gemfire.properties and gfsecurity.properties: Geode Properties

You use the gemfire.properties settings to join a cluster and configure system member behavior. Cluster members include applications, the cache server, the locator, and other Geode processes.

You can place any security-related (properties that begin with security-*) configuration properties in gemfire.properties into a separate gfsecurity.properties file. Placing these configuration settings in a separate file allows you to restrict access to security configuration data. This way, you can still allow read or write access for your gemfire.properties file.

You can also define provider-specific properties ("ssl" properties) in gfsecurity.properties instead of defining them at the command-line or in your environment.

You can specify non-ASCII text in your properties files by using Unicode escape sequences. See Using Non-ASCII Strings in Apache Geode Property Files for more details.

Note: Unless otherwise indicated, these settings only affect activities within this cluster - not activities between clients and servers or between a gateway sender and gateway receiver in a multi-site installation.

Setting	Definition	Applies to (Server, Locator, Client)	Default
ack-severe-alert-threshold	Number of seconds the cluster will wait after ack-wait-threshold for a message to be acknowledged before issuing a severe alert. 0 disables this feature.	S, L	0
ack-wait-threshold	Number of seconds a distributed message can wait for acknowledgment before sending an alert (logged as warnings). The waiter continues to wait. Valid range: 0..2147483647.	S, L	15
archive-disk-space-limit	Max size (MB) of all inactive statistic archive files combined. If exceeded, inactive archives are deleted oldest-first until within limit. 0 = unlimited.	S, L	0
archive-file-size-limit	Max size (MB) of a single statistic archive file. When exceeded, a new archive is created and the current becomes inactive. 0 = unlimited.	S, L	0
async-distribution-timeout	Milliseconds a publisher tries to distribute to this member before switching to async messaging (until it catches up, departs, or async limits are reached). Enable by setting > 0. Valid range: 0..60000. Note: Peer-to-peer only (not client/server or multi-site).	S	0
async-max-queue-size	Max size (MB) for non-conflated async queues for publishers to this member before asking this member to leave the cluster. Valid range: 0..1024. Note: Peer-to-peer only (not client/server or multi-site).	S	8
async-queue-timeout	Max milliseconds a publisher waits with no distribution to this member before asking it to leave the cluster (slow receiver handling). Note: Peer-to-peer only (not client/server or multi-site).	S, L	60000
bind-address	For multi-homed hosts: which NIC/address to bind for peer-to-peer comms, and default for servers to listen on unless overridden by server-bind-address. Use IP (not hostname). Empty = default NIC.	S, L	not set
cache-xml-file	Declarative initialization file for the member’s cache.	S	cache.xml
cluster-configuration-dir	Deprecated. Use gfsh import/export cluster-configuration. Directory where cluster configuration disk-store/artifacts are stored (dedicated locators with cluster config enabled).	L	not set
conflate-events	Client/server only. Client-side property passed to server. Controls subscription queue conflation for this client’s servers: true, false, or server.	S	server
conserve-sockets	If true, threads share sockets (fewer sockets). If false, each app thread has its own sockets. For WAN deployments, keep default false to avoid WAN messaging hangs.	S, L	false
delta-propagation	Whether to distribute deltas for entry updates instead of full values (client/server and peer-to-peer).	S	true
deploy-working-dir	Working directory used when deploying JARs to members (local or shared).	S	. (current directory)
disable-auto-reconnect	If true, disables automatic reconnect/reinitialize after being forced out/shunned (servers and locators).	S, L	false
disable-jmx	If true, prevents creation of JMX MBeans (gfsh and Pulse require them).	S, L	false
disable-tcp	If true, disables TCP sockets for inter-cache point-to-point messaging (uses UDP datagrams).	S, L	false
distributed-system-id	Identifier to distinguish messages from different clusters. Required for PDX. Must be consistent within a cluster and unique across WAN clusters. Valid range: -1..255 (-1 = unset).	S, L	-1
