Menu Close

Chapter 3. Monitoring and managing Red Hat Fuse applications on Karaf standalone

3.1. About the Fuse Console

The Red Hat Fuse Console is a web console based on HawtIO open source software. For a list of supported browsers, go to Supported Configurations.

The Fuse Console provides a central interface to examine and manage the details of one or more deployed Fuse containers. You can also monitor Red Hat Fuse and system resources, perform updates, and start or stop services.

The Fuse Console is available when you install Red Hat Fuse standalone or use Fuse on OpenShift. The integrations that you can view and manage in the Fuse Console depend on the plugins that are running. Possible plugins include:

  • Camel
  • JMX
  • OSGI
  • Runtime
  • Logs

3.2. Accessing the Fuse Console

To access the Fuse Console for Apache Karaf standalone, follow these steps.


Install Fuse on the Karaf container. For step-by-step instructions, see Installing on Apache Karaf.


  1. In the command line, navigate to the directory in which you installed Red Hat Fuse and run the following command to start Fuse standalone:


    The Karaf console starts and shows version information, the default Fuse Console URL, and a list of common commands.

  2. In a browser, type the URL to connect to the Fuse Console. For example: http://localhost:8181/hawtio
  3. In the login page, type your user name and password and then click Log In.

By default, the Fuse Console shows the Home page. The left navigation tabs indicate the running plugins.

3.3. Securing the Fuse Console

To secure the Fuse Console on Apache Karaf:

  • Disable the Fuse Console’s proxy servlet when deploying to AWS

    If you want to deploy a standalone Fuse application to Amazon Web Services (AWS), you should disable the Fuse Console’s proxy servlet by setting the hawtio.disableProxy system property to true.


    When you disable the Fuse Console proxy servlet, the Fuse Console’s Connect tab is disabled and you cannot connect to other JVMs from the Fuse Console. If you want to deploy more than one Fuse application on AWS, you must deploy the Fuse Console for each application.

  • Set HTTPS as the required protocol

    You can use the hawtio.http.strictTransportSecurity property to require web browsers to use the secure HTTPS protocol to access the Fuse Console. This property specifies that web browsers that try to use HTTP to access the Fuse Console must automatically convert the request to use HTTPS.

  • Use public keys to secure responses

    You can use the hawtio.http.publicKeyPins property to secure the HTTPS protocol by telling the web browser to associate a specific cryptographic public key with the Fuse Console to decrease the risk of “man-in-the-middle” attacks with forged certificates.

  • Enable SSL/TLS security

    SSL/TLS security is not enabled by default for the Fuse Console. It is recommended that you enable SSL/TLS security on the Fuse Console to protect username/password credentials from snooping.

  • Implement Red Hat Single Sign On
  • Control user access

    The operations that an authenticated user is allowed to perform depend on the role (or roles) assigned to that user, as listed in Table 3.1, “Role-based access on Karaf standalone”.


  1. To set HTTPS as the required protocol, set the hawtio.http.strictTransportSecurity property in the $KARAF_HOME/etc/ file as shown in the following example:

    hawtio.http.strictTransportSecurity = max-age=31536000; includeSubDomains; preload
  2. To use public keys to secure responses, set the hawtio.http.publicKeyPins property in the $KARAF_HOME/etc/ file as shown in the following example:

    hawtio.http.publicKeyPins = pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs"; max-age=5184000; includeSubDomains
  3. (For deploying on AWS only) To disable the Fuse Console’s proxy servlet, set the hawtio.disableProxy property to true in the $KARAF_HOME/etc/ file as shown in the following example:

    hawtio.disableProxy = true;
  4. For detailed instructions on how to enable SSL/TLS security, see the "Enabling SSL/TLS for Undertow in an Apache Karaf container" section in the Apache Karaf Security Guide.
  5. For information on how to secure the Fuse Console with Red Hat Single Sign-On, see the section on securing the Hawtio administration console in the Red Hat Single Sign-on Securing Applications and Services Guide.
  6. To ensure that a user has the necessary user role authorization to perform the Fuse Console operations that the user needs to perform, follow these steps to set a user role:

    1. Open the Red Hat Fuse etc/ file in an editor.
    2. Add an entry for the user name, password, and role.

      For example, the following entry in the etc/ file defines the admin user and grants the admin role.

      admin = secretpass,admin
    3. Save the file.

