantpulse-datalake |
| Entire screen says "Not measured" | Polling stopped or old image | Check pd env in IMAGE_BUILT_AT. Builds before 2026-09-04 generated "Another job is already running" often. |
| Tool card does not render | Service not on this node (worker) or polling unresponsive | Use the master node's console |
| Prometheus scrape returns 5xx | Backend module down | Use status.sh to check dependent modules |
| Audit screen says "not readable" | Worker node | Normal — view it on the master |
Related Documentation
- Web UI Login Accounts
pdCLI — the source of what the console shows- System Monitoring — readiness health checks for each web app
- Ports and Services