You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 237 Next »



Many clients wish to know what the hardware and operating system requirements are for a Delft-FEWS live system. On this page you can find a list of specifications. If you have any question about the list, or you do not see the operating system of your choice: please contact us. This list is not exhaustive.

Components

Operator client

The Operator Client (Gui) is the thick client for end users.

  • normal pc
  • minimum 512 MB RAM, 1GB recommended
  • operating system: Windows 7 / 8 / 10, Server 2012(R2) / 2016, Linux RedHat / CentOS
  • amount needed: as many as there are clients
  • usable in Citrix
  • users run with their own log on credential, no admin privileges required

Forecasting Shell Server

The Forecasting Shell Server (FSS) is the server for execution of forecast runs and import tasks. It contains the modelling software and it's operation is controlled by the Master Controller

  • minimum 2 GB RAM
  • one CPU core per FSS instance
    • When available, a FSS will use more than one CPU. This might be an issue when you have multiple FSS on a single machine. You can use a VM or container that limits the CPU usage of a FSS to a single core.
  • CPU typically Intel Xeon 2.33 GHz or equivalent
  • operating system: Windows 7 / 8 / 10, Server 2012(R2) / 2016, Linux RedHat / CentOS contains modelling software (incl. licenses), OS usually dependent on 3rd party modules and modelling software
  • recommended minimum 2 of Forecasting Shell Servers, add more depending on computational load
  • Windows and linux forecasting shells can be used simultaneously

Master Controller Server

The master controller organises task traffic and scheduling

  • minimum 1 GB RAM per Master Controller instance
  • CPU typically Intel Xeon 2.33 GHz or equivalent.
  • operating system: Windows 7 / 8 / 10, Server 2012(R2) / 2016, Linux RedHat / CentOS. Other Unix-like operating systems are possible (e.g. HP-UX, Solaris), as long as the procfs system is supported and there is a Java JRE and  with the correct version available for the OS.

JMS Server (no longer required in 2017.02 and beyond)

Java Messaging Service (JMS) controls a large part of the communication between the components.

  • minimum 1GB RAM per JMS instance
  • minimum 1GB disk space for caching purposes:
  • CPU typically Intel Xeon 2.33 GHz or equivalent
  • operating system: Windows 7 / 8 /10, Server 2012(R2) / 2016, Linux RedHat / CentOS
  • Supported JMS Servers: JBoss 4, JBoss 5, ActiveMQ 5.11 (as of release 2015.02 default JMS)

This component can often be installed on the same server as the Master Controller.

For the JMS to function properly, it is strongly recommended that clients and master-controller components synchronise with the same NTP server so that they run with the same clock time.

Central Database

This is the central data repository, linked to the master controller. The live system is known to run with the following database versions:

  • Oracle 10 / 11 / 12 for versions up to Delft-FEWS 2017.01, Oracle 12c, 18c or 19c for Delft-FEWS 2017.02 and later

Delft-FEWS 2017.02 and later require Oracle 12c or newer

  • MS SQL Server 2012 / 2014 / 2016

Delft-FEWS 2017.02 requires MS SQL Server 2012 or later

  • PostgreSQL 9.6 or later (9.6 is supported from 2016.01 onwards). In principle higher versions are also known to work. No testing has been done on 10.x versions. Postgres 11.8 is used successfully.

    Normally we start supporting the higher Postgres versions e.g. 9.6, 11.8., since these are a more mature than the initial releases e.g. 13.1, 13.2.


Stop using Postgres 9.2 or earlier, please migrate to a newer Postgres version. Binary transfer is more efficient in newer PostgreSQL versions.

This list is not exhaustive, so contact us if you are thinking of using a different database or a different type.

  • advised internal memory and CPU: See Database vendor requirements. Typically 1 GB RAM per DB instance and CPU Intel Xeon 2.33 GHz or equivalent.
  • The database instance(s) can be a hosted on an existing database server or cluster.
  • uses 1 instance for each Master controller

Open Archive

The Open Archive is an optional component for Delft-FEWS that stores forecast data, performance indicator data and configurations on a longer time scale than in the central database of the Delft-FEWS system.

