System properties and environment variables
You can use system properties and environment variables to configure many aspects of Management Center, from JMX to the home directory and feature flags. These properties give you the power to tweak settings at startup without having to configure anything in the UI.
If an environment variable isn't available for a property and you start Management Center using any of the following methods, you can use the JAVA_OPTS environment variable to set system properties:
-
Docker environments
tipYou may also need to use other environment variables. For the Docker reference, see DockerHub.
-
hz-mc conftool -
Start scripts included with Hazelcast Platform or Management Center such as
hz-mc start.
You can use properties to configure both Management Center and Management Center's client connection strategy on startup.
Management Center configuration
If an environment variable is available, it is listed under the system property in the Property column.
| Property | Description | Example |
|---|---|---|
| Whether a user can log into an account in Management Center on multiple devices in different locations at the same time. Default: true. See Secure user sessions. | bash |
| Whether Management Center logs auditable events. See Audit Logging. Default: false. | bash |
| List of check identifiers to be excluded from Healthcheck. By default, this is not set. See Healthcheck. | bash |
| Path to a YAML declarative configuration file that Management Center applies automatically before it starts. Not set by default. See YAML declarative configuration (Beta). | bash |
hazelcast. | Full class name of a variable replacer to use. See Variable replacers. | bash |
hazelcast. | Whether the configuration loading process stops when a replacement value is missing. Default: true. | bash |
| Prefix of all URL paths in Management Center. Default: ' ' (empty). | bash In this example, the URL for Management Center would be |
| A list of origins patterns for which cross-origin requests are allowed. If none of | bash |
| HTTP methods to allow for cross-origin requests. By default this is not set. If any other | bash |
| List of headers that a pre-flight request can list as allowed for use during an actual request. The special value A header name is not required to be listed if it is one of: By default this is not set. | bash |
| List of response headers that an actual response might have and can be exposed to the client. The special value A header name is not required to be listed if it is one of: By default this is not set. | bash |
| Whether user credentials are supported or not. Setting this property to true forbids originPatterns, allowedMethods, allowedHeaders to have a * value. Be aware that this option establishes a high level of trust with the configured domains and also increases the surface attack of the web application by exposing sensitive user-specific information such as cookies and CSRF tokens. By default this is not set (i.e. user credentials are not supported). | bash |
| Whether private network access is supported for user-agents restricting such access by default. Private network requests are requests whose target server's IP address is more private than that from which the request initiator was fetched. For example, a request from a public website ( By default this is not set (i.e. private network access is not supported). | bash |
| Configure how long, in seconds, the response from a pre-flight request can be cached by clients. By default this is not set. | bash |
hazelcast. | Timeout in milliseconds for Management Center operations that wait for a response from members. Default: 60000. | bash |
hazelcast. | Whether Management Center does not verify the hostname of signed TLS/SSL certificates. Default: false. | bash |
| Multiplier used for extending the disabled login period in case the failed login attempts continue after the disabled login period expires. Default: 10. See Secure user sessions. | bash |
| A comma separated list of cipher suites to be excluded from the list of supported ciphers in Management Center. Wildcards are supported. | bash |
| Path to an existing keystore. You do not have to set this property if you use a Hardware Security Module (HSM). Default: ' ' (empty). | bash |
| Password for the keystore. You do not have to set this property if you use a Hardware Security Module (HSM) that provides another means to access the keystore. Default: ' ' (empty). | bash |
| Type of the keystore. Default: JCEKS. | bash |
| Provider of the keystore. If you use a Hardware Security Module (HSM), specify the class name of your HSM's java. implementation. Default: System provider. | bash |
