JMX

The JMX integration requires CXDOT Collector 1.4.0 or greater. Java is a widely used programming language and runtime platform. Use the JMX CXDOT Collector integration to collect runtime metrics from Java apps that expose Java Management Extensions (JMX) in your environment. The JMX integration supports Java 8 or greater.

​

Supported telemetry types

The JMX integration supports these telemetry types:

​

Prerequisites

The JMX integration has the following prerequisites:

• Enable remote monitoring through Java Management Extensions (JMX) when you start each Java app. Set the remote registry and Remote Method Invocation (RMI) connector to ports that the CXDOT collector can reach. It’s recommended to use the same port for both connections and advertise a reachable host or IP address. For example, add these Java system properties:
  -Dcom.sun.management.jmxremote
  -Dcom.sun.management.jmxremote.port=9012
  -Dcom.sun.management.jmxremote.rmi.port=9012
  -Djava.rmi.server.hostname=<reachable-host>
  
• Make the JMX registry and remote connector reachable from the CXDOT collector.

​

Configure

The JMX integration is enabled by default. To configure the JMX integration, follow these steps:

1. Choose how the CXDOT collector finds your Java apps:
   • For discovered targets, add autodiscovery annotations for JMX. Per-target credentials and non-default endpoints belong in those annotations.
   • For Java apps that the CXDOT collector doesn’t discover, configure static targets as described in the next step.
   For more information, see autodiscovery. Metrics from discovered pods arrive with that pod’s Kubernetes metadata attached. For more information, see enrichment.
2. Optional: Configure static targets for Java apps outside your Kubernetes cluster. For example, add the following to the values.yaml for your Helm chart:
   config:
     integrations:
       jmx:
         endpoints:
           - endpoint: java.example.com:9012
   
   When you configure static targets, this integration instance collects from exactly those targets instead of discovered targets.
3. Optional: Configure a second integration instance to collect from both discovered pods and static targets. For example, add the following to the values.yaml for your Helm chart:
   config:
     integrations:
       jmx: {}
       jmx/external:
         endpoints:
           - endpoint: java.example.com:9012
   
   The jmx/external key defines a named instance for the static targets. The bare jmx key continues to use autodiscovery.
4. Optional: Configure the integration’s authentication and Transport Layer Security (TLS) settings to match the remote JMX agent. Supply the username and password together. If a remote stub advertises an address that the CXDOT collector can’t reach, override its advertised host or port in the integration configuration.
5. Optional: Disable the integration. For example, add the following to the values.yaml for your Helm chart:
   config:
     integrations:
       jmx:
         enabled: false
   

​

Validate

To validate the JMX integration, follow these steps:

1. In Live Telemetry Analyzer, filter for __name__=cxdot.integration.target.health and cxdot.integration.name=jmx. Confirm that the metric reports 1 for each target. The cxdot.integration.target, server.address, and server.port attributes identify the target.
2. In Metrics Explorer, run the following query:
   count by ("server.address", "server.port") ({"jvm.thread.count", "cxdot.integration.name"="jmx"})
   
   Confirm that the query returns a nonzero value for each target.

For more information about diagnosing a failing integration, see Troubleshooting.

​

Configuration reference

Configure one JMX integration instance with the following settings. In Helm values, place these settings under config.integrations.jmx. In a Collector configuration file, place them under cxdot.integrations.jmx.