Additional resources

  • For a description of the hawtio.http.strictTransportSecurity property’s syntax, see the description page for the HTTP Strict Transport Security (HSTS) response header.
  • For a description of the hawtio.http.publicKeyPins property’s syntax, including instructions on how to extract the Base64 encoded public key, see the description page for the HTTP Public Key Pinning response header.

3.4. Role-based access reference

The operations that an authenticated user is allowed to perform depend on the role (or roles) assigned to that user, as listed in Table 3.1, “Role-based access on Karaf standalone”.

Table 3.1. Role-based access on Karaf standalone


Log in/Log out




View Help topics




Set user preferences






Discover and connect to remote integrations




Discover and connect to local integrations






View all running Camel applications




Start, suspend, resume, and delete Camel contexts




Send messages




Add endpoints




View routes, route diagrams, and runtime statistics




Start and stop routes




Delete routes






Change attribute values




Select and view attributes in a time-based chart




View operations






View bundles, features, packages, services, servers, framework, and configurations




Add and delete bundles




Add configurations




Install and uninstall features





View system properties, metrics, and threads






View logs




Additional resources

For more information on role-based access control, see Deploying into Apache Karaf.

3.5. Customizing the Fuse Console branding

You can customize the Fuse Console branding information, such as title, logo, and login page information, by using the Fuse Console branding plugin.

By default, the Fuse Console branding is defined in the hawtconfig.json that is located in the Fuse Console WAR file (karaf-install-dir/system/io/hawt/hawtio-war/<version>/hawtio-war-<version>.war). When you implement the Fuse Console branding plugin, you can override the default branding with your own custom branding.


  1. Download the branding plugin example from to a local directory of your choice.
  2. In an editor of your choice, open the Fuse Console branding plugin’s src/main/webapp/plugin/brandingPlugin.js file to customize the Fuse Console branding.

    You can change the values of the configuration properties listed in Table A.1, “Fuse Console Configuration Properties”.

  3. Save your changes.
  4. In an editor of your choice, open the Fuse Console branding plugin’s pom.xml file to its <parent> section:

  5. Edit the <parent> section as follows:

    1. Change the value of the <version> property to match the version of your Fuse on Karaf installation. For example, if your Fuse on Karaf installation directory name is 2.0.0.fuse-760015, set the version to 2.0.0.fuse-760015.
    2. Remove the <relativePath>../..</relativePath> line.

      For example:

          <version> 2.0.0.fuse-760015</version>
  6. In a Terminal window, build the branding-plugin project by running the following command:

    mvn clean install
  7. If Fuse is not already running, start it by running the following command:

    Linux/Unix: bin/fuse

    Windows: bin\fuse.bat`

  8. At the Karaf CLI prompt, type the following command to install the Fuse Console branding plugin (where <version> is the version of your Fuse on Karaf installation):

    Linux/Unix: install -s mvn:io.hawt/branding-plugin/<version>/war

    Windows: install -s mvn:io.hawt\branding-plugin\<version>\war

  9. In a web browser, open the Fuse Console by using the URL that the start command returned in Step 7 (the default URL is http://localhost:8181/hawtio/).

If you have already run the Fuse Console in a web browser, the branding is stored in the browser’s local storage. To use new branding settings, you must clear the browser’s local storage.

3.6. Ensuring that data displays correctly in the Fuse Console

If the display of the queues and connections in the Fuse Console is missing queues, missing connections, or displaying inconsistent icons, adjust the Jolokia collection size parameter that specifies the maximum number of elements in an array that Jolokia marshals in a response.


  1. In the upper right corner of the Fuse Console, click the user icon and then click Preferences.

    mf preferences

  2. Increase the value of the Maximum collection size option (the default is 50,000).
  3. Click Close.

3.7. Disabling the Fuse Console

You can disable the Fuse Console on Karaf so that it becomes inaccessible to all users without affecting any other component.


