Using SSH tunneling with JMX for Alfresco

JMX is a great tool to monitor a Java application like Alfresco, but it can be tricky to configure, especially if you are not on the same internal network as your server and you have to pass through a firewall. Usually, this is what happens when you deploy your application in the cloud : you have only a SSH connection to admin your server. In that case, SSH tunneling is a good solution to access the JMX server. You can connect to your Alfresco JMX server from 2 different URL's:

• service:jmx:rmi:///jndi/rmi://localhost:50500/jmxrmi : this is the standard Java JMX URL
• service:jmx:rmi:///jndi/rmi://localhost:50500/alfresco/jmxrmi : this is the JMX Alfresco URL

Both URL's give access to the same services; you just don’t customize them the same way. JMX communications use the RMI protocol, which connects through 2 connections. The first one is to the RMI registry that pushes your request to the JMX server which is dynamically allocated, by default. Dynamic ports don’t give us the consistency we need so we will want to configure Alfresco to use a static port. Also, the second (server) connection requires you to set the hostname to connect. The latter is the local client that initiates communication with the JMX server. Here are the different steps:

• set a static port for the second (server) RMI connection
• set the hostname for the second (server) RMI connection
• creates a tunnel for the first (registry) connection
• creates a tunnel for the second (server) connection

On the server:

• We need to add the property monitor.rmi.services.port=50510 to alfresco-global.properties, in order to set the static port for the RMI server connection
• We need to modify alfresco.sh to set the hostname by adding -Djava.rmi.server.hostname=jmxhost to the JAVA_OPTS.

On the client:

• We need to add 127.0.0.1 jmxhost to /etc/hosts
• Then we can create the 2 ssh tunnels for the RMI registry and server connections:
ssh -f user@theserver.com -L 2000:localhost:50500 -N ssh -f user@theserver.com -L jmxhost:50510:localhost:50510 -N

Finally, we can connect by using jconsole (or any other JMX client) to the following URL: service:jmx:rmi:///jndi/rmi://localhost:2000/alfresco/jmxrmi NB: Here, we connected through the Alfresco JMX URL. Note that we can connect through the standard Java URL, as well. Since Java 7 update 4, a new Java property can be used to set a static port for the server RMI connection : com.sun.management.jmxremote.rmi.port. As the next Alfresco 4.2 will support Java 1.7, it will become an option.