JBoss - Usando o JConsole e JVisualM no JBoss

Este post será útil para os que querem monitorar e invocar métodos através do JConsole ou JVisualM remotamente.

Importante:

- Utilizada instância 'all';
- IP de bind do JBoss 192.168.56.101;

Configurações necessárias no 'run.conf' da instância do JBoss:

1 - Adicione a linha abaixo:

JAVA_OPTS="$JAVA_OPTS -Djava.rmi.server.hostname=$IP_DO_JBOSS -Dcom.sun.management.config.file=/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/management.properties -Dcom.sun.management.jmxremote -Djboss.platform.mbeanserver -Djavax.management.builder.initial=org.jboss.system.server.jmx.MBeanServerBuilderImpl"


2 - Substitua o IP_DO_JBOSS pelo IP que o JBoss realiza o bind, e também path do arquivo de configuração do JMX.

Ficaria assim um arquivo de configuração:

---


if [ "x$JAVA_OPTS" = "x" ]; then


   JAVA_OPTS="-Xms512m -Xmx512m -XX:MaxPermSize=256m -Dorg.jboss.resolver.warning=true -Dsun.rmi.dgc.client.gcInterval=3600000 -Dsun.rmi.dgc.server.gcInterval=3600000 -Dsun.lang.ClassLoader.allowArraySyntax=true"


   # Gerenciamento JConsole
   JAVA_OPTS="$JAVA_OPTS -Djava.rmi.server.hostname=192.168.56.101 -Dcom.sun.management.config.file=/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/management.properties -Dcom.sun.management.jmxremote -Djboss.platform.mbeanserver -Djavax.management.builder.initial=org.jboss.system.server.jmx.MBeanServerBuilderImpl"

fi

---

3 - Agora copie o conteúdo da pasta 'management' do seu JDK para o JBoss:

$ mkdir /opt/jboss-epp-5.1/jboss-as/server/all/conf/management/

$ cp /opt/jdk1.6.0_23/jre/lib/management/* /opt/jboss-epp-5.1/jboss-as/server/all/conf/management/

4 - Edite o arquivo '/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/jmxremote.access' deixando da seguinte forma:

######################################################################

#     Default Access Control File for Remote JMX(TM) Monitoring

######################################################################

#

# Access control file for Remote JMX API access to monitoring.

# This file defines the allowed access for different roles.  The

# password file (jmxremote.password by default) defines the roles and their

# passwords.  To be functional, a role must have an entry in

# both the password and the access files.

#

# The default location of this file is $JRE/lib/management/jmxremote.access

# You can specify an alternate location by specifying a property in

# the management config file $JRE/lib/management/management.properties

# (See that file for details)

#

# The file format for password and access files is syntactically the same

# as the Properties file format.  The syntax is described in the Javadoc

# for java.util.Properties.load.

# A typical access file has multiple lines, where each line is blank,

# a comment (like this one), or an access control entry.

#

# An access control entry consists of a role name, and an

# associated access level.  The role name is any string that does not

# itself contain spaces or tabs.  It corresponds to an entry in the

# password file (jmxremote.password).  The access level is one of the

# following:

#       "readonly" grants access to read attributes of MBeans.

#                   For monitoring, this means that a remote client in this

#                   role can read measurements but cannot perform any action

#                   that changes the environment of the running program.

#       "readwrite" grants access to read and write attributes of MBeans,

#                   to invoke operations on them, and optionally

#                   to create or remove them. This access should be granted

#                   only to trusted clients, since they can potentially

#                   interfere with the smooth operation of a running program.

#

# The "readwrite" access level can optionally be followed by the "create" and/or

# "unregister" keywords.  The "unregister" keyword grants access to unregister

# (delete) MBeans.  The "create" keyword grants access to create MBeans of a

# particular class or of any class matching a particular pattern.  Access

# should only be granted to create MBeans of known and trusted classes.

#

# For example, the following entry would grant readwrite access

# to "controlRole", as well as access to create MBeans of the class

# javax.management.monitor.CounterMonitor and to unregister any MBean:

#  controlRole readwrite \

#              create javax.management.monitor.CounterMonitorMBean \

#              unregister

# or equivalently:

#  controlRole readwrite unregister create javax.management.monitor.CounterMBean

#

# The following entry would grant readwrite access as well as access to create

# MBeans of any class in the packages javax.management.monitor and

# javax.management.timer:

#  controlRole readwrite \

#              create javax.management.monitor.*,javax.management.timer.* \

#              unregister

#

# The \ character is defined in the Properties file syntax to allow continuation

# lines as shown here.  A * in a class pattern matches a sequence of characters

# other than dot (.), so javax.management.monitor.* matches

# javax.management.monitor.CounterMonitor but not

# javax.management.monitor.foo.Bar.

#

# A given role should have at most one entry in this file.  If a role

# has no entry, it has no access.

# If multiple entries are found for the same role name, then the last

# access entry is used.

#

#

# Default access control entries:

# o The "monitorRole" role has readonly access.

# o The "controlRole" role has readwrite access and can create the standard

#   Timer and Monitor MBeans defined by the JMX API.

#monitorRole   readonly

#controlRole   readwrite \

#              create javax.management.monitor.*,javax.management.timer.* \

#              unregister

admin   readwrite

5 - Altere o arquivo '/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/jmxremote.password.template' para '/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/jmxremote.password' e edite o arquivo deixando-o da seguinte forma:

# ----------------------------------------------------------------------

#           Template for jmxremote.password

#

# o Copy this template to jmxremote.password

# o Set the user/password entries in jmxremote.password

# o Change the permission of jmxremote.password to read-only

#   by the owner.

#

# See below for the location of jmxremote.password file.

# ----------------------------------------------------------------------

##############################################################

#        Password File for Remote JMX Monitoring

##############################################################

#

# Password file for Remote JMX API access to monitoring.  This

# file defines the different roles and their passwords.  The access

# control file (jmxremote.access by default) defines the allowed

# access for each role.  To be functional, a role must have an entry

# in both the password and the access files.

#

# Default location of this file is $JRE/lib/management/jmxremote.password

# You can specify an alternate location by specifying a property in

# the management config file $JRE/lib/management/management.properties

# or by specifying a system property (See that file for details).

##############################################################

#    File permissions of the jmxremote.password file

##############################################################

#      Since there are cleartext passwords stored in this file,

#      this file must be readable by ONLY the owner,

#      otherwise the program will exit with an error.

#

# The file format for password and access files is syntactically the same

# as the Properties file format.  The syntax is described in the Javadoc

# for java.util.Properties.load.

# Typical password file has multiple  lines, where each line is blank,

# a comment (like this one), or a password entry.

#

#

# A password entry consists of a role name and an associated

# password.  The role name is any string that does not itself contain

# spaces or tabs.  The password is again any string that does not

# contain spaces or tabs.  Note that passwords appear in the clear in

# this file, so it is a good idea not to use valuable passwords.

#

# A given role should have at most one entry in this file.  If a role

# has no entry, it has no access.

# If multiple entries are found for the same role name, then the last one

# is used.

#

# In a typical installation, this file can be read by anybody on the

# local machine, and possibly by people on other machines.

# For # security, you should either restrict the access to this file,

# or specify another, less accessible file in the management config file

# as described above.

#

# Following are two commented-out entries.  The "measureRole" role has

# password "QED".  The "controlRole" role has password "R&D".

#

# monitorRole  QED

# controlRole   R&D

  admin teste123

Onde "admin" é o usuário do access e "teste123" será a senha de acesso deste usuário. 

6 - Edite o arquivo '/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/management.properties' e deixe-o da seguinte forma:

