JMX remote monitoring in AS7

[mackerman]

Hi, i'm trying to configure JMX remote monitoring in JBoss AS7.  I don't believe that the old way, setting the following properties is valid any more.  At least, when I try to do so I get port conflicts, and the server start throws exceptions.  What is the corresponding configuration for AS7 to 

-Dcom.sun.management.jmxremote.port=1090

-Dcom.sun.management.jmxremote.authenticate=false

I already have

<socket-binding name="jmx-connector-registry" port="1090"/>

in my domain.xml, but want to turn off authentication and secure monitoring only over SSL.  Currently with this configuration JConsole can't connect. 

thanks, Mitchell

[rkilcoyne]

Mitchell:

Did you ever find a solution to remote monitoring as7?

Rick

[mackerman]

Actually, just looked at this again last week, and what do you know, it worked.  I don't know what I have changed since then.  Here is the url i used to connect:

service:jmx:rmi:///jndi/rmi://10.81.0.227:1090/jmxrmi

If you are still having problems I can provide my config files.

Mitchell

[rkilcoyne]

Thanks for the response Mitchell. Which version of JBoss AS 7 are you running this against? I'm on 7.0.2.

[mackerman]

i'm on 7.0.2 also

[suku_1983]

Hi,

I have taken  the latest AS 7 v 7.1.0 Thunder release and am trying to hook into it using JConsole.

However there are a few places where i am stuck.

1. XML for jmx subsystem is changed. Cant find any documentation on it. !

        <subsystem xmlns="urn:jboss:domain:jmx:1.1">

            <show-model value="true"/>

            <remoting-connector/>

        </subsystem>

  - The remoting connector is new. Previosuly there was the <jmx-connector> tag that had to be configured (this was in Flux capacitor)

            <jmx-connector registry-binding="jmx-connector-registry" server-binding="jmx-connector-server"/>

2. When using JConsole as a Remote process, i tried hooking up with the following URLs - None worked

          - service:jmx:remoting-jmx://localhost:9999

          - service:jmx:rmi:///jndi/rmi://localhost:9990/jmxrmi

          - Also tried with loop back IP address and ports 4447 and 9999.

Has someone got it to work?

Hoping some documentation comes up on it. Expecially with the XML changed !

[mackerman]

rmi is typically over port 1090, not the management ports of 9990 or 9999.  try service:jmx:rmi:///jndi/rmi://localhost:1090/jmxrmi

[suku_1983]

Hi Mitchel,

Thanks for quick response. Port 1090 was my first attempt; since this was the port configuration in Flux Capacitor.

Config in flux capacitor below

========

        <subsystem xmlns="urn:jboss:domain:jmx:1.1">

            <jmx-connector registry-binding="jmx-connector-registry" server-binding="jmx-connector-server"/>

        </subsystem>

...

...

    <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">

        <socket-binding name="jmx-connector-registry" interface="management" port="1090"/>

           ...

    </socket-binding-group>

=======

However in Thunder the port is not configured for JMX. Instead as part of the JMX Subsystem, the XML indicates a <remoting-connector>

The config from standalone.xml of  AS7 Thunder below

=========

        <subsystem xmlns="urn:jboss:domain:jmx:1.1">

            <show-model value="true"/>

            <remoting-connector/>

        </subsystem>

          ....

        <subsystem xmlns="urn:jboss:domain:remoting:1.1">

            <connector name="remoting-connector" socket-binding="remoting" security-realm="ApplicationRealm"/>

        </subsystem>

          ....

          ....

    <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">

        <socket-binding name="remoting" port="4447"/>

    </socket-binding-group>

===========

Based on the above definition i kinda thought it is gona work with 4447.

Couldnt figure it our using the XSD as well. it doesnt have any reference to <remoting-connector>

Still no luck ! Let me know if you get it to work..

[suku_1983]

Got some details from the schema "https://source.jboss.org/browse/JBossAS/build/src/main/resources/docs/schema/jboss-as-jmx_1_1.xsd?"

