rudder agent version

Rudder agent 9.1.5

rudder server health

OK

ls /opt/rudder/etc/

agent-capabilities
hooks.d
htpasswd-webdav
htpasswd-webdav-initial
instance-id
logback.xml
openldap
plugins
policy_server.dat
postgresql
relayd
reportsInfo.xml
rudder-apache-relay-common.conf
rudder-apache-relay-nossl.conf
rudder-apache-relay-ssl.conf
rudder-apache-relay-ssl.conf.j2
rudder-apache-webapp-common.conf
rudder-apache-webapp-nossl.conf
rudder-apache-webapp-ssl.conf
rudder-apache-webapp-ssl.conf.j2
rudder-jetty-base
rudder-jetty.conf
rudder-networks-24.conf
rudder-networks-policy-server-24.conf
rudder-passwords.conf
rudder-pkg
rudder-users.xml
rudder-web.properties
rudder-web.properties.d
rudder.conf
ssl
uuid.hive

cat /opt/rudder/etc/rudder-relayd/main.conf

cat: /opt/rudder/etc/rudder-relayd/main.conf: No such file or directory

# 改 rudder-web.properties / rudder-users.xml 相关 JVM 侧后
systemctl restart rudder-jetty

# 改 relayd/*.conf 后
systemctl restart rudder-relayd

# 改 rudder-networks-24.conf 后
systemctl reload apache2

# 确认 JVM 进程参数（验证内存修改是否生效，5.1 节实测）
ps -ef | grep java | grep -v grep | grep -oE "\-Xms[0-9]+m -Xmx[0-9]+m"

# 确认 Web 应用已恢复（HTTP 302 跳登录页即正常）
curl -sk -o /dev/null -w "%{http_code}\n" https://localhost/rudder/secure/index.html

-Xms512m -Xmx512m

302

JAVA_XMX=${JAVA_XMX:=1024}

-Xms${JAVA_XMX}m -Xmx${JAVA_XMX}m

Rudder requires Java 17 or later. Your version of Java (detected as ${JAVA}) is ${JAVA_MAJOR_VERSION}.

JAVA_XMX=512
JAVA_MAXPERMSIZE=256

sed -i "s/^JAVA_XMX=512/JAVA_XMX=384/" /etc/default/rudder-jetty
grep "^JAVA_XMX" /etc/default/rudder-jetty
systemctl restart rudder-jetty
ps -ef | grep java | grep -v grep | grep -oE "\-Xms[0-9]+m -Xmx[0-9]+m" | head -1

JAVA_XMX=384
-Xms384m -Xmx384m

JAVA_XMX=512
-Xms512m -Xmx512m

curl -sk -o /dev/null -w "admin_login=%{http_code} %{redirect_url}\n" -d "username=admin&password=q1w2e3r4" https://localhost/rudder/j_spring_security_check

admin_login=302 https://localhost/rudder/secure/index.html

rudder.jdbc.driver=org.postgresql.Driver
rudder.jdbc.url=jdbc:postgresql://localhost:5432/rudder
rudder.postgresql.local=true
rudder.jdbc.username=rudder
rudder.jdbc.password=<已脱敏>
rudder.jdbc.maxPoolSize=25
rudder.jdbc.batch.max.size=500
ldap.host=localhost
ldap.port=389
ldap.authdn=cn=manager,cn=rudder-configuration
ldap.maxPoolSize=2
ldap.authpw=<已脱敏>

rudder.batch.reportscleaner.archive.TTL=0
rudder.batch.reportscleaner.delete.TTL=4
rudder.batch.reportscleaner.deleteLogReport.TTL=2x
rudder.batch.reportscleaner.compliancelevels.delete.TTL=8
rudder.batch.reportscleaner.frequency=daily
rudder.batch.databasecleaner.runtime.minute=0
rudder.batch.databasecleaner.runtime.hour=0
rudder.batch.databasecleaner.runtime.day=sunday

inventories.root.directory=/var/rudder/inventories
inventories.watcher.period.garbage.old=5 minutes
inventories.watcher.max.age.before.deletion=2 days
inventories.reject.maxAgeBeforeNow=2 days
inventories.reject.maxAgeAfterNow=12 hours
inventory.parse.parallelization=2
rudder.batch.purge.inventories.delete.TTL=7

[processing.reporting.cleanup]
frequency = "10min"
retention = "1day"

[general]
nodes_list_file = "/var/rudder/lib/relay/nodeslist.json"
nodes_certs_file = "/var/rudder/lib/ssl/allnodescerts.pem"
node_id = "root"
listen = "127.0.0.1:3030"
peer_authentication = "cert_pinning"
https_port = 443

[processing.inventory]
directory = "/var/rudder/inventories"
output = "disabled"