#####################################################################

#       Default Configuration File for Java Platform Management

#####################################################################

#

# The Management Configuration file (in java.util.Properties format)

# will be read if one of the following system properties is set:

#    -Dcom.sun.management.jmxremote.port=<port-number>

# or -Dcom.sun.management.snmp.port=<port-number>

# or -Dcom.sun.management.config.file=<this-file>

#

# The default Management Configuration file is:

#

#       $JRE/lib/management/management.properties

#

# Another location for the Management Configuration File can be specified

# by the following property on the Java command line:

#

#    -Dcom.sun.management.config.file=<this-file>

#

# If -Dcom.sun.management.config.file=<this-file> is set, the port

# number for the management agent can be specified in the config file

# using the following lines:

#

# ################ Management Agent Port #########################

#

# For setting the JMX RMI agent port use the following line

com.sun.management.jmxremote.port=21123

#

# For setting the SNMP agent port use the following line

# com.sun.management.snmp.port=<port-number>

#####################################################################

#                   Optional Instrumentation

#####################################################################

#

# By default only the basic instrumentation with low overhead is on.

# The following properties allow to selectively turn on optional

# instrumentation which are off by default and may have some

# additional overhead.

#

# com.sun.management.enableThreadContentionMonitoring

#

#      This option enables thread contention monitoring if the

#      Java virtual machine supports such instrumentation.

#      Refer to the specification for the java.lang.management.ThreadMBean

#      interface - see isThreadContentionMonitoringSupported() method.

#

# To enable thread contention monitoring, uncomment the following line

# com.sun.management.enableThreadContentionMonitoring

#####################################################################

#                       SNMP Management Properties

#####################################################################

#

# If the system property -Dcom.sun.management.snmp.port=<port-number>

# is set then

#       - The SNMP agent (with the Java virtual machine MIB) is started

#         that listens on the specified port for incoming SNMP requests.

#       - the following properties for read for SNMP management.

#

# The configuration can be specified only at startup time.

# Later changes to the above system property (e.g. via setProperty method), this

# config file, or the ACL file has no effect to the running SNMP agent.

#

#

# ##################### SNMP Trap Port #########################

#

# com.sun.management.snmp.trap=<trap-destination-port-number>

#      Specifies the remote port number at which managers are expected

#      to listen for trap. For each host defined in the ACL file,

#      the SNMP agent will send traps at <host>:<trap-destination-port-number>

#      Default for this property is 162.

#

# To set port for sending traps to a different port use the following line

# com.sun.management.snmp.trap=<trap-destination-port-number>

#

# ################ SNMP listen interface #########################

#

# com.sun.management.snmp.interface=<InetAddress>

#      Specifies the local interface on which the SNMP agent will bind.

#      This is useful when running on machines which have several

#      interfaces defined. It makes it possible to listen to a specific

#      subnet accessible through that interface.

#      Default for this property is "localhost".

#

#      The format of the value for that property is any string accepted

#      by java.net.InetAddress.getByName(String).

#

# For restricting the port on which SNMP agent listens use the following line

# com.sun.management.snmp.interface=<InetAddress>

#

# #################### SNMP ACL file #########################

#

# com.sun.management.snmp.acl=true|false

#      Default for this property is true. (Case for true/false ignored)

#      If this property is specified as false then the ACL file

#      is not checked:  all manager hosts are allowed all access.

#

# For SNMP without checking ACL file uncomment the following line

# com.sun.management.snmp.acl=false

#

# com.sun.management.snmp.acl.file=filepath

#      Specifies location for ACL file

#      This is optional - default location is

#      $JRE/lib/management/snmp.acl

#

#      If the property "com.sun.management.snmp.acl" is set to false,

#      then this property and the ACL file are ignored.

#      Otherwise the ACL file must exist and be in the valid format.

#      If the ACL file is empty or non existent then no access is allowed.

#

#      The SNMP agent will read the ACL file at startup time.

#      Modification to the ACL file has no effect to any running SNMP

#      agents which read that ACL file at startup.

#

# For a non-default acl file location use the following line

# com.sun.management.snmp.acl.file=filepath

#####################################################################