Hardware requirements

OpenArchive poses modest requirements to host hardware:

  • Storage. The most important requirement for the file system is that it keeps on functioning after the failure of a single disk. Any RAID (https://nl.wikipedia.org/wiki/Redundant_array_of_independent_disks) will be sufficient.
  • Memory. The server should have at least 4 GB memory available for the elasticsearch catalogue and the tomcat instance which hosts the archive server.
  • CPU. The speed of the catalogue (searching in the archive) depends heavily on the CPUs of the server. It is recommended to have at least 4 CPUs available.
Software requirements
  • The archive is a web application running inside a tomcat web server. Both Linux and Windows are supported.
Required permissions

The file system containing archive data:

  • Must be accessible by the THREDDS server with read permissions.
  • Must be accessible by the Deltares Archive Server with full permissions.
  • Must be accessible by the Forecasting Shell Servers with write permission

Webserver

The webserver is an optional server that hosts and distributes the webpages generated by Delft-FEWS. Hardware requirements depend on the intended use.

PiService

This is an optional service which allows SOAP clients to interact with and retrieve data from the Delft-FEWS system. Hardware requirements depend on the intended use. In general it is not recommended to have the PiService on the same machine as the master-controller.

Requirements overview

 

ComponentDescriptionHardware requirementsOperating system / Software requirementsInstances
Operator Client (Gui)

The Delft-FEWS client used by end-users.

client side, normal pc

Screen resolution depends upon the hardware supplied not on the Delft-FEWS software

Windows 7 / 8 / 10, Server 2012(R2), 2016

Linux RedHat Enterprise, CentOS (6.x 64 bit, 7.x 64 bit)

As many as there are clients

ConfigManager

 

Control and distribute configuration via the Master Controller database.

client side, normal pc

Windows 7 / 8, Server 2012(R2), 2016

Linux RedHat Enterprise, CentOS (6.x 64 bit, 7.x 64 bit)

As many as there are application managers
Forecasting Shell Server

Executes forecast models and stores the results in the central database.

Minimum 2 GB RAM and 1 one CPU core per Forecasting Shell Server instance. CPU typically Intel Xeon E5606 2.33 GHz or equivalent. Always reserve 1 CPU core for the OS.

Windows 7 / 8 / 10, Server 2012(R2), 2016

Linux RedHat Enterprise, CentOS (6.x 64 bit, 7.x 64 bit)


Contains modelling software (incl. licenses), OS usually dependent on 3rd party modules and modelling software

recommended minimum 2, add more depending on computational load
Master Controller Server

Dispatches tasks to the Forecasting Shell Servers.

Maintenance of central database.

Synchronisation between master-controllers.

Sends system alerts.

 

Minimum 1 GB RAM per MC instance. CPU typically Intel Xeon 2.33 GHz or equivalent.

Windows 7 / 8 / 10, Server 2012(R2), 2016

Linux RedHat Enterprise, CentOS (6.x 64 bit, 7.x 64 bit)


Other Unix-like operating systems possible (e.g. HP-UX, Solaris), as long as there is a JDK of the correct version available for the OS. For 2017.01 and before, JBoss 4 / 5 or ActiveMQ are required for the JMS layer.

1 or 2
Central DatabaseCentral data repository

See Database vendor requirements + 8 GB RAM per DB server including 1 MC DB instance and. CPU typically Intel Xeon E5606 2.33 GHz or equivalent. Add 1 GB RAM per extra MC DB instance.

Oracle 12c, 18c, 19c for Delft-FEWS 2017.02 and later

Oracle 10 / 11 / 12 for versions up to Delft-FEWS 2017.01,

PostgreSQL 9.6, PostgreSQL 11.

MS SQL Server 2012 / 2014 / 2016

MS SQL Server 2012 or later for Delft-FEWS 2017.02 and later.

The database instance(s) can be a hosted on an existing database server or cluster.

One instance per Master controller
Admin Interface

Super-user monitoring, system control and task scheduling

Minimum 1 GB RAM

Requires internet browser with javascript and session cookies enabled.

