How do you enable JMX in Websphere?

Question

I would like to use JConsole to monitor my Websphere application, but I am not sure how to enable JMX.

Answer 1

You cannot set the required system properties through the WAS console, because it does not allow you specify empty values. Instead, you have to insert the following at the bottom of 'server.xml':

<systemProperties xmi:id="Property_1315391623828" name="com.sun.management.jmxremote" value="" required="false"/>    <systemProperties xmi:id="Property_1315327918140" name="com.sun.management.jmxremote.port" value="1235" required="false"/>
<systemProperties xmi:id="Property_1315327935281" name="com.sun.management.jmxremote.authenticate" value="false" required="false"/>
<systemProperties xmi:id="Property_1315327948046" name="com.sun.management.jmxremote.ssl" value="false" required="false"/>
<systemProperties xmi:id="Property_1315390852859" name="javax.management.builder.initial" value="" required="false"/>

Answer 2

Look at the following simple method to connect jconsole to Websphere 6.1

It does works for me (Solaris, Was 6.1, Sun JVM), it also works with Visual VM

Enjoy !

Answer 3

Ok. There are two ways to do this: one using SOAP connector one using RMi/IIOP connector.

For SOAP you need to do WAS setup to add a new PORT and other JVM args described above. But all you get once JConsole connects to the server are basic JVM metrics.

With RMI you get everything that WebSphere exposes. All the MBeans! The only caveat is: if your WAS JVM is behind a firewall - you'd need to open a port to get to it from your desktop. But you can run this via X11 right off the app server host!

I used JDK7 on my Windows XP desktop to connect to WAS 7.0 with global security enabled. I took a script from Answer #4 above and used it as a starting point. Here's my version of it:

@echo off 
set HOST=<put hostname here>
set PORT=<put JVM's BOOTSTRAP_PORT here>

set WAS_HOME=C:\jconsole
set JAVA_HOME=C:\glassfish3\jdk7
set PROPS_DIR=C:\jconsole\properties

set CLIENTSAS=-Dcom.ibm.CORBA.ConfigURL=file:/%PROPS_DIR%/sas.client.props
set CLIENTSSL=-Dcom.ibm.SSL.ConfigURL=file:/%PROPS_DIR%/ssl.client.props
set PROVIDER=-Djava.naming.provider.url=corbaname:iiop:%HOST%:%PORT% 

set PROPS=
set PROPS=%PROPS% %CLIENTSAS% %CLIENTSSL% %PROVIDER%

set CLASSPATH=
set CLASSPATH=%CLASSPATH%;%WAS_HOME%\com.ibm.ws.admin.client_7.0.0.jar
set CLASSPATH=%CLASSPATH%;%WAS_HOME%\com.ibm.ws.ejb.thinclient_7.0.0.jar
set CLASSPATH=%CLASSPATH%;%WAS_HOME%\com.ibm.ws.orb_7.0.0.jar
set CLASSPATH=%CLASSPATH%;%JAVA_HOME%\lib\jconsole.jar
set CLASSPATH=%CLASSPATH%;%JAVA_HOME%\lib\tools.jar

set URL=service:jmx:iiop://%HOST%:%PORT%/jndi/JMXConnector

@echo on

%JAVA_HOME%\bin\java -classpath %CLASSPATH% %PROPS% sun.tools.jconsole.JConsole %URL%

The WAS_HOME is just a directory where i have those IBM JARs that i downloaded from my WebSphere binaries (off Solaris). I also created two subdirs under there: properties and keystore. In the properties subdir i put my sas.client.props and ssl.client.props, also downloaded from a working WAS7 cell (i took it off of a DM). In the keystore subdir i put the key.p12 and trust.p12 files, also downloaded from a WAS7 cell. Make sure they have the right certs! If the ones from WAS/etc don't work - try the ones from ${CONFIG_ROOT}/cells/. Modify ssl.client.props to make sure the path to the p12 files is correct!

