I'm working with custom metrics into AppDynamics. My application only really generates stats daily, so I figured I'd have it POST them to the HTTP metrics listener. I've enabled this with the -Dmetric.http.listener=true command line setting, but notice that it listens to localhost and the machine's IP address (and is thus accessible over the network).
is there a way of starting the listener only on localhost/127.0.0.1 so that it's not accessible via the network? Is there a metric.http.listener.host parameter or something?
EDIT
Oh wow - this is really, really necessary. I just realised that the doco says:
To shut down the machine agent
GET /machineagent/shutdown
|
That's a pretty major security problem - you can shut down all machine agents running the HTTP metrics listener just by sending an unauthenticated GET request that contains no secret information, remotely across the network. This means I absolutely can't use the HTTP listener unless I can limit it to localhost, and even then, it's a horrible security risk. I really hope there's a way to disable this shutdown 'feature'.