2018.02 requires Tomcat 9, Internet Explorer 10 or older is not supported. Supported browsers in preferred order :

  • Chrome: 76.0.3809.132 or higher
  • Firefox: 68.0.2 or higher
  • Edge: 42.17134.1.0 or higher
  • Internet Explorer 11: 11.950.1713.0 or higher.

2017.02 and before: Apache Tomcat 6 or higher

The web application runs over the Internet, E.g. Internet Explorer, Edge, Firefox, Chrome.

One instance per Master-Controller machine
"NFFS/FEWS" Web Server (optional)For disseminating forecast data and data from other sourcesTypically 1 GB RAM per server instance and CPU Intel Xeon 2.33 GHz or equivalent.Weblogic 11g with an Oracle Database. Weblogic as Application Server .One instance per Master-Controller machine (optional)
PiService (optional)Data access component.Typically 1 GB RAM per server instance and CPU Intel Xeon 2.33 GHz or equivalent.

Apache Tomcat 6 / 7 or later

Preferrably not on the same machine as the master-controller / MQ server.

1 (optional)
JMS ServerMessaging communication between FEWS components

No longer present in 2017.02. Minimum 1 GB RAM per JMS instance. CPU typically Intel Xeon 2.33 GHz or equivalent. Minimum 1GB disk space for cache.

Windows 7 / 8, Server 2012(R2) (32bit, 64bit)

Linux RedHat Enterprise, CentOS (6.x 64 bit, 7.x 64 bit)

One instance per Master controller
Archive Server (optional)

Stores forecast data, performance indicator data and configurations on a longer time scale than in the central FEWS system. For new projects consider using the Deltares Open Archive instead.

No longer supported in 2017.02, please migrate to the open archive. Ample storage space for Archive files

Apache Tomcat 6 / 7 or later

Separate database instance with same requirements as Central Database for Master Controller.

1 (optional)
Open Archive

New version of the Archive Server replacing the old one.

Stores forecast data, performance indicator data and configurations on a longer time scale than in the central FEWS system.

Ample storage space for Archive files

for 2017.02 or earlier:

Apache Tomcat 7 (or later)  with JRE version 8


for 2018.02 or later:

Apache Tomcat 9 with Amazon Coretto 11.0.3

1 (optional)

All activities contribute to resource consumption on a computing box, whether that box is hardware or virtual and Delft-FEWS will consume resources when running.

Scalability, number of servers

The components mentioned above can all be located on one (powerful) server or each on an individual machine, with all possible configurations in between. It is however common practice to separate the Forecasting Shell server from the Master-controller server. When using multiple machines it is essential that all machines have matching clocks. This can be achieved by making use of one and the same ntp server.

A typical configuration is:

  • Master Controller server running Master Controller(s),  Apache Tomcat for Admin Interface
  • Open Archive Server
  • Database Server
  • Forecasting Shell Server(s)

Typically in a dual master-controller setup every master-controller has its own machine so that maintenance can take place without offline time.

Virtualization

It is very well possible to deploy the master-controller components / forecasting shells in virtualized environments. The Deltares ICT team has most experience with Delft-FEWS on VMWare VSphere with in-depth knowledge but Delft-FEWS is also known to run on Microsoft Hyper-V. Virtualization of the Delft-FEWS back-end services can generally be done without problems.  Take into account that  (not Delft-FEWS related)  modelling software may have other requirements or limitations with respect to virtualization of the Forecasting Shells. 

Grid computing

FEWS can work with grid computing. Especially when working with heavy computations, e.g. ensemble forecasting or 3d hydraulic computing, this can be an interesting option to explore. It is recommended to contact the Delft-FEWS product management beforehand.

Embedded Java JRE software versions and other dependencies

Before starting to use Oracle JRE packages released after April 2019, please be aware of changes in the Oracle Java License model, see https://java.com/en/download/release_notice.jsp.