  1. To determine the hawtio-web bundle ID, use the following command to list the Fuse bundles that the Fuse Console uses:

    osgi:list | grep hawtio

  2. To stop the bundle, use the osgi:stop command. For example, if the hawtio :: Web console bundle has an ID of 246, type this command:

    osgi:stop 246

The bundle goes into the resolved state and you can no longer access the Fuse Console.

Additional resources

For more information about managing bundles, see the "Lifecycle Management" chapter of Deploying into Apache Karaf.

3.8. Connecting to remote Fuse applications

The Fuse Console uses Jolokia, an agent-based approach to Java Management Extensions (JMX) that requires extra software (an agent) installed on the client. By default, Red Hat Fuse includes a jolokia agent.

With standalone Fuse Console distributions, you can connect to remote integrations that already have a jolokia agent ( running inside them. If the process that you want to connect to does not have a jolokia agent inside, refer to the jolokia documentation (

3.8.1. Unlocking the Fuse Console

By default, Jolokia for Fuse 7 standalone on Apache Karaf is locked and the Fuse Console is not accessible remotely.

To unlock the Fuse Console for a hostname or IP address other than locahost or, follow these steps:

  1. Open the $KARAF_HOME/etc/jolokia-access.xml file in an editor.
  2. Register the hostnames or IP addresses for the Fuse integrations that you want to access with the Fuse console by adding them to the <cors> section.

    For example, to access hostname from the Fuse Console, add the


    line as shown:

      Cross-Origin Resource Sharing (CORS) restrictions
      By default, only CORS access within localhost is allowed for maximum security.
      You can add trusted hostnames in the <cors> section to unlock CORS access from them.
        <!-- Allow cross origin access only within localhost -->
        <!-- Whitelist the hostname patterns as <allow-origin> -->
        <!-- Check for the proper origin on the server side to protect against CSRF -->
        <strict-checking />
  3. Save the file.

3.8.2. Restricting remote access

Optionally, you can restrict remote access to the Fuse Console for specific hosts and IP addresses.

You can grant overall access based on the IP address of an HTTP client. To specify these restrictions:

In the jolokia-access.xml file, add or edit a <remote> section that contains one or more <host> elements. For the <host> element, you can specify an IP address, a host name, or a netmask given in CIDR format (for example, for all clients coming from the 10.0 network).

The following example allows access from localhost and all clients whose IP addresses start with 10.0. For all other IP addresses, access is denied.


For more details, see the Jolokia security documentation (

3.8.3. Allowing connections to remote Fuse instances

The Fuse Console’s proxy servlet uses whitelist host protection, with which by default the Fuse Console can only connect to localhost. If you want to connect the Fuse Console to other remote Fuse instances, you need to configure the whitelist as follows:

For Apache Karaf, make the following configuration changes in etc/ file:

hawtio.proxyWhitelist = localhost,, myhost1, myhost2, myhost3

3.8.4. Connecting to a remote Jolokia agent

Before you begin, you need to know the connection details (host name, port, and path) of the remote Jolokia agent.

The default connection URL for the Jolokia agent for Fuse on Apache Karaf is http://<host>:8181/hawtio/jolokia.

As a system administrator, you can change this default.

Typically, the URL to remotely connect to a Jolokia agent is the URL to open the Fuse Console plus /jolokia. For example, if the URL to open the Fuse Console is http://<host>:1234/hawtio, then the URL to remotely connect to it would probably be http://<host>:1234/hawtio/jolokia.

To connect to a remote Jolokia instance so that you can examine its JVM:

  1. Click the Connect tab.
  2. Click the Remote tab, and then Add connection.
  3. Type the Name, Scheme (HTTP or HTTPS), and the hostname.
  4. Click Test Connection.
  5. Click Add.

The Fuse Console automatically probes the local network interfaces other than localhost and and adds them to the whitelist. Hence, you do not need to manually register the local machine’s addresses to the whitelist.

3.8.5. Setting data moving preferences

You can change the following Jolokia preferences, for example, if you want to more frequently refresh data that displays in the Fuse Console. Note that increasing the frequency of data updates impacts networking traffic and increases the number of requests made to the server.

