Monitoring Jmx remotely without NRPE agent

[JakeHatMacys]

My jboss team has set up remote authentication we use for sitescope to remotely monitor jboss.

Thing is I don't want to use sitescope... i'd prefer to use Nagios!

I'm not sure what applies to the Nagios Jboss plugin and if I can get it rolling remotely. I've read some threads of people doing it. My management will not allow agent installation, our environment is too big and managing agents can be a chore and a half for us. Anyway:

Following https://assets.nagios.com/downloads/nag ... 1496691363

Is there a user guidline for using check_jmx without NRPE agent?

If not could anyone give any pointers into getting that set up???

[mcapra]

This documentation still applies:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf

You can do this totally without NRPE by using check_jmx from the Nagios XI machine. You'd just need to be sure whatever port+address your application binds to for it's JMX connections is open to the Nagios XI machine. You'd also need to be sure your Nagios XI machine can run the jar file (yum install java is typically sufficient).

Then you'd just run check_jmx from the Nagios XI machine against the remote JMX server:

Code: Select all

./check_jmx -U service:jmx:rmi:///jndi/rmi://<remote_host>:<remote_port>/jmxrmi -O java.lang:type=Memory
-A HeapMemoryUsage -K used -I HeapMemoryUsage -J used -vvvv -w 4248302272 -c 5498760192

This post has some examples I used against an application hosted under WebLogic:
https://support.nagios.com/forum/viewto ... 85#p220985

But the important thing to understand is JMX should be enabled on a per-application basis in the above cases. Some application servers will have configuration utilities to do this, others may require you to bake those system properties into your execution script. Totally depends on the flavor of app server. I don't have much experience with JBoss.

If you're using cert based authentication rather than credentials, this thread may be useful to you:
https://support.nagios.com/forum/viewto ... =6&t=41466

[JakeHatMacys]

This documentation still applies:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf

You can do this totally without NRPE by using check_jmx from the Nagios XI machine. You'd just need to be sure whatever port+address your application binds to for it's JMX connections is open to the Nagios XI machine. You'd also need to be sure your Nagios XI machine can run the jar file (yum install java is typically sufficient).

Then you'd just run check_jmx from the Nagios XI machine against the remote JMX server:

Code: Select all

./check_jmx -U service:jmx:rmi:///jndi/rmi://<remote_host>:<remote_port>/jmxrmi -O java.lang:type=Memory
-A HeapMemoryUsage -K used -I HeapMemoryUsage -J used -vvvv -w 4248302272 -c 5498760192

This post has some examples I used against an application hosted under WebLogic:
https://support.nagios.com/forum/viewto ... 85#p220985

But the important thing to understand is JMX should be enabled on a per-application basis in the above cases. Some application servers will have configuration utilities to do this, others may require you to bake those system properties into your execution script. Totally depends on the flavor of app server. I don't have much experience with JBoss.

If you're using cert based authentication rather than credentials, this thread may be useful to you:
https://support.nagios.com/forum/viewto ... =6&t=41466

Cool, so if I were to use this call:

./check_jmx -U service:jmx:rmi:///jndi/rmi://<remote_host>:<remote_port>/jmxrmi -O java.lang:type=Memory
-A HeapMemoryUsage -K used -I HeapMemoryUsage -J used -vvvv -w 4248302272 -c 5498760192

How would I bake in the username & PW used on xyz controller port set up by my admins??? What I mean by that is i'd use port 100099 lets say for the port in the remote call but they have a username & PW set on that. I'm just not sure what that'd look like in the CLI and wasn't sure if it was supported. But that's great it is!

[mcapra]

I don't believe it's something you can pass in-line to the actual jmxquery.jar executable (via check_jmx), but you can set it in the Java system properties at run-time. I think the check_jmx wrapper script would need to be modified to set the following system properties as part of it's execution of jmxquery.jar:

Code: Select all

-Dcom.sun.management.jmxremote.password.file=/path/to/password/file

I recall vaguely doing something similar in a ticket a while ago. Perhaps one of the techs can dig it up *if it exists* and check my work.

[tgriep]

If your server requires a user name and password, I did find a plugin you could try that allows you to authenticate.
Take a look at this link for more information.
https://snippets.syabru.ch/nagios-jmx-plugin/usage.html

[JakeHatMacys]

If your server requires a user name and password, I did find a plugin you could try that allows you to authenticate.
Take a look at this link for more information.
https://snippets.syabru.ch/nagios-jmx-plugin/usage.html

That looks like the golden ticket. I'll load it up and give it a whirl...

Thanks!

[dwhitfield]

Ok, great! Let us know how it goes.

[JakeHatMacys]

Ok, great! Let us know how it goes.

Well I might be hardheaded but i'm not seeing an install doc or real instructions... just throw two files in libexec and execute. Which isn't working off the bat.

Our systems might have a different reference point as i'm getting the following error:

-bash: ./check_jmx: /bin/sh^M: bad interpreter: No such file or directory.

Do I need to add a jar file to my Nagios install?

I had to add a jboss-cli-client.jar to my sitescope install to get that guy up and going.

[mcapra]

-bash: ./check_jmx: /bin/sh^M: bad interpreter: No such file or directory

You may need to run the check_jmx script through dos2unix. Typically a rogue ^M means that Windows is doing things that Linux doesn't like in terms of text encoding. This typically happens when you copy+paste text/files between a Windows and Linux machine. You should be able to yum install dos2unix on the Nagios XI machine.

[JakeHatMacys]

Yep, and it looks like that plugin doesn't support my jboss teams remote protocol which is just:

service:jmx:remoting-jmx://host:port etc...

That and since it hasn't been updated since 2011 probably not the greatest idea to lean on it for my companies solution.

If we were to look back to your official NRPE solution but not using the agent would I be able to get a Nagios support tech on a webex with myself and a Unix admin (I don't have root) to hash out what we'd need to set up remote JMX using the NRPE plugin???