Our software is known to work with the following OpenJDK alternatives (recommended):

  1. The Amazon OpenJDK distribution https://aws.amazon.com/corretto/.
  2. The OpenJDK reference implementation found at https://jdk.java.net/. NB. The 11.0.2 distribution contains bugs in the OpenJDK 11.0.2 SSL, which are known to occur specifically when setting up SSL encryption in Tomcat for the https database proxy. When SSL is not used, 11.0.2 is functionally usable.

Java JRE versions (from 2018.02)

++++++ provisional text ++++++++
The new client-package of Delft-FEWS 2018.02 (OC/CM/SA/FSS) will contain a 'embedded' stripped-down jre (java runtime environment) based on OpenJDK 11. Together with the Delft-FEWS binaries, it forms the Delft-FEWS base-build. The java runtime libraries are placed in an operating system specific sub-folder in the well-known Delft-FEWS bin folder. The jre sub-folders are clearly recognizable under /bin/windows/jre or /bin/linux/jre. This jre can be easily replaced by any other open source or commercially supported version of java 11. Since an Operator Client/Stand Alone and in most cases also Forecasting Shell Server run in a controlled (and secured) environment, it is not necessary to have this jre sub-folder replaced, although it is technically feasible.

In two other locations java is required to run a Delft-FEWS client-server system: in Tomcat (for deploying the Admin Interface or Open Archive) and for the Master Controller. These are part of the server-package we distribute to you. Although these jre's are not embedded, they can be treated similarly with respect to replacing them (or not) by another open source version or commercially supported version of java 11. The decision to arrange additional 'support for Java' is up to the end user of Delft-FEWS.

If - at some point in time - crucial (security) fixes are required to the embedded jre in the client-package of Delft-FEWS,  Deltares will distribute a new 'base-build' for 2018.02 (or higher). Since the distribution of this (new) base-build will take place via the database (and is uploaded via the Admin Interface), updating of all FSS and OC machines will be rather simple. The update of the base-build (including updated embedded jre) will then take place automatically and will neither be a large maintenance burden nor very time-consuming.

Important note for Application managers and Configurators

The openJDK supplied in 2018.02 and later is not the full JDK but bundled by the jlink executable to a stripped-down JRE with only those modules that the OC / FSS / CM client needs.

This is the consequence of java 11 having become a modular system and this saves the number of bytes that needs to be copied to every FSS host. This is different from 2017.02 and earlier where the full JRE was normally installed.

If a model adapter or external model to be run by the Forecasting Shell or Operator Client is also using this stripped down version of the JRE for its operation, it is possible that some of the java modules required are missing from the shipped jre and the adapter or model won't be able to run properly.

It is the responsibility of the application managers / model configurators to ensure that their adapter and models requiring Java are already supplied with the correct java runtime modules. The Forecasting Shell Launcher startup script should not be contaminated by additional path variables, instead the models should contain their own embedded jre. See the General Adapter Module for more details .


VersionOperator Client
Forecasting Shell

Tomcat
MC / AI

2020.01embedded (version see next column)Amazon Coretto 11.0.7
2019.02embedded (version see next column)Amazon Coretto 11.0.6
2018.02embedded (version see next column)Amazon Coretto 11.0.3

NB. only the jvm.dll and not the java executable is shipped with the base build. The jre release version is listed in windows\jre\release and linux/jre/release.

NB2. The Master Controller and Apache Tomcat 9 (Admin Interface, Open Archive, Fews Web Services and Database HTTPS Proxy) are known to work with the OpenJDK 11 as distributed by RedHat, our test suite).

Java JRE versions (2017.02 and earlier)

Note that for security reasons, java should never be installed inside a browser. Delft-FEWS should only be using the java JRE in embedded form.

Since 2014.01 Delft-FEWS requires a base-build. This base-build requires a (minimal) jre-version. See the table below. For 2015.01, 2015.02 and 2016.01 with Java JRE 8 upgrades above _100, a new base-build is required.

