Like most application servers, WebSphere 8.5 has a rich management infrastructure based on JMX, or Java Management Extensions. In fact, the WebSphere administration console uses JMX to connect to the server to issue queries and perform administrative operations. In a previous post I showed you how to secure JBoss’ JMX connector. While there is a lot of information out there on how to connect to WebSphere via JMX, most of the examples involve either disabling SSL, or worse – disabling security globally. So let’s see how we can access WebSphere’s JMX connector remotely in a secure way. Like most things WebSphere, this could look very daunting at first, but once done, you will have a reliable and secure setup.
First, a Little Background
Historically most JMX implementations used the simple JMXMP protocol as the underlying transport. The newer versions of the the JMX Spec stipulate that each implementation should support RMI as a transport. As a result, both WebSphere and JBoss have moved away from JMXMP connectors in favor of RMI connectors for JMX. To complicate things even further, WebSphere’s version of RMI works on top of IIOP (and not JRMP as most RMI servers do). In practice, this means that any RMI client (including JMX clients) connecting to WebSphere should use some WebSphere-specific jar files on the classpath. Additionally, because RMI/IIOP uses SSL, we need to specify the correct path to the server’s keystore and trust store where the client and server SSL keys are stored.
Enabling the JMX Connector in WebSphere
For the rest of this post, we are going to assume the following:
- WebSphere 8.5 is installed in /opt/IBM/WebSphere
- You have created an application server node named server1, which is up and running
- The administration console is deployed
- You have the administrative credentials
Step 1. Log on to the Admin Console
Step 2. Navigate to the server settings:
From the menu on the left, go to Servers > Server Types > WebSphere Application Servers.
Step 3. Click on your server (default is server1) and select the Configuration tab.
Step 6. Verify the IIOP Port Number Go back to the server page (see steps 2&3), but this time click on Ports (under the Communications heading). Make a note of the ORB_LISTENER_ADDRESS value (default is 9100)
Step 7. Restart the server. From the command line, go to your server profile folder, e.g.
[dkamenov@was01 bin]cd /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/bin [dkamenov@was01 bin]sudo ./stopServer.sh server1 ADMU0116I: Tool information is being logged in file /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/server1/stopServer.log ADMU0128I: Starting tool with the AppSrv01 profile ADMU3100I: Reading configuration for server: server1 ADMU3201I: Server stop request issued. Waiting for stop status. ADMU4000I: Server server1 stop completed. [dkamenov@was01 bin]$ sudo ./startServer.sh server1 ADMU0116I: Tool information is being logged in file /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/server1/startServer.log ADMU0128I: Starting tool with the AppSrv01 profile ADMU3100I: Reading configuration for server: server1 ADMU3200I: Server launched. Waiting for initialization status. ADMU3000I: Server server1 open for e-business; process id is 13397
After what seems like an eternity, your server will come up.
Step 8. Verify that the server is listening on port 9100:
[dkamenov@was01 ~]$ netstat -an | grep 9100 tcp 0 0 :::9100 :::* LISTEN
JConsole is the generic JMX console provided with the Java SDK. It is expected to work with any MBean server. On the other WebSphere’s MBean server exposes WebSphere-specific objects. For this reason, we need to tweak the environment a little bit in order to make the WebSphere-specific classed known to JConsole. There are also some SSL-specific client and server keys (stored in a key store) that the JMX client needs to establish an SSL connection to the server. We will do all this (and more) with a simple shell script (be sure to change the PORT variable to match ORB_LISTENER_ADDRESS, and also to specify the correct IP address). After the script sets up the environment variables, it invokes the jconsole client bundled with the IBM JDK installed in the WebSphere directory:
#!/bin/bash WAS_HOME=/opt/IBM/WebSphere/AppServer # setup server-specific env variables . $WAS_HOME/profiles/AppSrv01/bin/setupCmdLine.sh #HOST=localhost HOST=192.168.24.129 # Change this as needed PORT=9100 CLASSPATH=$JAVA_HOME/lib/jconsole.jar CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.admin.client_8.5.0.jar CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.ejb.thinclient_8.5.0.jar CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.orb_8.5.0.jar $JAVA_HOME/bin/jconsole \ -J-Djava.class.path=$CLASSPATH\ -J$CLIENTSAS\ -J$CLIENTSSL\ service:jmx:iiop://$HOST:$PORT/jndi/JMXConnector
In a future post, we will take things a step further by using the Monitis JMX monitor to gather metrics from WebSphere and upload them to your Monitis account. Until then, happy monitoring!