Enabling Java Management Extensions (JMX) for Jamf Pro
Java Management Extensions (JMX) can be used to generate metrics for Jamf Pro host server performance monitoring for on-premise environments. This article describes the process used to set up JMX.
Java provides built-in tools such as Jconsole that you can use to monitor these metrics. Alternatively, you may choose to use any third-party monitoring tool that can connect to JMX.
General Requirements
JMX monitoring tool (e.g., Jconsole, Zabbix, Nagios)
Enabling JMX on Linux
- On the Jamf Pro host server, copy the default JMX password file to /etc/ by executing:
sudo cp /usr/lib/jvm/java<version>/jre/lib/management/jmxremote.password /etc/jmxremote.password
- Change the owner and the permissions of the jmxremote.password file by executing:
sudo chown jamftomcat:jamftomcat /etc/jmxremote.password sudo chmod 400 /etc/jmxremote.password
Note:The JMX password file must be owned by the user and the group that runs Tomcat on the Jamf Pro host server and access must be restricted to that user. To confirm the user and the group, execute a command similar to the following:ls -al /path/to/tomcat/
- Modify the jmxremote.password file and uncomment
monitorRole
andcontrolRole
by removing "#" at the beginning of the line, then changing the password. ThemonitorRole
role has password QED. ThecontrolRole
role has password R&D. Modify the file by executing:sudo nano /etc/jmxremote.password
- Save and exit.
- Modify the Java options on the Jamf Pro host server as defined by the setenv.sh file. Modify the file by executing:
sudo nano /usr/local/jss/tomcat/bin/setenv.sh
Add the following lines and modify theDjava.rmi.server.hostname
value of My.IP.Address.Number to match the IP address of the Jamf Pro host server. The default port of 3333 can be modified as well.Note:Do not remove any settings.
export CATALINA_OPTS="$CATALINA_OPTS -Djava.awt.headless=true" export CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote.port=3333" export CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote.ssl=false" export CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote.authenticate=true" export CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote=true" export CATALINA_OPTS="$CATALINA_OPTS -Djava.rmi.server.hostname=My.IP.Address.Number" export CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/jmxremote.password"
- Save and exit.
- Modify the DataBase.xml file to turn on JMX for the specific web application by executing:
sudo nano /usr/local/jss/tomcat/webapps/ROOT/WEB-INF/xml/DataBase.xml
Add the following between the<DataBase>
</DataBase>
entries:<EnableJMX>true</EnableJMX>
Note: This enables connection pool metrics that can help you to understand how the connection pool is performing.This enables connection pool metrics that can help you to understand how the connection pool is performing.
- Save and exit.
- Restart Tomcat. For instructions, see Starting and Stopping Tomcat.
- If you have a firewall enabled in your environment, you must allow for incoming traffic on the port you specified above so that an external monitoring system can connect to your Jamf Pro host server via JMX.
- On a macOS system with Java installed, open Terminal and execute:
jconsole
Enter the Jamf Pro host server IP address, port, username, and password for the
monitorRole
specified above.
You can now use Jconsole or any third-party monitoring tool to leverage JMX.
For the full list of JMX objects, see the Java Management Extensions (JMX) Glossary for Jamf Pro article.
Enabling JMX on Windows
- On the Jamf Pro host server, open Command Prompt and execute the following to copy the default JMX password file to the root of the C: drive:
copy "C:\Program Files\Java\jre<version>\lib\management\jmxremote.password.template" C:\jmxremote.password
- Change the owner of C:\jmxremote.passwordNote:
-
The JMX password file must be owned by the user that runs Tomcat on the Jamf Pro host server. If you used the Jamf Pro installer, the default owner of Tomcat is "System". For instructions on modifying ownership of the file, see: https://docs.oracle.com/javase/8/docs/technotes/guides/management/security-windows.html
-
You may see the following errors in the tomcat8-stderr<date>.log on Systems if the file is not restricted to the owner of Tomcat: "Error: Password file read access must be restricted: C:\jmxremote.password"
-
You may see the following errors in the tomcat8-stderr<date>.log on Systems if the file is restricted to a user other than the owner of Tomcat: "Error: Failed in reading the password file: C:\jmxremote.password"
-
- Use a text editor to modify the jmxremote.password file located at C:\jmxremote.password. Uncomment
monitorRole
andcontrolRole
, then change the password. ThemonitorRole
role has password QED. ThecontrolRole
role has password R&D. - Save and exit.
- Modify the Java options on the Jamf Pro host server. Open C:\Program Files\JSS\Tomcat\bin\tomcat8w.exe application and navigate to the Java tab. Add the following lines and modify the
Djava.rmi.server.hostname
value of My.IP.Address.Number to match the IP address of the Jamf Pro host server. The default port of 3333 can be modified as well.Note:Do not remove any settings.
-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=3333 -Dcom.sun.management.jmxremote.rmi.port=3333 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=true -Djava.rmi.server.hostname=My.IP.Address.Number -Dcom.sun.management.jmxremote.password.file=C:\jmxremote.password
- Save and exit.
- Modify the Database.xml file located at the following filepath to turn on JMX for the specific web application:
C:\Program Files\JSS\Tomcat\webapps\ROOT\WEB-INF\xml\DataBase.xml
Add the following between the<DataBase>
</DataBase>
entries:<EnableJMX>true</EnableJMX>
Note:This enables connection pool metrics that can help you to understand how the connection pool is performing.
- Save and exit.
- Restart Tomcat. For instructions, see Starting and Stopping Tomcat.
- If you have a firewall enabled in your environment, you must allow for incoming traffic on the port you specified above so that an external monitoring system can connect to your Jamf Pro host server via JMX by executing:
netsh advfirewall firewall add rule name=JamfProJMX dir=in action=allow protocol=TCP localport=3333
- On a system with Java installed, open C:\Program Files\Java\jdk<version>\bin\jconsole.exe Enter the Jamf Pro host server IP address, port, username, and password for the
monitorRole
specified above.
You can now use Jconsole or any third-party monitoring tool to leverage JMX.
For the full list of JMX objects, see the Java Management Extensions (JMX) Glossary for Jamf Pro article.