An idiot's guide to RMI/JMX remote connections - without SSL / authentication

From Red5Tutorials

1 What is JMX?
2 Why is JMX useful for Red5
3 Why remote monitoring?
4 What does Red5 provide
5 Getting started
6 Red5 setup and startup
7 Connecting with JConsole
8 Potential Pitfall

What is JMX?

http://en.wikipedia.org/wiki/JMX

Why is JMX useful for Red5

JMX lets you monitor aspects of server performance in realtime, such as memory usage, active threads, RAM allocation and so on. It also provides the means to access, and manipulate active objects within the Red5 server/application.

[edit]

Why remote monitoring?

a) Production servers are/should (probably) not be running X. Clients such as JConsole are graphical so monitoring from a remote machine with a graphics system is essential if you want to monitor such servers.

b) It is said that Clients such as JConsole place a significant load on the machine where they are run, potentially distorting results. For the least interference with your results, the client should be run remotely.

[edit]

What does Red5 provide

Red5 provides everything you need to connect a JMX Client, from the probes to the Connectors which your client program (probably JConsole) will connect to.

Note : You do *not* need to start a seperate rmiregistry. If Red5 sees that none is active, it will start its own.

[edit]

Getting started

The following description aims to help you setup a simple remote connection *without security*. Once you have accomplished this you should read the other tutorial here about JMX with SSH. Under no circumstances should you use JMX in a production environment without SSH, as anybody who knows the port number you are using for your JMX connections will be able to do horrible things to your servers.

Disclamer : This is based on one day of experience with JMX. Whilst not wrong, it's probably possible to do things in much simpler and more intelligent ways :) This is correct for 0.6 versions of Red5.

[edit]

Red5 setup and startup

You should be able to leave the configuration of Red5 as it is (rmi connector on port 9999).

To use JMX without security or authentication add the following arguments to the startup command in red5.sh or red5.bat :

-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=9999 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false

Here's a fuller example from a modified red5.sh : exec $JAVA -Djava.security.manager -Djava.security.policy=conf/red5.policy -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=9999 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -cp red5.jar:conf:$CLASSPATH org.red5.server.Standalone

[edit]

Connecting with JConsole

Start JConsole. It should now be possible to put [yourIP:9999] in it's remote Connection box in JConsole : e.g. 192.168.2.6:9999

[edit]

Potential Pitfall

If this does not work, try starting as "jconsole -debug". When you attempt a remote connection it will bring up a window giving you debug output.

It could well be that you see the following error message :

java.rmi.ConnectException: Connection refused to host: 127.0.0.1; nested exception is: java.net.ConnectException: Connection refused: connect ... ... ... etc.

[edit]

Cause

Why is it talking about 127.0.0.1 when you specified 192.168.2.6?

JMX resolves names in a messy and unreliable way : http://java.sun.com/j2se/1.4.2/docs/guide/rmi/faq.html#nethostname In a nutshell it's returning "localhost" (or possibly directly 127.0.0.1 - try "hostname -i" on your machine) to JConsole as the name of ther server so follow on calls resolve to the wrong machine.

[edit]

A Solution

Although this *should* work (put it in ...red5/conf/red5.properties) :

JMX

jmx.rmi.port.registry=9999 jmx.rmi.port.remoteobjects= jmx.rmi.host=0.0.0.0 jmx.rmi.ssl=false jmx.http=false jmx.http.port=8082

... it doesn't work for me (in the now ancient Red5 0.62).

What we can do, however, is to add some rmi specific properties : http://java.sun.com/j2se/1.4.2/docs/guide/rmi/javarmiproperties.html

e.g. the "-Djava.rmi.server.hostname=test.hostname.com " in exec $JAVA -Djava.security.manager -Djava.security.policy=conf/red5.policy -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=9999 -Djava.rmi.server.hostname=test.hostname.com -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -cp red5.jar:conf:$CLASSPATH org.red5.server.Standalone

This implies that your "test.hostname.com" must resolve to the server correctly. If it's a local virtual machine for instance, be sure that it's the "host" files on all machines concerned.

There must be cleaner, better ways to achieve this... ?

[edit]