[processing.inventory.catchup]
frequency = 10
limit = 50

[processing.reporting]
directory = "/var/rudder/reports"
output = "database"
skip_event_types = []

[processing.reporting.catchup]
frequency = 10
limit = 0

[output.database]
url = "postgresql://rudder@localhost:5432/rudder"
password = "<已脱敏>"
max_pool_size = 10

[output.upstream]
host = "127.0.0.1"
user = "rudder"
password = "<已脱敏>"

[remote_run]
command = "/opt/rudder/bin/rudder"
use_sudo = true

[shared_files]
path = "/var/rudder/shared-files/"

[shared_folder]
path = "/var/rudder/configuration-repository/shared-files/"

[general]
#level = "info"
#filter = ""

cp /opt/rudder/etc/relayd/logging.conf /tmp/logging.conf.bak
sed -i 's|^#level = "info"|level = "debug"|' /opt/rudder/etc/relayd/logging.conf
grep "^level" /opt/rudder/etc/relayd/logging.conf
systemctl restart rudder-relayd
journalctl -u rudder-relayd --no-pager -n 12 | tail -12

level = "debug"
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd: Creating HTTP client for upstream
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd::http_client: Creating HTTP client with pinned certificates
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd: Setup configuration reload signal handler
Oct 22 10:35:49 rudder-server rudder-relayd[32371]:  INFO reporting:watcher{path="/var/rudder/reports/incoming" cfg=CatchupConfig { frequency: 10s, limit: 0 }}: rudder_relayd::input::watch: Starting file watcher on "/var/rudder/reports/incoming"
Oct 22 10:35:49 rudder-server rudder-relayd[32371]:  INFO rudder_relayd: Skipping inventory as it is disabled
Oct 22 10:35:49 rudder-server rudder-relayd[32371]:  INFO api: rudder_relayd::api: Starting API on 127.0.0.1:3030
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd::processing::shared_files: starting shared-files cleanup in "/var/rudder/shared-files/"
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd: Setup shutdown signal handler
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd::processing::shared_files: cleaning shared-files in "/var/rudder/shared-files/"
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd::input::watch: listing "/var/rudder/reports/incoming"
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd::input::watch: cleaning "/var/rudder/reports/incoming"
Oct 22 10:35:49 rudder-server rudder-relayd[32371]: DEBUG rudder_relayd::input::watch: cleaning "/var/rudder/reports/failed"

<user name="NAME" password="REPLACE_BY_HASH" permissions="ROLE" tenants="*" />
<user name="admin" password="$argon2id$...(哈希略)" permissions="administrator"/>

rudder server create-user -u opsuser -p "Ops#2026x"

User 'opsuser' added, restarting the Rudder server

grep -c opsuser /opt/rudder/etc/rudder-users.xml
curl -sk -o /dev/null -w "%{http_code} -> %{redirect_url}\n" -d "username=opsuser&password=Ops#2026x" https://localhost/rudder/j_spring_security_check

0
302 -> https://localhost/rudder/index.html?login_error=true

Require ip 127.0.0.0/8
Require ip ::1
Require ip 127.0.0.1
Require ip 10.89.61.2
Require ip 127.0.0.1
Require ip 10.89.61.2/24

cat /var/rudder/cfengine-community/policy_server.dat

rudder-server

rudder agent policy-server
rudder agent policy-server rudder-server

rudder-server

echo rudder-wrong > /var/rudder/cfengine-community/policy_server.dat
rudder agent update

   error: Unable to resolve policy server host: rudder-wrong
   error: Unable to resolve policy server host: rudder-wrong
   error: No suitable server found for '/var/rudder/cfengine-community/inputs/rudder-promises-generated.tmp'
   error: Promise belongs to bundle 'update_action' in file '/var/rudder/cfengine-community/inputs/common/1.0/update.cf' near line 187
   error: Errors encountered when actuating files promise '/var/rudder/cfengine-community/inputs/rudder-promises-generated.tmp'
R: ******************************************************************************
* rudder-agent could not get an updated configuration from the policy server.   *
* This can be caused by:                                                        *
*   * an agent key that has been changed                                        *
*   * if this node is not accepted or deleted node on the Rudder root server    *
*   * if this node has changed policy server without sending a new inventory    *
* Any existing configuration policy will continue to be applied without change. *
*********************************************************************************
error: Rudder agent policies could not be updated.

rudder agent set-force-audit

ok: Rudder agent is now enforced in audit mode.

       Report mode: full-compliance
  Forced audit mode: since 2026-10-22 10:33:45+0000

rudder agent unset-force-audit

ok: Rudder agent is not enforced in audit mode anymore.

rudder agent info | grep -i audit

  Forced audit mode: no