durable-client-id	Client/server only. Marks client as durable and identifies it; used by servers to resume messaging after downtime.	C	not set
durable-client-timeout	Client/server only. Seconds client can stay disconnected while server accumulates durable events.	C	300
enable-cluster-configuration	Dedicated locators only. If true, creates/serves cluster config to joining members and persists changes from gfsh.	L	true
enable-management-rest-service	If true, enables cluster management REST service. Requires cluster configuration enabled, and only starts if http-service-port ≠ 0.	L	true
enable-network-partition-detection	Detects/handles split brain. Must be same across all members. Must be true for persistent regions with DISTRIBUTED_ACK or GLOBAL scope to avoid conflicts.	S, L	true
enable-time-statistics	Tracks time-based statistics. Disabled by default for performance; not recommended for prod. Requires statistic-sampling-enabled=true and statistic-archive-file set.	S, L	false
enforce-unique-host	For partitioned region redundancy: prevents placing redundant copies on members on the same physical machine; requires different machines.	S	false
geode.disallow-internal-messages-without-credentials	If true, enables internal message validation. Set as a system property when restarting servers to work with upgraded clients.	S	false
groups	Comma-separated list of member groups. Roles also count as groups.	S	not set
http-service-bind-address	If set, binds embedded HTTP service to specified address. If HTTP service enabled and this isn’t set, binds to local address. Used by Pulse and developer REST API.	S	not set
http-service-port	If non-zero, starts embedded HTTP service on this port (Pulse + dev REST API). Set to 0 to disable. Ignored if jmx-manager and start-dev-rest-api are both false.	S	7070
jmx-manager	If true, member is willing to be a JMX Manager. If false, all jmx-manager-* props are ignored.	S, L	false (except on locators)
jmx-manager-bind-address	Address/hostname the JMX Manager listens on for non-HTTP connections (default: all local addresses). Ignored if jmx-manager=false or jmx-manager-port=0.	S, L	not set
jmx-manager-hostname-for-clients	Hostname given to clients asking locator for JMX Manager location (default: reported IP). Ignored if jmx-manager=false or jmx-manager-port=0.	S, L	not set
jmx-manager-http-port	Deprecated. Use http-service-port.	S, L	7070
jmx-manager-port	Port JMX Manager listens on. 0 disables remote connections (you can use JVM JMX system properties instead). Ignored if jmx-manager=false.	S, L	1099
jmx-manager-start	If true, starts a JMX Manager when cache is created. Usually unnecessary (manager starts when needed if jmx-manager=true). Ignored if jmx-manager=false.	S, L	false
jmx-manager-update-rate	Milliseconds between pushing updates to JMX Managers. Should be ≥ statistic-sample-rate. Too high can cause stale values in gfsh/Pulse.	S, L	2000
load-cluster-configuration-from-dir	If true, loads cluster configuration from cluster_config directory in the locator (dedicated locators with cluster config enabled).	L	false
locator-wait-time	Seconds a member waits for a locator to start if none available when joining (useful when starting all at once).	S	0
locators	Locator list for members (must be consistent across cluster). Format examples: text\nlocators=addr1[port1],addr2[port2]\nlocators=host1@addr1[port1]\nlocators=host1[port1],host2[port2]\n Notes: On multi-homed hosts, hostname-only uses default address—specify addresses if locators use bind addresses. If locators is set, mcast-port defaults to 0. Invalid DNS hostnames can prevent gfsh-started members from producing log files.	S, L	not set
lock-memory	If true, locks heap and off-heap memory into RAM to prevent OS paging to disk.	S, L	false
log-disk-space-limit	Max size (MB) of all inactive log files combined. If exceeded, deletes oldest inactive logs until within limit. 0 = unlimited.	S, L	0
log-file	Log output file. If null, uses defaults: application → stdout; locator → <locator_name>.log; server → <server_name>.log.	S, L	null
log-file-size-limit	Max size (MB) of a log file before rolling to a new child log. 0 disables rolling.	S, L	0
log-level	Log verbosity. Valid values (low→high): fine, config, info, warning, error, severe, none.	S, L	config
max-wait-time-reconnect	Max milliseconds to wait for cluster reconnect on each reconnect attempt.	S, L	60000
mcast-address	Multicast discovery address (used only if mcast-port ≠ 0, must match across cluster). Choose different address and port per cluster. Note: Peer-to-peer only.	S, L	239.192.81.1 (IPv4) / FF38::1234 (IPv6)
