Configuring JMX Monitoring

Java Management Extensions (JMX) is a Java technology that allows for managing and/or monitoring applications, system objects, devices, and service oriented networks. The managed/monitored entity is represented by objects called MBeans (for Managed Bean).

This section describes how to configure JMX on an Waveset server so that a JMX client can monitor the system for changes.

You can also configure Waveset to make audit events available using JMX. For information, see The JMX Publisher Type in Oracle Waveset 8.1.1 Business Administrator’s Guide.

Enabling JMX

The JRE did not provide a JMX MBean server prior to Java 1.5, so using JMX required support from the application server. Starting with the Java 1.5 specification, the JRE must provide a built-in MBean server. Consequently, JMX is available from any application server running JRE version 1.5 or later.

Each application server that provides direct JMX support has a different technique for enabling JMX and providing access to the MBeans. You must consult the application server documentation for those instructions.

The MBean server in the JVM is enabled by default, but requires some additional options to be accessed by JConsole or other MBean viewing tools. In most cases, enabling JMX means the application server allows communication on a separate channel with a security profile that is different from that of the HTTP channel. When deciding to enable this channel, you must consider the need to access the MBean data (without restarting the server) against the additional security exposure. Oracle strongly recommends enabling remote JMX access on development and test servers.

For Local Access to MBeans

To enable local access to JMX, where JConsole running on the same host can access MBeans but JConsole running on other hosts cannot, add the following option to the JVM startup:

-Dcom.sun.management.jmxremote

You must decide whether to use this option on production servers based on your security requirements and the need to access the MBean data without restarting the server.

For Remote Access to MBeans

To enable remote access to JMX, where JConsole running on a remote host can access the MBeans but JConsole running on other hosts cannot, add the following options to the JVM startup:

-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=<port num>

When you enable remote JMX access, you must carefully consider the security ramifications. For a test server, you can add the following option, which allows non-SSL access to the JMX server without providing any authentication data:

-Dcom.sun.management.jmxremote.authenticate=false

Using this option is very insecure. You should never use this option on a production server, but it might be appropriate for a test server. For more information, consult the following web site: http://download.oracle.com/docs/cd/E17476_01/javase/1.5.0/docs/guide/management/agent.html#jmxagent.

To Configure JMX Polling Settings

The Cluster MBean provided by Waveset has both passive and active operational modes. In active mode, the MBean polls the Waveset repository for additional data and exposes that data through JMX.

Currently, enabling Cluster polling is not recommended because the operational cost of polling is greater than the information provided by the polling. However, if you choose to enable Cluster polling, you can use the following process:

1. Follow the steps described in Using the Administrator Interface to Configure Waveset. Select the JMX tab.

2. Enable JMX cluster polling and configure the interval for the polling threads.

   Use the following options:

   • Enable JMX Cluster Polling. Enables or disables the polling thread for the JMX Cluster MBean. Because system resources are used for polling cycles, enable this option only if you plan to use JMX.

   • Polling Interval (ms). Changes the default interval at which the server polls the repository for changes, when JMX is enabled. Specify the interval in milliseconds.

     The default polling interval is set to 60000 milliseconds. To change it, enter the new value in the entry field provided.

3. Click Save to save changes to the server settings.

With the exception of the Cluster MBean, all other Waveset MBeans are passive, meaning they do not do any additional processing on their own. Most MBeans reflect the values of counters or other variables in the Waveset server. Because they are passive, they add very little processing load to the server.

To Set Java Security Manager MBean Permissions

If you deploy Waveset on an application server that has Java Security Manager enabled, you must add several MBean-related permissions to the application server security policy file, as follows:

grant codeBase "file:${application_server_instance}
      /Oracle Waveset_web_deployment_directory/-" {
    permission javax.management.MBeanServerPermission "*";
    permission javax.management.MBeanPermission "*", "*";
    permission javax.management.MBeanTrustPermission "*";
};

These permissions enable the entire set of Waveset MBean monitoring actions.