  • Update rate - The period between polls to Jolokia to fetch JMX data (the default is 5 seconds).
  • Maximum depth - The number of levels that Jolokia will marshal an object to JSON on the server side before returning (the default is 7).
  • Maximum collection size - The maximum number of elements in an array that Jolokia marshals in a response (the default is 50,000).

To change the values of these settings:

  1. In the upper right of the Fuse Console, click the user icon and then click Preferences.

    mf preferences

  2. Edit the options and then click Close.

3.8.6. Viewing JVM runtime information

To view JVM runtime information, such as system properties, metrics, and threads, click the Runtime tab.

3.9. Viewing and managing Apache Camel applications

In the Fuse Console’s Camel tab, you view and manage Apache Camel contexts, routes, and dependencies.

You can view the following details:

  • A list of all running Camel contexts
  • Detailed information of each Camel context such as Camel version number and runtime statics
  • Lists of all routes in each Camel application and their runtime statistics
  • Graphical representation of the running routes along with real time metrics

You can also interact with a Camel application by:

  • Starting and suspending contexts
  • Managing the lifecycle of all Camel applications and their routes, so you can restart, stop, pause, resume, etc.
  • Live tracing and debugging of running routes
  • Browsing and sending messages to Camel endpoints


The Camel tab is only available when you connect to a container that uses one or more Camel routes.

3.9.1. Starting, suspending, or deleting a context

  1. In the Camel tab’s tree view, click Camel Contexts.
  2. Check the box next to one or more contexts in the list.
  3. Click Start or Suspend.
  4. To delete a context:

    1. Stop the context.
    2. Click the ellipse icon and then select Delete from the dropdown menu.

When you delete a context, you remove it from the deployed application.

3.9.2. Viewing Camel application details

  1. In the Camel tab’s tree view, click a Camel application.
  2. To view a list of application attributes and values, click Attributes.
  3. To view a graphical representation of the application attributes, click Chart and then click Edit to select the attributes that you want to see in the chart.
  4. To view inflight and blocked exchanges, click Exchanges.
  5. To view application endpoints, click Endpoints. You can filter the list by URL, Route ID, and direction.
  6. To view, enable, and disable statistics related to the Camel built-in type conversion mechanism that is used to convert message bodies and message headers to different types, click Type Converters.
  7. To view and execute JMX operations, such as adding or updating routes from XML or finding all Camel components available in the classpath, click Operations.

3.9.3. Viewing a list of the Camel routes and interacting with them

  1. To view a list of routes:

    1. Click the Camel tab.
    2. In the tree view, click the application’s routes folder:

      mf list of routes

  2. To start, stop, or delete one or more routes:

    1. Check the box next to one or more routes in the list.
    2. Click Start or Stop.
    3. To delete a route, you must first stop it. Then click the ellipse icon and select Delete from the dropdown menu.

      mf delete route

      • When you delete a route, you remove it from the deployed application.
      • You can also select a specific route in the tree view and then click the upper-right menu to start, stop, or delete it.
  3. To view a graphical diagram of the routes, click Route Diagram.
  4. To view inflight and blocked exchanges, click Exchanges.
  5. To view endpoints, click Endpoints. You can filter the list by URL, Route ID, and direction.
  6. Click Type Converters to view, enable, and disable statistics related to the Camel built-in type conversion mechanism, which is used to convert message bodies and message headers to different types.
  7. To interact with a specific route:

    1. In the Camel tab’s tree view, select a route.
    2. To view a list of route attributes and values, click Attributes.
    3. To view a graphical representation of the route attributes, click Chart. You can click Edit to select the attributes that you want to see in the chart.
    4. To view inflight and blocked exchanges, click Exchanges.
    5. Click Operations to view and execute JMX operations on the route, such as dumping the route as XML or getting the route’s Camel ID value.
  8. To trace messages through a route:

    1. In the Camel tab’s tree view, select a route.
    2. Select Trace, and then click Start tracing.
  9. To send messages to a route:

    1. In the Camel tab’s tree view, open the context’s endpoints folder and then select an endpoint.
    2. Click the Send subtab.
    3. Configure the message in JSON or XML format.
    4. Click Send.
    5. Return to the route’s Trace tab to view the flow of messages through the route.