mcast-flow-control	Flow-control tuning for UDP (unicast+multicast) no-ack messaging: byteAllowance,rechargeThreshold,rechargeBlockMs. Min: 10000,0.1,500 ; Max: no_maximum,0.5,60000. Note: Peer-to-peer only.	S, L	1048576,0.25,5000
mcast-port	Multicast port (with mcast-address). 0 disables multicast. Valid range: 0..65535. Notes: Use different address+port per cluster; peer-to-peer only.	S, L	0
mcast-recv-buffer-size	Socket buffer size for incoming multicast. Valid range: 2048..OS_maximum. Notes: Default may exceed Unix OS max; raise OS max to ≥ 1MB for high-volume. Peer-to-peer only.	S, L	1048576
mcast-send-buffer-size	Socket buffer size for outgoing multicast. Valid range: 2048..OS_maximum. Note: Peer-to-peer only.	S, L	65535
mcast-ttl	Multicast reach. Lower may improve performance. 0 confines to local machine. Note: Peer-to-peer only.	S, L	32
member-timeout	Milliseconds used to detect unresponsive members. Heartbeats sent every half timeout; removal typically takes ~2–3× timeout if no responses. Valid range: 1000..600000.	S, L	5000
membership-port-range	Port range for UDP unicast and TCP failure detection, low-high. Member picks at least two unique ports (UDP + FD_SOCK); may also pick TCP DirectChannel if tcp-port=0. Range must have at least 3 available ports.	S, L	41000-61000
memcached-port	If non-zero, starts embedded Gemcached server on this port.	S	0
memcached-protocol	Protocol for embedded Gemcached server: BINARY or ASCII.	S	ASCII
name	Symbolic name for this system member.	S, L	not set
off-heap-memory-size	Off-heap size in m or g. Examples: text\noff-heap-memory-size=4096m\noff-heap-memory-size=120g\n	S	not set
redundancy-zone	Redundancy zone for partitioned-region redundancy (won’t place redundant copies in same zone).	S	not set
remote-locators	WAN: locators to connect to remote site(s). Formats mirror locators examples. Requires unique distributed-system-id.	L	not set
remove-unresponsive-client	If true, primary server drops unresponsive clients (queue full) from itself and all secondaries; puts may block while queue is full.	S	false
security-*	Security properties (security-...) can be moved from gemfire.properties to gfsecurity.properties to restrict access.	S, L	not set
security-client-accessor	Deprecated. Authorization callback (pre-operation), returns AccessControl.	S, L	not set
security-auth-token-enabled-components	Comma list used with security-manager to choose token auth components instead of basic auth. Valid: all, management, pulse.	L	""
security-client-accessor-pp	Deprecated. Authorization callback (post-operation / notifications).	S, L	not set
security-client-auth-init	Authentication. Fully-qualified static method that returns AuthInitialize for client auth credentials.	S, L	not set
security-client-authenticator	Deprecated. Authentication. Static creation method returning Authenticator for peer credential verification.	S, L	not set
security-client-dhalgo	Deprecated. Use ssl-enabled-components instead. Sets cipher for encrypting sensitive credentials via Diffie-Hellman on clients.	S, L	not set
security-log-file	Security log file; if unset uses regular log file.	S, L	not set
security-log-level	Security log level: fine, config, info, warning, error, severe, none.	S, L	config
security-manager	SecurityManager implementation for authentication/authorization callbacks.	S, L	not set
security-peer-auth-init	Authentication. Static method returning AuthInitialize for peer auth credentials.	S, L	not set
security-peer-authenticator	Deprecated. Authentication. Static method returning Authenticator for peer credential verification.	S, L	not set
security-peer-verifymember-timeout	Timeout (ms) used by peer to verify membership of an unknown authenticated peer requesting secure connection.	S, L	1000
security-post-processor	PostProcessor implementation that can alter returned results of region get operations.	S, L	not set
security-udp-dhalgo	Cipher used for server-to-server UDP communications when defined.	S	not set
serializable-object-filter	Semicolon-separated list expanded using patterns per ObjectInputFilter.Config#createFilter into allowed class names for serialization when validate-serializable-objects=true.	S, C	"!*"
server-bind-address	Multi-homed hosts: NIC/address servers bind to for client/server comms (separate from peer-to-peer). Use IP (not hostname). Empty = same card as peer-to-peer (bind-address or default NIC).	S	not set