#                       RMI Management Properties

#####################################################################

#

# If system property -Dcom.sun.management.jmxremote.port=<port-number>

# is set then

#     - A MBean server is started

#     - JRE Platform MBeans are registered in the MBean server

#     - RMI connector is published  in a private readonly registry at

#       specified port using a well known name, "jmxrmi"

#     - the following properties are read for JMX remote management.

#

# The configuration can be specified only at startup time.

# Later changes to above system property (e.g. via setProperty method),

# this config file, the password file, or the access file have no effect to the

# running MBean server, the connector, or the registry.

#

#

# ########## RMI connector settings for local management ##########

#

# com.sun.management.jmxremote.local.only=true|false

#      Default for this property is true. (Case for true/false ignored)

#      If this property is specified as true then the local JMX RMI connector

#      server will only accept connection requests from clients running on

#      the host where the out-of-the-box JMX management agent is running.

#      In order to ensure backwards compatibility this property could be

#      set to false. However, deploying the local management agent in this

#      way is discouraged because the local JMX RMI connector server will

#      accept connection requests from any client either local or remote.

#      For remote management the remote JMX RMI connector server should

#      be used instead with authentication and SSL/TLS encryption enabled.

#

# For allowing the local management agent accept local

# and remote connection requests use the following line

com.sun.management.jmxremote.local.only=false

#

# ###################### RMI SSL #############################

#

# com.sun.management.jmxremote.ssl=true|false

#      Default for this property is true. (Case for true/false ignored)

#      If this property is specified as false then SSL is not used.

#

# For RMI monitoring without SSL use the following line

com.sun.management.jmxremote.ssl=false

# com.sun.management.jmxremote.ssl.config.file=filepath

#      Specifies the location of the SSL configuration file. A properties

#      file can be used to supply the keystore and truststore location and

#      password settings thus avoiding to pass them as cleartext in the

#      command-line.

#

#      The current implementation of the out-of-the-box management agent will

#      look up and use the properties specified below to configure the SSL

#      keystore and truststore, if present:

#          javax.net.ssl.keyStore=<keystore-location>

#          javax.net.ssl.keyStorePassword=<keystore-password>

#          javax.net.ssl.trustStore=<truststore-location>

#          javax.net.ssl.trustStorePassword=<truststore-password>

#      Any other properties in the file will be ignored. This will allow us

#      to extend the property set in the future if required by the default

#      SSL implementation.

#

#      If the property "com.sun.management.jmxremote.ssl" is set to false,

#      then this property is ignored.

#

# For supplying the keystore settings in a file use the following line

# com.sun.management.jmxremote.ssl.config.file=filepath

# com.sun.management.jmxremote.ssl.enabled.cipher.suites=<cipher-suites>

#      The value of this property is a string that is a comma-separated list

#      of SSL/TLS cipher suites to enable. This property can be specified in

#      conjunction with the previous property "com.sun.management.jmxremote.ssl"

#      in order to control which particular SSL/TLS cipher suites are enabled

#      for use by accepted connections. If this property is not specified then

#      the SSL/TLS RMI Server Socket Factory uses the SSL/TLS cipher suites that

#      are enabled by default.

#

# com.sun.management.jmxremote.ssl.enabled.protocols=<protocol-versions>

#      The value of this property is a string that is a comma-separated list

#      of SSL/TLS protocol versions to enable. This property can be specified in

#      conjunction with the previous property "com.sun.management.jmxremote.ssl"

#      in order to control which particular SSL/TLS protocol versions are

#      enabled for use by accepted connections. If this property is not

#      specified then the SSL/TLS RMI Server Socket Factory uses the SSL/TLS

#      protocol versions that are enabled by default.

#

# com.sun.management.jmxremote.ssl.need.client.auth=true|false

#      Default for this property is false. (Case for true/false ignored)

#      If this property is specified as true in conjunction with the previous

#      property "com.sun.management.jmxremote.ssl" then the SSL/TLS RMI Server

#      Socket Factory will require client authentication.

#

# For RMI monitoring with SSL client authentication use the following line

com.sun.management.jmxremote.ssl.need.client.auth=false

