Geek Answers Handbook

VisualVM through Firewalls - RMI Troubleshooting

Sorry for this question, which must have been asked many times, but I cannot succeed in solving my problem. I read a lot of blogs, sites, forums, ... and did not find a solution in my case.

Case: I need to connect VisualVM on my box to remote servers (tomcats, weblogics) to monitor performance / threads / memory. These servers are installed on (physical or virtual) machines that are protected by a firewall. Large port spans are open in the firewall and may be used, but not in all ports.

Test

  • I tried direct connections through JMX in VisualVM using the following server-side JVM options when starting the server: 
     -Djava.rmi.server.hostname=[hostname] -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=[port] -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false

I determined the host name because from my network the host name and IP address of the server do not match the names from the network of the remote server.

No success, VisualVM is always looking for an unknown server.

  • tried to run jstatd on the server side on an accessible port (-p) from my window (telnet works on this port), but when running visualVM on this host with the jstatd port it still seems to be waiting for something unattainable .... Same behavior when connecting jps to this remote host.

  • tried using the same tools on a server with less network protection, and it works. Thus, I saw the connections between my mailbox and the server, and they run on ports other than what I specified jstatd. I understand that this port is necessary for the first connection (a kind of handshake), and real communications are performed on other ports, but are not predictable (for example: 60305, 55197, ...). Not sure if I understand very well how RMI works.

Please help me, I'll lose my mind!

+6
java visualvm jmx rmi
source share
3 answers

Unfortunately, JMX is trying to open ports other than the one you are configuring. Just yesterday, I was able to connect to tomcat behind a firewall through JMX. Two complex parts:

  • put the jmxremote.access file in CATALINA_HOME/conf , which contains the following lines:

     monitorRole readonly controlRole readwrite

  • in server.xml set the ports to be used by jmx through the tomcat special listener (catalina-jmx-remote.jar, required in / lib):

     <Listener className="org.apache.catalina.mbeans.JmxRemoteLifecycleListener" rmiRegistryPortPlatform="9009" rmiServerPortPlatform="9010" />

Then open these two ports on the firewall. It is working. But this is only for tomcat.

Another option is to use ssh tunneling . In short, you connect via SSH and configure it to forward some local port (where the jmx client is running) to some ports on the other side of the tunnel.

Literature:

+7
source share

Here are the steps for doing this:

  • Run ejstatd on your remote host this way (in the ejstatd folder): mvn exec:java -Djava.rmi.server.hostname=[remote_host_name] -Dexec.args="-pr 1099 -ph 1100 -pv 1101" (used for type "jstatd" connection)
  • Launch a Java application with the following additional Java parameters: -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.port=1102 -Dcom.sun.management.jmxremote.rmi.port=1102 -Djava.rmi.server.hostname=[remote_host_name] (used to connect like "JMX") ( java.rmi.server.hostname is required here only because that the IP and hostname of your network do not match the server point view)
  • Open these 4 ports on the remote host and make them available for your local machine: 1099 , 1100 , 1101 and 1102
  • Launch JVisualVM
    • Right-click on "Remote"> "Add Remote Host ..." and enter the name of the remote host in "Host Name" (if you are not using port 1099 , you can change this in the "Advanced Settings" field)
    • Right-click the newly created remote host> "Add JMX Connection ..." and enter " [remote_host_name]:1102 " into "Connection" and check the box "No SSL connection required"
    • Your Java process will appear twice: one of the jstatd connection type and one of the JMX connection type.

Disclaimer: I am the author of the open source tool ejstatd .

+1
source share

On your [hostname], open the [port] port and tcp port 40000-60000 only for your IP address. This is a pretty trick for me.

0
source share

More articles:


All Articles