Now, in order for this to work you also have to download the following from your WAS binaries:

WAS_BIN_HOME/java/jre/lib/endorsed

Put this whole directory under your SUN JDK's jre/lib directory. This takes care of the IBM JSSE2 Provider errors and such. Also, get the following three files from WAS_BIN_HOME/java/jre/lib/security:

java.security
local_policy.jar
US_export_policy.jar

I just overwrote the ones that came with SUN's JDK with the ones i took from IBM's.

Also, in sas.client.props be sure to enter user ID and password, similar to how you do it in soap.client.props. You can encode the password the same way. This is needed to get past Global Security's BasicAuth.

I think that's it. P.S. I'm not a Windows pro, so if there's a cleaner way to do this - please share it.

Answer 4

Maybe it's a little offtopic, but I have found a way to connect to WAS 7.0 JMX server from JConsole. No server setup is required, no AppClient, only some JARs and a little client setup.

Use the following script

@echo off 
set HOST=<host>
set PORT=2809

set WAS_HOME=D:/Programy/IBM/WebSphere/AppServer

set THIS_DIR=E:/Home/Bogus/Pulpit

set CLIENTSAS=-Dcom.ibm.CORBA.ConfigURL=file:/%THIS_DIR%/sas.client.props
set PROVIDER=-Djava.naming.provider.url=corbaname:iiop:%HOST%:%PORT% 

set PROPS=
set PROPS=%PROPS% %CLIENTSAS%
set PROPS=%PROPS% %PROVIDER%

set CLASSPATH=
set CLASSPATH=%CLASSPATH%;%WAS_HOME%\java\lib\tools.jar
set CLASSPATH=%CLASSPATH%;%WAS_HOME%\runtimes\com.ibm.ws.admin.client_7.0.0.jar
set CLASSPATH=%CLASSPATH%;%WAS_HOME%\runtimes\com.ibm.ws.ejb.thinclient_7.0.0.jar
set CLASSPATH=%CLASSPATH%;%WAS_HOME%\runtimes\com.ibm.ws.orb_7.0.0.jar
set CLASSPATH=%CLASSPATH%;%WAS_HOME%\java\lib\jconsole.jar

set URL=service:jmx:iiop://%HOST%:%PORT%/jndi/JMXConnector

@echo on

:: %WAS_HOME%\java\bin\
java -classpath %CLASSPATH% %PROPS% sun.tools.jconsole.JConsole %URL%

If the target server has administrative security disabled, comment out CLIENTSAS and PROVIDER lines.

If the security is enabled, you will also need sas.client.props file to be put in THIS_DIR directory. The template file can be found under WAS_profile\properties directory. You will have to do a little setup. Here is an excerpt from my sas.client.props

com.ibm.CORBA.securityEnabled=true

com.ibm.CORBA.authenticationTarget=BasicAuth
com.ibm.CORBA.authenticationRetryEnabled=true
com.ibm.CORBA.authenticationRetryCount=3
com.ibm.CORBA.validateBasicAuth=true
com.ibm.CORBA.securityServerHost=
com.ibm.CORBA.securityServerPort=
com.ibm.CORBA.loginTimeout=300
com.ibm.CORBA.loginSource=prompt

com.ibm.CORBA.loginUserid=
com.ibm.CORBA.loginPassword=

com.ibm.CORBA.krb5ConfigFile=
com.ibm.CORBA.krb5CcacheFile=

com.ibm.CSI.performStateful=true

com.ibm.CSI.performClientAuthenticationRequired=false
com.ibm.CSI.performClientAuthenticationSupported=true

# SET ALL THE FOLLOWING VALUES TO FALSE

com.ibm.CSI.performTLClientAuthenticationRequired=false
com.ibm.CSI.performTLClientAuthenticationSupported=false

com.ibm.CSI.performTransportAssocSSLTLSRequired=false
com.ibm.CSI.performTransportAssocSSLTLSSupported=false

com.ibm.CSI.performMessageIntegrityRequired=false
com.ibm.CSI.performMessageIntegritySupported=false

com.ibm.CSI.performMessageConfidentialityRequired=false
com.ibm.CSI.performMessageConfidentialitySupported=false

# COMMENT THIS OUT
#com.ibm.ssl.alias=DefaultSSLSettings


com.ibm.CORBA.requestTimeout=180

OK :)

After connecting, the login popup will appear. Type your admin user and password (user & pw are not required on the connection dialog in JConsole)

You may run the JConsole from IBM JDK, or Sun JDK. For IBM, no other setup is required. However, for Sun you may need to put orb.properties file in your home directory. The file can be found in com.ibm.ws.ejb.thinclient_7.0.0.jar.