| Number of failed login attempts that Management Center allows before disabling logins. Default: 3. See Secure user sessions. | bash |
| Whether Management Center forces users to log out when other users try to log into the same account. Default: false. See Secure user sessions. | bash |
| Whether Management Center reads X- headers from reverse proxies. Default: true. | bash |
| Whether the /health endpoint is enabled on port hazelcast. + 1. Default: false. This endpoint is always served over HTTP, regardless of any TLS/SSL settings. This endpoint responds with 200 OK HTTP status code if Management Center is running. | bash In this example, the health check would be available at |
| The port on which the /health endpoint is exposed. Default: hazelcast. + 1. | bash |
| Home directory where metrics, executed SQL queries, and configuration settings are saved. See Configure Management Center. | bash |
| Network address that Management Center is reachable on. Default: 0. (all network interfaces). | bash |
| HTTP port for Management Center. Default: 8080. | bash In this example, the URL for Management Center would be |
| A comma separated list of cipher suits to be included in the list of supported ciphers in Management Center. Wildcards are supported. | bash |
| Initial duration for the disabled login period in seconds. Default: 5. See Secure user sessions. | bash |
| Whether the clustered JMX service is enabled. Default: false. See Clustered JMX. | bash |
| Hostname/IP address of the JMX host machine. This is used by the JMX client to connect back into JMX, so the given host must be accessible from the host machine that runs the JMX client. Default: Server's hostname. | bash |
| Whether mutual authentication is enabled for the JMX interface. Default: false. | bash |
| Port on which the clustered JMX service is exposed. Default: 9999. | bash |
| Port on which the Java process that you want to monitor listens for incoming connections from the client (Remote management applications) such as JConsole . For monitoring a local Java process, there is no need to specify the JMX RMI port number. Default: 9998. | bash |
| Whether TLS/SSL is enabled for communication between the JMX interface and JMX clients. Default: false. | bash |
| The standard name of the requested SSL protocol. Default: TLS. | bash |
| Path to a keystore. Default: ' ' (empty). | bash |
| Password for the keystore. Default: ' ' (empty). | bash |
| Path to a truststore. Default: ' ' (empty). | bash |
| Type of the truststore. Default: JKS. | bash |
| Password for the truststore. Default: ' ' (empty). | bash |
| Name of the algorithm based on which the authentication keys are provided. System default is used if none is provided. You can find out the default by calling the javax. method. | bash |
| Type of the keystore. Default: JKS. | bash |
| Name of the algorithm based on which the authentication keys are provided. You can find out the default by calling the javax. method. Default: System default. | bash |
| Timeout in milliseconds for Active Directory and LDAP search queries. Default: 3000. | bash |
| The standard name of the requested SSL protocol for LDAP connection. Default: TLS. | bash |
| Path to a keystore for LDAP SSL connection. Default: ' ' (empty). | bash |
| Type of the keystore. Default: JKS. | bash |
| Password for the keystore for LDAP SSL connection. Default: ' ' (empty). | bash |
| Name of the algorithm based on which the authentication keys are provided. Default: System default. | bash |
| Path to the truststore. Default: ' ' (empty). | bash |
| Password for the truststore. Default: ' ' (empty). | bash |
| Type of the truststore. Default: JKS. | bash |
| Name of the algorithm based on which the authentication keys are provided. Default: System default. | bash |
| The standard name of the requested SSL protocol for AD connection. Default: TLS. | bash |
| Path to a keystore for AD SSL connection. Default: ' ' (empty). | bash |
| Type of the keystore. Default: JKS. | bash |
| Password for the keystore for AD SSL connection. Default: ' ' (empty). | bash |
| Name of the algorithm based on which the authentication keys are provided. Default: System default. | bash |
| Path to the truststore. Default: ' ' (empty). | bash |
| Password for the truststore. Default: ' ' (empty). | bash |
| Type of the truststore. Default: JKS. | bash |
| Name of the algorithm based on which the authentication keys are provided. Default: System default. | bash |
| Enterprise license. When this property is set, the license takes precedence over one that is set in the user interface, and you cannot update the license in the UI. For more details about licenses, see See Enterprise licenses. | bash |