3.9.4. Debugging a route

  1. In the Camel tab’s tree view, select a route.
  2. Select Debug, and then click Start debugging.
  3. To add a breakpoint, select a node in the diagram and then click Add breakpoint. A red dot appears in the node:

    mf breakpoint

    The node is added to the list of breakpoints:

    mf breakpointlist

  4. Click the down arrow to step to the next node or the Play button to resume running the route.
  5. Click the Pause button to suspend all threads for the route.
  6. Click Stop debugging when you are done. All breakpoints are cleared.

3.10. Viewing and managing JMX domains and MBeans

Java Management Extensions (JMX) is a Java technology that allows you to manage resources (services, devices, and applications) dynamically at runtime. The resources are represented by objects called MBeans (for Managed Bean). You can manage and monitor resources as soon as they are created, implemented, or installed.

With the JMX plugin on the Fuse Console, you can view and manage JMX domains and MBeans. You can view MBean attributes, run commands, and create charts that show statistics for the MBeans.

The JMX tab provides a tree view of the active JMX domains and MBeans organized in folders. You can view details and execute commands on the MBeans.


  1. To view and edit MBean attributes:

    1. In the tree view, select an MBean.
    2. Click the Attributes tab.
    3. Click an attribute to see its details.
  2. To perform operations:

    1. In the tree view, select an MBean.
    2. Click the Operations tab, expand one of the listed operations.
    3. Click Execute to run the operation.
  3. To view charts:

    1. In the tree view, select an item.
    2. Click the Chart tab.

3.11. Viewing and managing Quartz Schedules

Quartz ( is a richly featured, open source job scheduling library that you can integrate within most Java applications. You can use Quartz to create simple or complex schedules for executing jobs. A job is defined as a standard Java component that can execute virtually anything that you program it to do.

The Fuse Console shows the Quartz tab if your Camel route deploys the camel-quartz2 component. Note that you can alternately access Quartz mbeans through the JMX tree view.


  1. In the Fuse Console, click the Quartz tab.

    The Quartz page includes a treeview of the Quartz Schedulers and Scheduler, Triggers, and Jobs tabs.

  2. To pause or start a scheduler, click the buttons on the Scheduler tab.
  3. Click the Triggers tab to view the triggers that determine when jobs will run. For example, a trigger can specify to start a job at a certain time of day (to the millisecond), on specified days, or repeated a specified number of times or at specific times.

    • To filter the list of triggers select State, Group, Name, or Type from the drop-down list. You can then further filter the list by selecting or typing in the fill-on field.
    • To pause, resume, update, or manually fire a trigger, click the options in the Action column.
  4. Click the Jobs tab to view the list of running jobs. You can sort the list by the columns in the table: Group, Name, Durable, Recover, Job ClassName, and Description.

3.12. Viewing and managing your OSGI environment

For Apache Karaf standalone distributions, you can view and manage the Red Hat Fuse OSGi environment. You can view and manage container bundles, features, and configurations, as well as Java packages and OSGi services.

The OSGi tab contains a series of subtabs with options for each container component:

List of installed bundles. You can install and uninstall bundles, start and stop bundles, and edit bundle properties. You can also filter the list and toggle between list and grid view.
List of available features. You can install and uninstall features or feature repositories, and drill down to view feature details.
List of installed Java packages. You can view package versions and associated bundles.
List of running services. You can view service IDs, associated bundles and object classes.
Declarative Services
List of declarative OSGi services. You can view the service state and drill down to view service details. You can also activate and deactivate services.
Detailed information about the local or remote host in read-only mode.
Configuration options for the container OSGi framework. You can set the framework start level and the initial bundle start level.
List of configuration objects. You can view the state of each object and drill down to view or edit object details. You can also create a new configuration object.

3.13. Viewing diagnostics

Use the Diagnostics tab to view diagnostic information about the JVM via the JVM DiagnosticCommand and HotspotDiangostic interfaces.


The functionality is similar to the Diagnostic Commands view in Java Mission Control (jmc) or the command line tool jcmd. The plugin will provide corresponding jcmd commands in some scenarios.


  1. To retrieve the number of instances of loaded classes and the amount of bytes they take up, click Class Histogram. If the operation is repeated, the tab shows the difference since last run.
  2. To view the JVM diagnostic flag setting, click the JVM flags.
  3. For a running JVM, you can also modify the flag settings.