VersionBase-build

JRE version

Operator Client /

Forecasting Shell Server /

ConfigManager

Master-controller /

Tomcat

   WindowsLinux 
Delft-FEWS 2017.02#76073Java JRE 8 update 17232 / 64 bit 64 bit 
  
64 bit 
 
Delft-FEWS 2017.01

#67816

Java JRE 8 update 131

 

32 / 64 bit

 

 

 

 
Delft-FEWS 2016.02#68073Java JRE 8 update 102
Delft-FEWS 2016.01#62571Java JRE 8 update 100+

32 / 64 bit (beta)

#62088Java JRE 8 update 77
Delft-FEWS 2015.02#62545Java JRE 8 update 100+

 

32 bit  

#57990Java JRE 8 update 45
Delft-FEWS 2015.01#62465Java JRE 8 update 100+
#54888Java JRE 8 update 45
Delft-FEWS 2014.02#50595Java JRE 7 update 71
Delft-FEWS 2013.01 - 2014.01n/aJava JRE 7 update 71
Delft-FEWS before 2013.01n/aJava JRE 6 update 45

Tomcat webcontainer for Admin Interface / PiService / Proxy

When multiple components require one and the same dll (e.g. for Active Directory / kerberos integration), it is required to run those components in a separate tomcat instance to avoid problems.

VersionProduct
Delft-FEWS 2018.02Tomcat 9
Delft-FEWS 2017.02 and beforeTomcat 5, 6, 7, 8, 9

JMS providers and their Java JRE versions (no longer present in 2017.02 onwards)

VersionProduct

JRE version

Windows / LinuxRemarks
Delft-FEWS 2017.02 or laterNo JMS provider required anymore. Direct database access (DDA) is replacing synchronisation via JMS. Https (as supported by JMS) is not supported in 2017.02, but is available in 2018.02.
Delft-FEWS 2017.01ActiveMQ 5.14.5Java JRE 8

 

64 bit

(installation of 32 bit is not recommended)

ActiveMQ 5.14.5 requires JRE 8 (best 64 bit), but may also be used with JRE 7.
Delft-FEWS 2016.02 and olderActiveMQ 5.11.1ActiveMQ 5.11 requires JRE 8 (best 64 bit), but may also be used with JRE 7.
Delft-FEWS 2017.01 and olderJBoss 4 / 5 / 7Java JRE 6 / 7

Does not function with JRE 8. Note that JBoss4 requires a jdbc driver for storing temporary messages.

The JRE version with which this driver is compiled should be compatible with the JRE used for Jboss4.

Windows VC-Redistributables (no longer required since 2020.02)

The Delft-FEWS software contains Windows executables requiring a VC++ Redistributable Package being installed.

ExecutableInstallerDownload locationdescription
JavaService.exeMicrosoft Visual C++ 2008 Redistributable Package (x86)https://www.microsoft.com/en-us/download/details.aspx?id=29
JavaService_x64.exeMicrosoft Visual C++ 2010 Redistributable Package (x64)

https://www.microsoft.com/en-us/download/details.aspx?id=14632


JavaService_x64.exeMicrosoft Visual C++ 2019 Redistributable Package (x64)https://aka.ms/vs/16/release/vc_redist.x64.exeServer 2019 and later, see also the-latest-supported-visual-c-downloads

Security

Read more about the shared responsibility model. >>

Security - Shared responsibility model for Delft-FEWS system installations
The Delft-FEWS server software historically was most commonly installed on-premise at the customer site on servers that were not directly connected to the internet. Nowadays, there are also more and more Delft-FEWS applications that are being deployed in the cloud. This means security standards and guidelines for the installation of live systems have become more critical than ever before. Delft-FEWS runs on top of a stack of components like 3rd party components: databases, Tomcat and an embedded JRE.

It is the primary responsibility of the customer to apply the latest security fixes to the OS, database, Tomcat and all other components.

 For updates for the embedded JRE it is recommended to contact Deltares. The role of Deltares is to supply guidelines and facilitate security best practices where possible. Deltares maintains a separate section on the WIKI especially for system and database administrators. To view these pages, personal credentials can be supplied. These pages contain highly detailed information for installing and upgrading Delft-FEWS, amongst others about security aspects. For the near future it is foreseen that more and more managed services from cloud providers (e.g. Tomcat, database) can be applied.  All Delft-FEWS developers are security aware and evaluate the existing and potential vulnerabilities on a regular basis. Together with our colleagues from our ICT department they meet regularly to discuss (potential) improvements for each Delft-FEWS release.