| Whether the hz- tool does not check for an mc. file in the home directory. Default: false. See Skipping the Check for a Lock File | bash |
| Maximum amount of time for the disable login period. By default, the disabled login period is unlimited. | bash |
| Whether Management Center persists metrics. Default: true. See Historical metrics. | bash |
| Time-to-Live (TTL) in ISO-8601-based durations format for each record in the metrics persistence. Default: P1 (one day). This value must be positive. See Historical metrics. | bash |
| Number of threads that are used to consume metrics from cluster members. Default: 2. See Historical metrics. | bash |
hazelcast. | Interval in milliseconds that Management Center waits before requesting metrics from cluster members. Default: 1000. | bash |
hazelcast. | Interval in seconds that Management Center holds Jet metrics in memory. Default: 3600. | bash |
| Whether Management Center sends usage data to the Hazelcast phone home server. Default: true. See Usage analytics. | bash |
| Whether to expose all metrics to the /metrics endpoint to be consumed by Prometheus. All metrics at the endpoint include the hz_ prefix. Default: false. | bash |
| Whether to send timestamp of the individual members' metrics to Prometheus. Its default value is true (enabled). | bash |
| Comma-separated list of metrics to include in the /metrics endpoint. Supports the * wildcard. Default: ' ' (empty). | bash |
| Comma-separated list of metrics to exclude from the /metrics endpoint. Supports the * wildcard. Default: ' ' (empty). | bash |
| Port on which the /metrics endpoint is exposed. |
bash bash In this example, the |
| Which set of metrics to expose. Default: V1,V2. See Prometheus metrics. | bash |
| Enable clustered REST endpoints. Default: false. | bash |
| Minimum length that words in the dictionary must contain. Default: 3. | bash |
| Path to a text file that contains words that cannot be included in user passwords. | bash |
| Number of seconds that a session can remain inactive before it is invalid and the user must log in again. Default 1800. | bash |
| Duration in milliseconds that Management Center waits before requesting metadata from a Hazelcast cluster. Metadata includes a list of all data structures and their configurations. Default: 1000. | bash |
| A comma separated list of TLS/SSL protocols to be excluded from the list of supported protocols in Management Center. | bash |
| Allow Management Center to use Google's Conscrypt SSL that is built on their fork of OpenSSL, BoringSSL. Default: false. | bash |
| Whether TLS/SSL is enabled. Default: false. | bash |
| Path to a keystore. | bash |
| Password of the keystore in hazelcast.. | bash |
| Path to a truststore. If the hazelcast. system property is true and this value is empty, Management Center uses the system JVM's own truststore. | bash |
| Password of the truststore. | bash |
| Whether the HTTP port in the hazelcast. system property is redirected to the HTTPS port in the hazelcast. system property. | bash |
| Whether clients connected to Management Center are authenticated:
Default: | bash |
| Enables use of an existing keystore. Default: false. | bash |
hazelcast. | Max length of a cell in SQL query result, longer values are truncated. Default: 2048. | bash |
hazelcast. | Max number of rows returned by SQL batch query. Default: 1000. | bash |
hazelcast. | The buffer size of the WebSocket connection MC uses for SQL operations. Default: 5. | bash |
hazelcast. | Tables bigger than the threshold are loaded asynchronously. You can't sort an asynchronous table. Default: 500. | bash |
Client connection strategy configuration
Use the following properties to configure the connection strategy of the Management Center client.
These properties apply to all clients that are started by Management Center.
| Property | Description | Example |
|---|---|---|
hazelcast. | Upper limit of the backoff in milliseconds. Default: 30000. Values must be between 30000 and 600000. | bash |
hazelcast. | Factor by which to multiply the backoff after each failed retry. Default: 2. Values must be between 1 and 10. | bash |
hazelcast. | Duration in milliseconds that Management Center waits after the first connection failure before retrying. Default: 1000. Values must be between 1000 and 60000. | bash |
hazelcast. | Adjusts client filtering modes. Default: ALLOWLIST, DENYLIST. Value must be set of ALLOWLIST and DENYLIST. | bash |
hazelcast. | Set the instance name visible in the Top Bar. Set blank to not display any instance name. If not set the instance name defaults to the hostname of the machine Manage Center is deployed on. | bash |
mask | Comma-separated list of option keys to be masked. Masks sensitive data in logs passed via JAVA_OPTS. Default: ' ' (empty). | bash |