Additional resources

The supported JVM depends on the platform, for more information go to one of the following sources:

3.14. Viewing threads

You can view and monitor the state of threads.


  1. Click the Runtime tab and then the Threads subtab. The Threads page lists active threads and stack trace details for each thread. By default, the thread list shows all threads in descending ID order.
  2. To sort the list by increasing ID, click the ID column label.
  3. Optionally, filter the list by thread state (for example, Blocked) or by thread name.
  4. To drill down to detailed information for a specific thread, such as the lock class name and full stack trace for that thread, in the Actions column, click More.

3.15. Viewing log entries

You can view log entries for Red Hat Fuse in the Logs tab.


The Logs tab is available when the Java application includes the Log MBean.


  1. To view a list of the log entries, click the Log Entries tab.

    By default, the list shows log entries in ascending order.

    You can drill down to each log entry to view detailed information about the log entry.

  2. To filter the list of logs to show specific log types, click the Action Bar. You can filter the log entries section according to a text string or the logging level.
  3. To change the Fuse Console default settings:

    1. In the upper right corner of the Fuse Console, click the user icon and then click Preferences from the drop-down menu.

      mf preferences

    2. To change the default sorting order, select Server Logs and then click the log entry link to drill down to details about the log entry, such as the bundle name, thread, and the full message text.
    3. Optionally, you can customize these settings for storing log messages:

      • The number of log statements to keep in the Fuse Console (the default is 100).
      • The global log level: INFO (the default), OFF, ERROR, WARN, and DEBUG.
      • The child-level messages to include, such as hawtio-oauth and hawtio-core-utils.
    4. To reset the Fuse Console Logs settings to the default values, click ResetReset settings.

3.16. Enabling Prometheus metrics

Prometheus is an open-source systems and service monitoring and alerting toolkit that you can use to monitor services deployed in a standalone Apache Karaf container. Prometheus collects and stores metrics from configured services at given intervals, evaluates rule expressions, displays the results, and can trigger alerts if a specified condition becomes true.


Red Hat support for Prometheus is limited to the setup and configuration recommendations provided in Red Hat product documentation.

Prometheus uses “exporters” that are installed and configured on the clients to expose an endpoint to Prometheus format. This endpoint is an HTTP interface that provides a list of metrics and the current values of the metrics. Prometheus periodically scrapes each target-defined endpoint and writes the collected data to its database. Prometheus gathers data over an extended time, rather than just for the currently running session. Prometheus stores the data so that you can graphically visualize and run queries on the data.

3.16.1. Enabling the export of metrics from a standalone Apache Karaf container

Prometheus uses a configuration file ( which includes metrics exposed by Camel.


The metrics that you can identify are limited to those supplied in JMX.

You must deploy a Fuse application in order for Apache Camel metrics to be generated.


To enable the export of Prometheus metrics from a standalone Apache Karaf container using the command line:

  1. Open a command prompt and make sure you are in the etc/ directory of your Apache Karaf installation.
  2. Type the following command to create the Prometheus configuration file from the example file in the etc/ directory:

    cp prometheus-config.yml-example prometheus-config.yml
  3. The exporter is only available when you use the fuse or fuse.bat command to start Fuse: run bin/fuse on Linux/Unix or bin\fuse.bat on Windows.
  4. When Fuse has restarted, you can view the exposed metrics by opening a web browser at: http://localhost:9779

Optionally you can change the default values of the KARAF_PROMETHEUS_PORT and KARAF_PROMETHEUS_CONFIG configuration variables from the command line.

3.16.2. Configuring the Prometheus server to scrape exposed metrics from the Apache Karaf container

To enable the Prometheus server to scrape metrics from the Apache Karaf container, the endpoint which exposes the metrics must be added to the targets property of the Prometheus configuration file.


  1. Navigate to the /prometheus.yml configuration file in the Prometheus installation directory.
  2. Add the Apache Karaf endpoint to scrape:

      - job_name: 'prometheus'
        # metrics_path defaults to '/metrics'
        # scheme defaults to 'http'.
        - targets: ['localhost:9779']