Like most application servers, WebSphere 8.5 has a rich management infrastructure based on JMX, or Java Management Extensions. In fact, the WebSphere administration console uses JMX to connect to the server to issue queries and perform administrative operations. In a previous post I showed you how to secure JBoss’ JMX connector. While there is a lot of information out there on how to connect to WebSphere via JMX, most of the examples involve either disabling SSL, or worse – disabling security globally. So let’s see how we can access WebSphere’s JMX connector remotely in a secure way. Like most things WebSphere, this could look very daunting at first, but once done, you will have a reliable and secure setup.

First, a Little Background
Historically most JMX implementations used the simple JMXMP protocol as the underlying transport. The newer versions of the the JMX Spec stipulate that each implementation should support RMI as a transport. As a result, both WebSphere and JBoss have moved away from JMXMP connectors in favor of RMI connectors for JMX. To complicate things even further, WebSphere’s version of RMI works on top of IIOP (and not JRMP as most RMI servers do). In practice, this means that any RMI client (including JMX clients) connecting to WebSphere should use some WebSphere-specific jar files on the classpath. Additionally, because RMI/IIOP uses SSL, we need to specify the correct path to the server’s keystore and trust store where the client and server SSL keys are stored.

Enabling the JMX Connector in WebSphere
For the rest of this post, we are going to assume the following:

• WebSphere 8.5 is installed in /opt/IBM/WebSphere
• You have created an application server node named server1, which is up and running
• The administration console is deployed
• You have the administrative credentials

Step 1. Log on to the Admin Console

Open a web browser, go to https://localhost:9043/ibm/console and log in with your administrative user and password:

Step 2. Navigate to the server settings:

From the menu on the left, go to Servers > Server Types > WebSphere Application Servers.

Step 3. Click on your server (default is server1) and select the Configuration tab.

Step 4. Scroll down to the Server Infrastructure section and expand Administration and select Administration Services

Step 5. Enable JSR160 RMI JMX Connector. Select JMX Connectors, then check JSR160RMIConnector and click Enable. When prompted, select Save to Master Configuration:

Step 6. Verify the IIOP Port Number Go back to the server page (see steps 2&3), but this time click on Ports (under the Communications heading). Make a note of the ORB_LISTENER_ADDRESS value (default is 9100)

Step 7. Restart the server. From the command line, go to your server profile folder, e.g.

[dkamenov@was01 bin]cd /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/bin
[dkamenov@was01 bin]sudo ./stopServer.sh server1
ADMU0116I: Tool information is being logged in file
           /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/server1/stopServer.log
ADMU0128I: Starting tool with the AppSrv01 profile
ADMU3100I: Reading configuration for server: server1
ADMU3201I: Server stop request issued. Waiting for stop status.
ADMU4000I: Server server1 stop completed.

[dkamenov@was01 bin]$ sudo ./startServer.sh server1 
ADMU0116I: Tool information is being logged in file
           /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/server1/startServer.log
ADMU0128I: Starting tool with the AppSrv01 profile
ADMU3100I: Reading configuration for server: server1
ADMU3200I: Server launched. Waiting for initialization status.
ADMU3000I: Server server1 open for e-business; process id is 13397

After what seems like an eternity, your server will come up.

Step 8. Verify that the server is listening on port 9100:

[dkamenov@was01 ~]$ netstat -an | grep 9100
tcp        0      0 :::9100                     :::*                        LISTEN

Running JConsole
JConsole is the generic JMX console provided with the Java SDK. It is expected to work with any MBean server. On the other WebSphere’s MBean server exposes WebSphere-specific objects.  For this reason, we need to tweak the environment a little bit in order to make the WebSphere-specific classed known to JConsole. There are also some SSL-specific client and server keys (stored in a key store) that the JMX client needs to establish an SSL connection to the server. We will do all this (and more) with a simple shell script (be sure to change the PORT variable to match ORB_LISTENER_ADDRESS, and also to specify the correct IP address). After the script sets up the environment variables, it invokes the jconsole client bundled with the IBM JDK installed in the WebSphere directory:

#!/bin/bash

WAS_HOME=/opt/IBM/WebSphere/AppServer

# setup server-specific env variables
. $WAS_HOME/profiles/AppSrv01/bin/setupCmdLine.sh

#HOST=localhost
HOST=192.168.24.129 # Change this as needed
PORT=9100 

CLASSPATH=$JAVA_HOME/lib/jconsole.jar
CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.admin.client_8.5.0.jar
CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.ejb.thinclient_8.5.0.jar
CLASSPATH=$CLASSPATH:$WAS_HOME/runtimes/com.ibm.ws.orb_8.5.0.jar

$JAVA_HOME/bin/jconsole \
        -J-Djava.class.path=$CLASSPATH\
        -J$CLIENTSAS\
        -J$CLIENTSSL\
        service:jmx:iiop://$HOST:$PORT/jndi/JMXConnector

Once you run the script, JConsole should open and connect to the server. Enter your administrator credentials when prompted:

Feel free to explore the properties and administrative operations provided by the server:

In a future post, we will take things a step further by using the Monitis JMX monitor to gather metrics from WebSphere and upload them to your Monitis account. Until then, happy monitoring!