Tomcat

Tomcat is required for the deployment of the Admin Interface, Database HTTPS Proxy, Fews Webservices and the Deltares Open Archive. Tomcat is installed and maintained by the customer organization. Deltares indicates which version of tomcat is compatible with / required for which version of Delft-FEWS. All security related aspects available in Tomcat can be applied and are under the responsibility of the customer organization. 

For Admin Interface clients / proxies that are exposed to the internet it is crucial that the highest stable release version of Tomcat with security fixes is used. This prevents exposure from common vulnerabilities and exposures (CVEs). 

For releases up to 2022.02, any tomcat9 version should be able to work for our Admin Interface / HttpProxy / PI Service / ArchiveServer web containers. This requires that the correct Java version matching the indicated JRE version for the Delft-FEWS release version is used and this Java version must be compatible with the Tomcat distribution.

See http://tomcat.apache.org/security-9.html

  • Run Tomcat server as an unprivileged user and NOT root / Administrator.
  • Tomcat user has read-only permission to the contents of the conf/, bin/, and lib/ directories in ${CATALINA_HOME.}.
  • Limit the Tomcat user’s access and permissions to only the needed directories and files work / temp / webapps / logs.
  • Uninstall all non-essential web applications in the webapps/ directory, including the applications that come with Tomcat.

JRE/Java

In several components of Delft-FEWS a (stripped down) version of Java/JRE (Java Runtime Environment) is embedded. This JRE folder is a recognizable and standard part of the Delft-FEWS binary package for Operator Clients and Forecasting Shell Servers. This means that Deltares delivers an optimized (and minimal) Java Runtime Environment based on Amazon Corretto's series. This so-called base-build can be updated and Deltares will release new base-builds if required. Since the JRE folder is recognizable within the Delft-FEWS binaries, organizations may decide to replace this JRE folder in favour of another (compatible) version of the JRE. It is certainly possible to use a different provider (e.g. Oracle Sun or the openJDK). Replacing the JRE can be done by creating a soft link to the JRE directory or by replacing the JRE folder.

Local databases (Operator Client, Stand Alone)

In recent versions of Delft-FEWS there is no need for a local database (datastore) for an Operator Client (OC) in a client-server environment. Although it is still possible to have a 'fully synchronized' (local) database in an OC or to create a 'replicate' of the central database to continue working as a standalone (SA). There are two data formats available: Derby or Firebird. These are just local files (just like any other file on the file system) and they do not require any software installed for managing it. The Delft-FEWS Operator Client or Stand Alone application just reads from and writes to this database format. This mechanism cannot be used as a ‘hub’ to enter other server side components.

Central Database access

Delft-FEWS can be equipped with one of three common brands of central databases: Oracle, PostgreSQL or MS SQLServer. Access to the central database is required for several Delft-FEWS servers side components. These components are normally located behind the organization's firewall (same network) or in the secure domain of a data centre or cloud provider. Operator client access to this database is also required, but when set up from 'outside' the organization's network, a https (proxy) server (including IP whitelisting) should be in between. Deltares can provide this.

Forecasting Shells

  1. The Delft-FEWS binaries folder should be made read-only.

  2. Forecasting Shell Servers (FSS) should have limited permissions (rights). Only write access within their own directory.

  3. Only provide access to the data feed shared folders for FSSs.

  4. The account for installing should be different than the account running processes

  5. When applying external simulation software, ensure the executables and other libraries have only permission to be run locally.

Operator clients

  1. The Delft-FEWS binaries folder should be made read-only.

  2. When using the optional JCEF browser, white-listing is used to grant access to webpages.

Multi-layered security approach

  • The inner layer is the central database (and optionally Deltares Open Archive).
  • The middle layer are Delft-FEWS components that communicate directly with the database using encryption.
  • The third layer (optional) is a reverse proxy to the database that can be accessed externally.
  • The outer layer is the bastion host (optional).



  • No labels