If you have a security requirement to disable certain MBean actions, refer to the following web site for more information, http://www.jcp.org/aboutJava/communityprocess/maintenance/jsr003/JMX_1.2_Security_Proposal.pdf.

Filtering Resource MBeans

By default, each Waveset resource has a corresponding JMX MBean that captures the operational statistics of Waveset's interaction with that resource. When an installation has a lot of resources, this may be too much of a good thing, so there is a way to exclude resources and particular operations on resources.

To disable JMX from reporting on different resources or operations on resources follow these steps:

1. Log in to the Waveset admin console.

2. Select the Configuration tab.

3. Select the Servers subtab.

4. Click the Edit Default Server Settings button.

5. Select the JMX tab.

   This page contains two text fields:

   • Use the top field to exclude one or more resources from being monitored by JMX.

     To exclude a resource from JMX monitoring, you must provide a Java regular expression that matches the resource to be excluded. The pattern being compared is in the following form:

     <resource type>:<resource version>:<resource name>

     For example, a regular expression of Database Table:*:Oracle* excludes all resources with a name that starts with Oracle.

   • Use the bottom field to exclude one or more operations (on a set of resources) from being monitored by JMX. To exclude a specific operation from being monitored, you must provide a Java regular expression that matches the operation to be excluded. Operation names are in the following form:

     ACCOUNT_<Operation>

     OBJECT_<Operation>

     ACTION_<Operation>

   The regular expression patterns must match those names. For example:

   • To exclude all operations for non-account objects, enter

     ^OBJECT.*

   • To exclude updates and deletes, enter

     .*UPDATE$

     .*DELETE$

   JMX can monitor these operations:

   ACCOUNT_CREATE ACCOUNT_UPDATE ACCOUNT_DELETE ACCOUNT_GET ACCOUNT_AUTHENTICATE OBJECT_CREATE OBJECT_UPDATE OBJECT_DELETE OBJECT_GET OBJECT_LIST ACTION_RUN

Viewing JMX Data

Because JMX is a Java standard, there are multiple consoles you can use to interact with MBeans. The Java 1.5 JDK provides the JConsole utility, which is a graphical MBean console that is well suited for displaying Waveset MBean data. JConsole can show the current static value of MBean attributes and it can chart individual (numeric) attributes over time. JConsole charts MBean attributes by periodically polling the MBean for its current value and displaying the attributes as a line chart.

Using JConsole Locally

Using JConsole to view a local server is as simple as starting JConsole and selecting the application server process from a list. When JConsole displays the new connection dialog, it scans the local host for any Java processes that offer an MBean server. Local JConsole connections connect to a local process. These connections are only possible when JConsole is running on the same host as the application server. If your application server does not show up in JConsole's local process list, you probably have not enabled JMX (see Enabling JMX).

Using JConsole Remotely

Assuming you started the JVM with the settings that allow remote MBean access, you can access a remote server's MBean by starting JConsole and connecting to a remote process. The exact Uniform Resource Identifier (URI) used to connect to the remote server depends on how you enabled remote JMX access. The URI is typically one of the following:

• hostname:port (if remote access was granted with the options shown above)

• service:jmx:rmi://host:port/jndi/...

Again, refer to your application server documentation for more information about how to remotely connect to the MBean server. If you have problems connecting JConsole to the application server, check the following URL for more information: http://download.oracle.com/docs/cd/E17476_01/javase/1.5.0/docs/guide/management/faq.html

You can view the structure (but not the data) of the Waveset-provided MBean by going to the following debug page (http://host:port/Oracle Waveset/debug) and clicking the Show MBean button.

For more information on JMX, visit this website:

http://www.oracle.com/technetwork/java/javase/tech/index.html

Data Exposed in JMX

So what kind of data does Waveset expose using JMX MBeans? The following table contains a list of MBeans, describes the data they provide, and explains how to use that data.

Every application server also provides a number of useful MBeans. These MBeans typically supply information about the application server's processing elements such as HTTP processing, DataSource operations, classloading, and JSP compilation. If you have never browsed the MBeans provided by your application server, consider doing so.