Unable to Connect to Tomcat Using VisualVM

Question

I am having problems monitoring a remote Tomcat process. I'm trying to use the Java 6 versions of JConsole/JVisualVM.

I have jstatd running on the remote server with the appropriate security policy. The process is started and the TCP connections are available.

When I try to connect through JConsole, I get 'Connection Failed:jmxrmi'.

When I try to connect through VisualVM, I add the host name and my right-click options are 'Add JMX Connection'. It's unclear to me from the docs whether or not that's what I'd expect to see. When I try to connect, I get:

'Cannot connect using service:jmx:rmi:///jndi/rmi://<host>:<port>/jmxrmi'.

So, the docs suggest I only need have jstatd running remotely to monitor in VisualVM, while the UI is asking for jmxrmi .. Are those the same? I've tried setting up tomcat using jmx rmi options and I also timeout, though I know it's not a firewall issue.

If anyone has had success getting a remote Tomcat process attached in this manner, and could describe how, that would help me out a great deal.

Solution 1

Usually you need to make sure you specify the server's ip address in the JAVA_OPTS. Otherwise, it appears that JMX is going to send back instructions to the client to reconnect to the server on a different port and if it doesn't have the ip address to give the client, the connection fails.

The argument for this is:

-Djava.rmi.server.hostname=1.2.3.4

You can find more details in this walk through of the setup process.

Solution 2

You need to enable the management extensions to the Tomcat VM. Usually that means passing in something like these:

-Dcom.sun.management.jmxremote.port=8086
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false

Of course, if you do it the above way make sure your Tomcat isn't visible on the Internet or the port is firewalled from remote access or take similar security measures to avoid being port scanned and compromised. Otherwise use the authentication options.

Solution 3

JMX port usually sends data to another port so you need to find that port number by executing lsof -p -n | grep TCP and enable permissions to that port and then try to connect to remote JMX agent.

Solution 4

I have actually just tackled this problem myself and figured it out.

I would wager that the problem is the RMI connections - you can't predict which ports it will use and so you can't get it to work with a firewall.

The workaround is to use an SSH proxy:

1. SSH to the box where your application is running but use the -D option like this:

   ssh user@remoteHost -D 9999

   This will start a socks proxy on your local machine on port 9999.

2. Open JVisualVM and in the preferences, under 'network' configure it to use a socks proxy at localhost, on port 9999.

If you do the above, you should then be able to connect to the remote machine as normal and since all the RMI traffic is now going over the SSH proxy, it is punched through the firewall and works nicely.

Good luck :-)

View more solutions