Answer 5

I also struggled for a few hours to get this to work and I found the solution. The key issue is here is SSL - the client has to use the proper keys to establish a SSL connection to the server. This involves pointing to the correct trust store location and trust store password as described here. The best way to set up the environment is to call the setupCmdLine.sh (on Windoze it is setupCmdLine.bat) for the relevant server, and then invoke jconsole like this:

#!/bin/bash

WAS_HOME=/opt/IBM/WebSphere/AppServer

# setup server-specific env variables
. $WAS_HOME/profiles/AppSrv01/bin/setupCmdLine.sh

HOST=localhost
PORT=9100

CLASSPATH=$JAVA_HOME/lib/jconsole.jar
CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.admin.client_8.5.0.jar
CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.ejb.thinclient_8.5.0.jar
CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.orb_8.5.0.jar

$JAVA_HOME/bin/jconsole \
    -J-Djava.class.path=$CLASSPATH\
    -J$CLIENTSAS\
    -J$CLIENTSSL\
    service:jmx:iiop://$HOST:$PORT/jndi/JMXConnector

Answer 6

you can try the following, it uses the SOAP protocol adapter. I think it's as lean a configuration possible.

#!/bin/sh 
current_dir=`dirname "$0"`

HOSTNAME=host.fqdn
PORT=2809

WAS_HOME=/opt/IBM/WebSphere/AppServer
WAS_PROFILE=$WAS_HOME/profiles/AppSrv01
WAS_RUNTIMES=$WAS_HOME/runtimes

WAS_LIB=$WAS_HOME/java/lib
JAVA_HOME=$WAS_HOME/java



CLASSPATH=$JAVA_HOME/lib/tools.jar:$JAVA_HOME/lib/jconsole.jar:$WAS_RUNTIMES/com.ibm.ws.admin.client_7.0.0.jar:$WAS_LIB/ibmcfw.jar 

TARGET=service:jmx:soap://$HOSTNAME:$PORT/jndi/JMXConnector

CP="-J-Djava.class.path=$CLASSPATH"
SSL_SERVER_KEY="-J-Djavax.net.ssl.keyStore=$WAS_PROFILE/etc/DummyServerKeyFile.jks -J-Djavax.net.ssl.keyStorePassword=WebAS"
SSL_TRUST_STORE="-J-Djavax.net.ssl.trustStore=$WAS_PROFILE/etc/DummyServerTrustFile.jks -J-Djavax.net.ssl.trustStorePassword=WebAS"
SSL_OPTS="-J-Dcom.ibm.SSL.ConfigURL=file:$WAS_PROFILE/properties/ssl.client.props"
SOAP_OPTS="-J-Dcom.ibm.SOAP.ConfigURL=file:$WAS_PROFILE/properties/soap.client.props"
WAS_OPTS="-J-Dwas.install.root=$WAS_HOME -J-Djava.ext.dirs=$WAS_HOME/plugins:$WAS_HOME/lib:$WAS_HOME/plugins/com.ibm.ws.security.crypto_6.1.0:$WAS_HOME/lib:$JAVA_HOME/jre/lib/ext"

COMMAND="$JAVA_HOME/bin/jconsole $CP $SSL_SERVER_KEY $SSL_TRUST_STORE $SSL_OPTS $SOAP_OPTS $WAS_OPTS $TARGET"

exec $COMMAND

Credits to my colleague Jeroen for the initial version of the script using IIOP (I'm trying SOAP in the hope that it will work with Hyperic)