# com.sun.management.jmxremote.registry.ssl=true|false

#      Default for this property is false. (Case for true/false ignored)

#      If this property is specified as true then the RMI registry used

#      to bind the RMIServer remote object is protected with SSL/TLS

#      RMI Socket Factories that can be configured with the properties:

#          com.sun.management.jmxremote.ssl.config.file

#          com.sun.management.jmxremote.ssl.enabled.cipher.suites

#          com.sun.management.jmxremote.ssl.enabled.protocols

#          com.sun.management.jmxremote.ssl.need.client.auth

#      If the two properties below are true at the same time, i.e.

#          com.sun.management.jmxremote.ssl=true

#          com.sun.management.jmxremote.registry.ssl=true

#      then the RMIServer remote object and the RMI registry are

#      both exported with the same SSL/TLS RMI Socket Factories.

#

# For using an SSL/TLS protected RMI registry use the following line

com.sun.management.jmxremote.registry.ssl=false

#

# ################ RMI User authentication ################

#

# com.sun.management.jmxremote.authenticate=true|false

#      Default for this property is true. (Case for true/false ignored)

#      If this property is specified as false then no authentication is

#      performed and all users are allowed all access.

#

# For RMI monitoring without any checking use the following line

com.sun.management.jmxremote.authenticate=true

#

# ################ RMI Login configuration ###################

#

# com.sun.management.jmxremote.login.config=<config-name>

#      Specifies the name of a JAAS login configuration entry to use when

#      authenticating users of RMI monitoring.

#

#      Setting this property is optional - the default login configuration

#      specifies a file-based authentication that uses the password file.

#

#      When using this property to override the default login configuration

#      then the named configuration entry must be in a file that gets loaded

#      by JAAS. In addition, the login module(s) specified in the configuration

#      should use the name and/or password callbacks to acquire the user's

#      credentials. See the NameCallback and PasswordCallback classes in the

#      javax.security.auth.callback package for more details.

#

#      If the property "com.sun.management.jmxremote.authenticate" is set to

#      false, then this property and the password & access files are ignored.

#

# For a non-default login configuration use the following line

# com.sun.management.jmxremote.login.config=<config-name>

#

# ################ RMI Password file location ##################

#

# com.sun.management.jmxremote.password.file=filepath

#      Specifies location for password file

#      This is optional - default location is

#      $JRE/lib/management/jmxremote.password

#

#      If the property "com.sun.management.jmxremote.authenticate" is set to

#      false, then this property and the password & access files are ignored.

#      Otherwise the password file must exist and be in the valid format.

#      If the password file is empty or non-existent then no access is allowed.

#

# For a non-default password file location use the following line

com.sun.management.jmxremote.password.file=/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/jmxremote.password

#

# ################ RMI Access file location #####################

#

# com.sun.management.jmxremote.access.file=filepath

#      Specifies location for access  file

#      This is optional - default location is

#      $JRE/lib/management/jmxremote.access

#

#      If the property "com.sun.management.jmxremote.authenticate" is set to

#      false, then this property and the password & access files are ignored.

#      Otherwise, the access file must exist and be in the valid format.

#      If the access file is empty or non-existent then no access is allowed.

#

# For a non-default password file location use the following line

com.sun.management.jmxremote.access.file=/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/jmxremote.access

Parâmetros importantes:

com.sun.management.jmxremote.port=21123 - Porta do JMX 

com.sun.management.jmxremote.local.only=false - Se responderá só locamente 

com.sun.management.jmxremote.ssl=false - Se utilizará SSL(é indicado utilizar)

com.sun.management.jmxremote.authenticate=true - Se o JMX utilizará autenticação

com.sun.management.jmxremote.password.file=/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/jmxremote.password - Arquivo de senhas

com.sun.management.jmxremote.access.file=/opt/jboss-epp-5.1/jboss-as/server/all/conf/management/jmxremote.access - Arquivo de usuários

7 - Crie o arquivo dentro de seu JDK para o Jstat '/opt/jdk1.6.0_23/jre/lib/security/tools.policy' e deixe-o da seguinte forma:

grant {

  permission java.security.AllPermission;

};

8 - Execute o seguinte comando:

$ /opt/jdk1.6.0_23/bin/jstatd -p 1099 -J-Djava.security.policy=tools.policy &

9 - Agora poderá utilizando o JConsole ou JVisualM adicionar seu JBoss para monitoramento remoto:

JConsole - hostname - No meu caso 192.168.56.101

               - porta 21123

JVisualM 

             JMX - hostname 192.168.56.101 - porta 21123

             Jstat - hostname 192.168.56.101 - porta 1099

Em produção - Utilize no JMX SSL e no Jstat utilize grants mais restritivas, também pode limitar o acesso por IPTables.