Nagios Support Forum

Posted: **Fri Dec 09, 2016 4:37 am**

Hi,

I am trying tu use a nagios plugin named check_jmx to monitor from a linux client a Jmx/tomcat server on e remote Windows server.
The difficulty here is that we must use SSL.
The JMX server listens on the 8443 port number

Version : Linux centos 7.2, with java 1.8 (From which I run the plugin). The Remote server windows version is 2012 R2.

Note :
- When I try to connect to JMX via the "Java Mission Control" (From windows server): It works well
- When I try to reun the check_jmx plugin while ssl and certificates athentication is disabled on the remote Windows server : It works well.

Thus... the jmxremote feature works well ..... But I still cannot connect when I want to use the ssl
I created a local trustore on my Linux server containing the certificate from the Windows server .....

In the check_jms script I tried to specify many different java options :

-Dcom.sun.management.jmxremote.ssl=True \
-Dcom.sun.management.jmxremote.ssl.need.client.auth=True \
-Dcom.sun.management.jmxremote.port=8443 \
-Dcom.sun.management.jmxremote.registry.ssl=True \
-Dcom.sun.management.jmxremote.password.file=/usr/local/nagios/etc/jmxremote.password \
-Dcom.sun.management.jmxremote.access.file=/usr/local/nagios/etc/jmxremote.access \
-Djavax.net.ssl.trustStore=/home/nagios/JMX/truststore.jks \
-Djavax.net.ssl.trustStorePassword=$my_passwd \
-Djavax.net.ssl.trustStoreType=jks \

Please note that these above options are given to the Plugin (java command line) from the Linux server: this is whet the check_jmx plugin do:
/bin/java -verbose -$OPTION_LIST -jar /usr/local/nagios/plugin/check_jmx.jar "$@" "
($OPTION_LIST is all the options I mentionned above.... initially there is no option on the original check_jmx : Only :/bin/java -jar $MY_PATH/check_jmx.jar "$@" )

The error I always get is :
JMX CRITICAL - Error opening connection: Failed to retrieve RMIServer stub: javax.naming.CommunicationException [Root exception is java.rmi.ConnectIOException: non-JRMP server at remote endpoint]

I investigated a lot on differents forums /website .... I changed the above settings in different manners .... But I always get the same error.
The most frustrating is that I have no more logs neither from the java on the Linux ... nor from the Windows server running the JMX.

Any help would be really appreciated ...

Thanks.

Posted: **Fri Dec 09, 2016 12:43 pm**

Looking over the client this plugin leverages (jmxquery.jar), I do not think SSL is possible in it's current state.

The way this client establishes the JMX connection is done like so:

Code: Select all

private JMXConnector connector;
private MBeanServerConnection connection;

...

JMXServiceURL jmxUrl = new JMXServiceURL(url);
connector = JMXConnectorFactory.connect(jmxUrl);
connection = connector.getMBeanServerConnection();

Based on this document from Oracle, it needs to be explicitly setting the RMI connection factory to use SSL:
https://blogs.oracle.com/lmalventosa/en ... ment_agent

Code: Select all

JMXServiceURL url = ...;
Map<String,Object> env = new HashMap<String,Object>();
env.put("com.sun.jndi.rmi.factory.socket", new SslRMIClientSocketFactory());
JMXConnector cc = JMXConnectorFactory.connect(url, env);
MBeanServerConnection mbsc = cc.getMBeanServerConnection();

I'll see what can be done about this, but I can't make any guarantees since this is a 3rd party plugin that is quite old (developed against JRE 1.5).

Posted: **Mon Dec 12, 2016 9:39 am**

Hi,

Thanks, I appreciate !

Anyway, if you have any ideau on hos I could connect to a JMX server from my nagios server : tha't woul be great. I couldn't find any other .jar for that (I mean supporting ssl).

A nice day ,

Posted: **Mon Dec 12, 2016 2:07 pm**

I would suggest checking out this thread where I made a few modifications to jmxquery.jar that allowed connections via SSL:
https://support.nagios.com/forum/viewtopic.php?t=41466

This post specifically provides some steps you may find useful:
https://support.nagios.com/forum/viewto ... 61#p205561

Posted: **Tue Dec 13, 2016 4:34 am**

Hi,

Thanks !

I tried your jmxquery.jar ..... but i know get a java error:

Exception in thread "main" java.lang.UnsupportedClassVersionError: JMXQuery : Unsupported major.minor version 52.0
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:634)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:277)
at java.net.URLClassLoader.access$000(URLClassLoader.java:73)
at java.net.URLClassLoader$1.run(URLClassLoader.java:212)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
at java.lang.ClassLoader.loadClass(ClassLoader.java:321)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
at java.lang.ClassLoader.loadClass(ClassLoader.java:266)
Could not find the main class: JMXQuery. Program will exit.

The java command that I run is :
jave ..... ALL THE OPTIONS ..... -cp $DIR/jmxquery.jar JMXQuery "$@"

I use the below version of java : Mybe it is too old ?:
java version "1.6.0_22"
OpenJDK Runtime Environment (IcedTea6 1.10.4) (suse-1.2-x86_64)
OpenJDK 64-Bit Server VM (build 20.0-b11, mixed mode)

Thanks again for your help,

Regards,

Posted: **Tue Dec 13, 2016 4:52 pm**

What version of Core are you running? It shouldn't matter, but in case we do end up getting it to work in the other thread, it may end up being useful information in figuring out how to get yours working.

Nagios Support Forum

Nagios plugin check_jmx cannot connect to JMX server

Nagios plugin check_jmx cannot connect to JMX server

Re: Nagios plugin check_jmx cannot connect to JMX server

Re: Nagios plugin check_jmx cannot connect to JMX server

Re: Nagios plugin check_jmx cannot connect to JMX server

Re: Nagios plugin check_jmx cannot connect to JMX server

Re: Nagios plugin check_jmx cannot connect to JMX server