JMX Access to Domain Mode EAP 6 Server Node
External
- Accessing JMX with jconsole over SSL on EAP 6 https://access.redhat.com/solutions/632773
Internal
Overview
A generic JMX client connects to a domain mode server node using the remoting endpoint.
Unlike a standalone server node, a domain mode server node does not expose a management interface native endpoint, so the server node has to be explicitly configured to allow JMX access over the general purpose remoting connector. More details on how that is configured is available in the "" section.
Specific JBoss libraries must be added to the generic client's classpath, and we will show how those can be added for Visual VM and jconsole. Also, the access must be secured by adding a specific user (or using an existing user) to the applications realm associated with the remoting connector.
Server Endpoint
The generic JMX client must connect to the native endpoint of the standalone instance's management interface.
The host address and port binding for the endpoint are specified as "management-native" socket binding, in standalone.xml configuration file:
<socket-binding-group name="standard-sockets" ...>
...
<socket-binding name="management-native" interface="management" port="${jboss.management.native.port:9999}"/>
</socket-binding-group>
The port value is 9999.
If the standalone instance runs with a specific port offset, the management endpoint port value must account for that offset.
The actual value for the management interface bind address is specified under the related "management" interface specification:
<interfaces>
<interface name="management">
<inet-address value="${jboss.bind.address.management:127.0.0.1}"/>
</interface>
...
</interfaces>
Unless explicitly re-configured, the default bind address for the management interface is 127.0.0.1.
The bind address and the port are reported as INFO, as follows:
16:15:51,187 INFO [org.jboss.as.remoting] (MSC service thread 1-15) JBAS017100: Listening on 127.0.0.1:9999
The bind address and port will be needed when assembling the URL to be used by the JMX client, below.
Server Endpoint Authentication
A generic JMX client usually provides a username and a password when connecting. Those values must be explicitly added to the Management Realm of the server instance we connect to. The procedure to add a user to the Management Realm is presented in detail here:
Note that no specific group is necessary to be specified during the procedure.
JMX Client
The generic JMX client must add client JBoss libraries to its class path and must set up JBoss specific system properties, as shown below. It also must use a specific URL to connect, and the user and the password configured on the server, as described in the "Server Endpoint Authentication" section.
JMX Client Classpath and Startup Options
The JBoss JAR $JBOSS_HOME/bin/client/jboss-cli-client.jar must be added to the JMX client classpath. Also, the JMX client must be started with -Dmodule.path=${JBOSS_HOME}/modules. Specific details for a number of clients are available below:
URL
Use:
service:jmx:remoting-jmx://<server-host>:9999
where <server-host> is the interface the native management endpoint is bound to. If the client and server are collocated, that is usually 127.0.0.1.
Authentication
Use the username and the password configured on the server, as described in the "Server Endpoint Authentication" section.
SSL Connection Configuration
TODO, come up with the full procedure, until then, more details are available here: https://access.redhat.com/solutions/632773
review
In order to expose the JMX bus of a server node in domain mode, the JMX subsystem instance on the nodes sharing the same profile must be configured to expose the JMX interface on the connector defined by the Remoting subsystem.
The configuration change that enables this behavior must be applied in domain.xml, as follows:
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
...
<remoting-connector use-management-endpoint="false"/>
</subsystem>
The Remoting subsystem binds by default to port 4447 and authenticates against the ApplicationRealm security realm. For more details on remoting security see Remoting Concepts - Security. For details on how to add users to the ApplicationRealm, see Adding a User to the Application Realm.