socket-buffer-size	TCP receive buffer size (bytes) used for data transmission; also chunk size for large messages. Larger = faster for large messages but more memory.	S, L	32768
socket-lease-time	Milliseconds a thread can have exclusive access to an unused socket. 0 = never expires. Ignored if conserve-sockets=true. Valid range: 0..600000.	S, L	60000
ssl-enabled-components	Comma-separated list of components to enable SSL for (cluster,gateway,jmx,locator,server,web) or all. Also set security-udp-dhalgo to secure UDP cluster comms.	C, S, L	all
ssl-endpoint-identification-enabled	If true, clients validate the server hostname using the server certificate.	C, S, L	false
ssl-use-default-context	If true, allows use of default SSL context; also sets ssl-endpoint-identification-enabled=true.	C, S, L	false
ssl-require-authentication	If true, requires mutual (two-way) auth for SSL-enabled components (all except web).	S, L	true
ssl-http-require-authentication	If true, requires mutual auth for the web component.	S, L	false
ssl-default-alias	Default certificate alias; if empty uses first certificate in keystore.	S, L	""
ssl-<component>-alias	Certificate alias for one component (cluster,gateway,jmx,locator,server,web).	S, L	""
ssl-ciphers	Comma-separated list of SSL ciphers or any.	S, L	any
ssl-parameter-extension	SSLParameterExtension implementation for SSL parameter extensions.	S, L	not set
ssl-protocols	Comma-separated list of SSL protocols or any.	S, L	any
ssl-keystore, ssl-keystore-password	Keystore path and password.	S, L	""
ssl-truststore, ssl-truststore-password	Truststore path and password.	S, L	""
ssl-keystore-type, ssl-truststore-type	Keystore/truststore types. JKS is common for Java; pkcs12 is another common option.	S, L	JKS
standard-output-always-on	If true, always logs to stdout even if a log file exists.	S, L	false
start-dev-rest-api	If true, starts the developer REST API when cache is created (configured by http-service-port / http-service-bind-address).	S	false
start-locator	If set, auto-starts a locator in-process on connect and stops it on disconnect. Formats: text\nstart-locator=address[port]\nstart-locator=port\n If only port is specified, uses member’s address. Auto-adds to locators if needed.	S	not set
statistic-archive-file	File where statistic samples are written (e.g. StatisticsArchiveFile.gfs). Add .gz to compress. To disable: set to /dev/null.	S, L	not set
statistic-sample-rate	Stats sampling frequency (ms). Valid range: 100..60000.	S, L	1000
statistic-sampling-enabled	Enables statistics sampling/archiving. Recommended in production; default sample rate has minimal perf impact. Note: Does not apply to partitioned regions (stats always enabled there).	S, L	false
tcp-port	TCP port for cache communications. 0 = OS chooses. Must be unique per process on a machine. Valid range: 0..65535.	S, L	0
thread-monitor-enabled	If true, enables monitoring of created operational threads; informational messages are written to log.	S	true
thread-monitor-interval-ms	Interval (ms) at which thread monitoring runs.	S	60000
thread-monitor-time-limit-ms	Time (ms) after which a monitored thread is considered stuck.	S	30000
tombstone-gc-threshold	Number of tombstones that can accumulate before triggering tombstone garbage collection.	S	100000
udp-fragment-size	Max UDP fragment size (bytes) for unicast/multicast. Smaller messages may be combined up to this size. Valid range: 1000..60000.	S, L	60000
udp-recv-buffer-size	UDP receive buffer size. If disable-tcp=false, reduced default of 65535 is used. Default 1048576 may exceed Unix OS max; raise OS max to ≥ 1MB for high-volume. Valid range: 2048..OS_maximum.	S, L	1048576
udp-send-buffer-size	UDP send buffer size. Valid range: 2048..OS_maximum.	S, L	65535
use-cluster-configuration	Data members only. If true, requests and uses configuration from dedicated locator cluster-config services. If false, does not request it.	S	true
user-command-packages	Comma-separated Java packages containing classes implementing CommandMarker (loaded at startup and available in GFSH).	S	not set
validate-serializable-objects	If true, blocks deserialization of non-internal classes not allowed by serializable-object-filter (throws IncompatibleClassException). Requires JDK 8u121+; older servers/clients will fail on startup.	S, C	false

• Using Non-ASCII Strings in Property Files

  You can specify Unicode (non-ASCII) characters in Apache Geode property files by using a \uXXXX escape sequence.