=======Definition for remoting-connector========

   <xs:complexType name="remotingConnectorRefType">

       <xs:attribute name="use-management-endpoint" type="xs:boolean" default="true" use="optional" >

           <xs:annotation>

               <xs:documentation>

                   <!--If true then this connector will use the management endpoint, otherwise it will use the remoting subsystem endpoint. -->

               </xs:documentation>

           </xs:annotation>

       </xs:attribute>

   </xs:complexType>

==========================================

Based on that, the following should work

- > service:jmx:rmi:///jndi/rmi://localhost:9990/jmxrmi   [this if the one if you set "use-management-endpoint" as "true"; which is the default]

- > service:jmx:rmi:///jndi/rmi://localhost:4447/jmxrmi   [this if the one if you set "use-management-endpoint" as "false"]

Both of these dont work when i use JConsole...

Hope its not a JIRA and only a flaw in my configuration

Cheers,

Suku

[ejroberts]

I am also having a problem connecting from a remote machine to Thunder.

Take a look at this https://community.jboss.org/wiki/UsingJconsoleToConnectToJMXOnAS7

As far as I understand it you need to use a different url

service:jmx:remoting-jmx://<host>:<port>

If you want to use the management endpoint, the port is the native port, which is 9999

I can connect if the client is on the same machine. This uses a different local file system token authentication mechanism, so without

any other input, it worked.

If you want to use remote endpoint then it should be port 4447

When I try to connect to this from a remote machine it simply doesn't work. I'm sure all the authentication bits

are correct.

[suku_1983]

Hi Ed,

I had checked that article as well. (was the first relavent hit on google )

However that is based on flux capacitor / 7.0.1 Beta... That procedure doesnt work in flux capacitor.

I also had a look at the source code to check how its picked up.. it looks like the URL its looking for is in line with 

service:jmx:rmi:///jndi/rmi://localhost:4447/jmxrmi

Meanwhile, on the ports, have a look at the Schema for domain.xml..

It states the below on the attribute "use-management-endpoint"

=======Definition for remoting-connector========

   <xs:complexType name="remotingConnectorRefType">

       <xs:attribute name="use-management-endpoint" type="xs:boolean" default="true" use="optional" >

           <xs:annotation>

               <xs:documentation>

                   <!--If true then this connector will use the management endpoint, otherwise it will use the remoting subsystem endpoint. -->

               </xs:documentation>

           </xs:annotation>

       </xs:attribute>

   </xs:complexType>

==========================================

Based on that schema definition, i guess the port can either be the remoting port (4447) or the management end point (9990).

Anyway hope we get an answer for this from someone soon. Think the JBoss Dev team can help us

[dlofthouse]

Just catching up on this thread - at this point I would suggest not trying to switch the native interface to the different connection - from the messages described here it sounds more like a user has not been added and then specified when connecting from jconsole - when you are truely remote you need to use username / password based authentication to connect to that port - if no username is specified you will not be able to connect to the server.

[ctomc]

Hi,

guys the procedure how to run jconsole in AS7.1 is described here https://community.jboss.org/wiki/UsingJconsoleToConnectToJMXOnAS7

please note that you need to run console via script that is provided in JBOSS_HOME/bin/jsonsole.bat/.sh

for AS7.1 you don't to add any additional configuration, just connect to port 9999 and that is it.

url for connecting to localhost is "service:jmx:remoting-jmx://localhost:9999" and user & password that you use to login into web console or other management interfaces.

--

tomaz

[ejroberts]

Hi Darran,

If I am able to log onto the web management interface on http://myhost:999http://myhost:9990/console/App.html0/console/App.htmlhttp://myhost:9990/console/App.html with a specific user name and password (created and stored inside mgmt-users.properties)

then should I also be able to do the same in a jconsole on a remote machine using the followng connection string and the same user name and password ?

service:jmx:remoting-jmx://myhost:9999

the configuration I am using has the following relevant entries

        <management-interfaces>
            <native-interface security-realm="ManagementRealm">
                <socket-binding native="management-native"/>
            </native-interface>

        </management-interfaces>

        <subsystem xmlns="urn:jboss:domain:jmx:1.1">
            <show-model value="true"/>
            <remoting-connector use-management-endpoint="true"/>
        </subsystem>

    <interfaces>
        <interface name="management">
            <inet-address value="${jboss.bind.address.management:127.0.0.1}"/>
        </interface>
    </interfaces>

    <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
        <socket-binding name="management-native" interface="management" port="${jboss.management.native.port:9999}"/>
    </socket-binding-group>

I am passing overrides in on the command line for the bind address, and can happily telnet to myhost 9999

Have I got something configured incorrectly ?

Thanks

[ejroberts]

apologies for the corrupted http url, not sure how that happened, but basically I can log onto the mnagement web app.