Monitoring your Java application with JMX - Part 2

In the Part-1 of this article I explained the fundamentals of JMX monitoring, local and remote monitoring and provided an example on monitoring a java application locally. In Part-2 I'll explain how to monitor it remotely and how to authenticate the monitoring process.

Following system properties need to be present for remote monitoring.
-Dcom.sun.management.jmxremote
-Dcom.sun.management.jmxremote.port=portNum where portNum is the port which you want to enable the JMX connection.

You also need to add the follwing two properties.
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false

By default, ssl and authentication is enabled. Therefore if you do not set authenticate=false, application will look for a password file and hence fail to start. If ssl is not set to false, you wont be able to connect without configuring ssl properly.

There is a special scenario where your network interface might be only listening to IPv6 addresses and hence a request from an IPv4 address failing to connect. To get rid of this, you have to add the following property too.
-Djava.rmi.server.hostname=yourIP

Lets try to monitor Tcpmon remotely. When we were monitoring Tcpmon locally we just had to start it and monitor. But in remote scenario, we have to provide the parameters mentioned above. To do this, open TCPMON_HOME/build/tcpmon.sh. It will contain,

java -cp ./tcpmon-1.0.jar org.apache.ws.commons.tcpmon.TCPMon $*

Now, edit it by adding the above parameters. Then it will look like,

java -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=port
-Djava.rmi.server.hostname=yourIP -Dcom.sun.management.jmxremote.authenticate=false
-Dcom.sun.management.jmxremote.ssl=false -cp ./tcpmon-1.0.jar org.apache.ws.commons.tcpmon.TCPMon $*

Save tcpmon.sh and run it. You will be successfully able to start Tcpmon. Then start a JConsole from a remote machine. Provide host:port for the remote process and click connect. You will be able to connect to JMX service successfully.


Lets turn to authenticating the monitoring. First, you have to set -Dcom.sun.management.jmxremote.authenticate=true. When this is set, system will be looking for a password file and an access file. You can find these two files (jmxremote.access and jmxremote.password.template) in JDK_HOME/jre/lib/management folder. Copy these two files to a place you refer. Rename jmxremote.password.template to jmxremote.password.

Following is a section extracted from the password file.

# Following are two commented-out entries.  The "monitorRole" role has
# password "QED".  The "controlRole" role has password "R&D".
#
monitorRole  QED
controlRole   R&D 

You can define role names (usernames) and passwords as shown above. Actions which are allowed to these roles are defined in the jmxremote.access file. Shown below is a section extracted from it.# Default access control entries:

# o The "monitorRole" role has readonly access.
# o The "controlRole" role has readwrite access and can create the standard
#   Timer and Monitor MBeans defined by the JMX API.

monitorRole   readonly
controlRole   readwrite 

You have to restrict access (make read-write-only by the owner) to the jmxremote.password file by,

chmod 0600 jmxremote.password

Then if you ls -l the files, you should see,

-rw-r--r-- 1 amila amila 3896 2011-01-17 17:45 jmxremote.access
-rw------- 1 amila amila 2854 2011-01-17 17:47 jmxremote.password

After that you have to set the system properties to point to the password and access files. Following are the properties.
-Dcom.sun.management.jmxremote.password.file=/path/to/jmxremote.password/file
-Dcom.sun.management.jmxremote.access.file=/path/to/jmxremote.access/file

Lets turn back to our Tcpmon monitoring again. Add the above two properties to tcpmon.sh and make authenticate=true. Then. tcpmon.sh should look like,

java -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=port
-Djava.rmi.server.hostname=yourIP -Dcom.sun.management.jmxremote.authenticate=true
-Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.password.file=/path/to/jmxremote.password/file
-Dcom.sun.management.jmxremote.access.file=/path/to/jmxremote.access/file -cp ./tcpmon-1.0.jar org.apache.ws.commons.tcpmon.TCPMon $*

Now, save tcpmon.sh and run it. Start a JConsole from a remote machine. Provide the host:port parameters, username and password and click connect. You will be able to successfully monitor Tcpmon remotely. You can try out the difference between the two access roles defined in the jmxremote.access file.

monitorRole readonly
controlRole readwrite

If you log in as the monitorRole, you will be only allowed to monitor. If you try to carry out controlRole tasks, you will be provided with a warning message as shown below.

So, now you are able to monitor your Java application using JMX successfully. For a quick recap, following are the necessary system properties to monitor it remotely.

-Dcom.sun.management.jmxremote
-Dcom.sun.management.jmxremote.port=portNum
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=true
-Djava.rmi.server.hostname=yourIP
-Dcom.sun.management.jmxremote.password.file=/path/to/jmxremote.password/file
-Dcom.sun.management.jmxremote.access.file=/path/to/jmxremote.access/file

Find more details on JMX from here.

Monitoring your Java application with JMX - Part 1

What is JMX?
Java Management Extension technology which comes with the Java platform provides a simple and standard way of managing applications and services.You can use JMX technology to monitor the JVM also. It (JVM) has built-in instrumentation which enables you to monitor and manage it.

What we have to do?
To be able to monitor via JMX, you have to set certain system properties when you start the JVM (i.e. When you start your Java application). Following is the syntax of setting a system property.
java -Dpropertyname=value
You can provide these system properties at the commandline or in a configuration file also. Based on your requirement on monitoring, these system properties change. I will explain the necessary properties when the article progresses.

Local and remote monitoring
You can monitor your application/jvm locally or remotely. For remote monitoring to be possible you have to set the follwing properties.
-Dcom.sun.management.jmxremote (if we do not provide a value, default value will be taken. i.e 'true' for htis property).
-Dcom.sun.management.jmxremote.port=portNum where portNum is the port which you want to enable the JMX connection.


Monitoring your java application using JConsole
JConsole is a graphical monitoring tool to monitor jvm/java applications. Executable file for JConsole is located in the JDK_HOME/bin folder. If you have this folder in your system path, you can simply start it by typing jconsole. Else, you will have to provide the absolute path for it. There are two ways to monitor a local application.

1.You can provide the process id of the application when you start JConsole
jconsole processID

2.If you dont provide a process ID, JConsole will list the available local applications for monitoring and you can select from the list.

It is necessary that both JConsole and the Java application started by the same user because JMX uses operating system's file permissions. Local monitoring is not recommended for production environments. The reason for this is, JConsole consumes a considerable amount of resources when running.

For remote monitoring, you either need the jmx service url or the host:port combination. You can provide the host:port combination at JConsole start time or later.
jconsole host:port

Example
Lets monitor tcpmon, which is a java application using JConsole locally. First, start tcpmon by running tcpmon.sh in TCPMON_HOME/build folder. Then start a JConsole. You will see the available applications to be monitored as shown in the image below.


Select tcpmon from the list and click connect. Then you will be connected monitor tcpmon as shown below.


In my next article (i.e. Part 2), I will explain remote monitoring related requirements such as authentication, ssl. There will be an example explaining how to monitor your application remotely.