​

Optional settings

• enabled Type: boolean. Optional. Default: true. Whether to run the JMX integration. If true, the Collector collects JMX metrics. If false, the Collector doesn’t run this integration.
• endpoints Type: array of object. Optional. Default: []. Static JMX targets. Each endpoint can be a host:port Remote Method Invocation (RMI) registry address or a service:jmx:rmi URL. When this list isn’t empty, the integration collects from exactly these targets instead of discovered targets.
• endpoints[].endpoint Type: string. Required. JMX target as a host:port RMI registry address or a service:jmx:rmi URL.
• registry_tls Type: boolean. Optional. Default: false. Whether to use TLS for the RMI registry connection. If true, the Collector uses TLS. If false, it uses an unencrypted registry connection.
• advertised_host_override Type: string. Optional. Default: “. Host to use instead of the host advertised by returned Remote Method Invocation (RMI) stubs. When empty, the integration uses the host from the endpoint.
• advertised_port_override Type: integer. Optional. Default: 0. Minimum: 0. Maximum: 65535. Port to use instead of the port advertised by returned RMI stubs. A value of 0 uses the advertised port.
• username Type: string. Optional. JMX authentication username. Configure with password.
• password Type: string. Optional. JMX authentication password. Configure with username.
• collection_interval Type: duration. Optional. Default: 15s. Time between metric collections from each JMX target.
• bean_detection_interval Type: duration. Optional. Default: 10m. Time between JMX bean discovery refreshes.
• bean_limit Type: integer. Optional. Default: 35000. Minimum: 1. Maximum number of JMX bean matches collected from each endpoint. When the number of matches exceeds this value, the integration drops beans according to the attribute mapping priority.
• target_system Type: string. Optional. Default: jvm. Comma-delimited attribute mapping names. Names must start with a lowercase letter or digit and contain only lowercase letters, digits, underscores, and hyphens. The JVM mapping is included automatically; add -jvm to disable it when at least one other mapping is configured.
• attribute_mapping_paths Type: array of string. Optional. Default: []. Directories and files searched before the built-in Java Virtual Machine (JVM) attribute mapping.
• tls Type: object. Optional. Default: {}. TLS certificate and client authentication settings for RMI registry and server connections.
• tls.ca_file Type: string. Optional. Path to the CA cert. For a client this verifies the server certificate. For a server this verifies client certificates. If empty uses system root CA. (optional)
• tls.ca_pem Type: string. Optional. In memory PEM encoded cert. (optional)
• tls.cert_file Type: string. Optional. Path to the TLS cert to use for TLS required connections. (optional)
• tls.cert_pem Type: string. Optional. In memory PEM encoded TLS cert to use for TLS required connections. (optional)
• tls.cipher_suites Type: array of string. Optional. CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a safe default list is used. See https://go.dev/src/crypto/tls/cipher_suites.go for a list of supported cipher suites.
• tls.curve_preferences Type: array of string. Optional. contains the elliptic curves that will be used in an ECDHE handshake, in preference order Defaults to empty list and “crypto/tls” defaults are used, internally.
• tls.include_system_ca_certs_pool Type: boolean. Optional. If true, load system CA certificates pool in addition to the certificates configured in this struct.
• tls.insecure Type: boolean. Optional. Whether to disable transport security. This setting must be false. Use registry_tls to control transport security for the RMI registry.
• tls.insecure_skip_verify Type: boolean. Optional. Whether to skip verification of the JMX server certificate. If true, the connection is encrypted but isn’t authenticated and is vulnerable to man-in-the-middle attacks. If false, the Collector verifies the certificate.
• tls.key_file Type: string. Optional. Path to the TLS key to use for TLS required connections. (optional)
• tls.key_pem Type: string. Optional. In memory PEM encoded TLS key to use for TLS required connections. (optional)
• tls.max_version Type: string. Optional. MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls for defaults. (optional)
• tls.min_version Type: string. Optional. MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used. (optional)
• tls.reload_interval Type: duration. Optional. ReloadInterval specifies the duration after which the certificate will be reloaded If not set, it will never be reloaded (optional)
• tls.server_name_override Type: string. Optional. Server name to verify in the JMX certificate instead of the endpoint hostname. Use this setting when the certificate name differs from the endpoint hostname.
• tls.tpm Type: object. Optional. Trusted platform module configuration
• tls.tpm.auth Type: string. Optional. Authorization value for the trusted platform module key.
• tls.tpm.enabled Type: boolean. Optional. Whether to use a trusted platform module for the TLS private key. If true, the Collector loads the key from the configured device or socket. If false, the Collector uses the configured key file or in-memory key.
• tls.tpm.owner_auth Type: string. Optional. Owner authorization value for the trusted platform module.
• tls.tpm.path Type: string. Optional. The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.