> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# JMX

> Runtime metrics from Java apps that expose Java Management Extensions.

The JMX integration requires CXDOT Collector 1.4.0 or greater.

[Java](https://www.oracle.com/java/) is a widely used programming language and runtime
platform. Use the JMX CXDOT Collector integration to collect runtime metrics from Java
apps that expose Java Management Extensions (JMX) in your environment.

The JMX integration supports Java 8 or greater.

## Supported telemetry types

The JMX integration supports these telemetry types:

| Type | Supported |
| - | - |
| Logs | No |
| Metrics | Yes |
| Traces | No |
| Events | No |

## Prerequisites

The JMX integration has the following prerequisites:

* Enable remote monitoring through
  [Java Management Extensions (JMX)](https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html)
  when you start each Java app. Set the remote registry and Remote Method
  Invocation (RMI) connector to ports that the CXDOT collector can reach. It's
  recommended to use the same port for both connections and advertise a reachable
  host or IP address. For example, add these Java system properties:

  ```shell theme={null}
  -Dcom.sun.management.jmxremote
  -Dcom.sun.management.jmxremote.port=9012
  -Dcom.sun.management.jmxremote.rmi.port=9012
  -Djava.rmi.server.hostname=<reachable-host>
  ```

* Make the JMX registry and remote connector reachable from the CXDOT collector.

## Configure

The JMX integration is enabled by default. To configure the JMX integration, follow
these steps:

1. Choose how the CXDOT collector finds your Java apps:

   * For discovered targets, add autodiscovery annotations for JMX. Per-target
     credentials and non-default endpoints belong in those annotations.
   * For Java apps that the CXDOT collector doesn't discover, configure static targets
     as described in the next step.

   For more information, see
   [autodiscovery](https://docs-xcor.paloaltonetworks.com/ingest/xcor/collector/discover/kubernetes).

   Metrics from discovered pods arrive with that pod's Kubernetes metadata attached.

2. Optional: Configure static targets for Java apps outside your Kubernetes
   cluster. For example, add the following to the `values.yaml` for your Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       jmx:
         endpoints:
           - endpoint: java.example.com:9012
   ```

   When you configure static targets, this integration instance collects from exactly
   those targets instead of discovered targets.

3. Optional: Configure a second integration instance to collect from both discovered
   pods and static targets. For example, add the following to the `values.yaml` for
   your Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       jmx: {}
       jmx/external:
         endpoints:
           - endpoint: java.example.com:9012
   ```

   The `jmx/external` key defines a named instance for the static targets. The bare

   `jmx` key continues to use autodiscovery.

4. Optional: Configure the integration's authentication and Transport Layer Security
   (TLS) settings to match the remote JMX agent. Supply the username and password
   together. If a remote stub advertises an address that the CXDOT collector can't
   reach, override its advertised host or port in the integration configuration.

5. Optional: Disable the integration. For example, add the following to the
   `values.yaml` for your Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       jmx:
         enabled: false
   ```

### Validate

To validate the JMX integration, follow these steps:

1. In [Live Telemetry Analyzer](https://docs-xcor.paloaltonetworks.com/investigate/analyze/telemetry-analyzer),
   filter for
   `__name__=cxdot.integration.target.health` and
   `cxdot.integration.name=jmx`. Confirm that the metric reports `1` for each target.
   The `cxdot.integration.target`, `server.address`, and `server.port` attributes
   identify the target.

2. In [Metrics Explorer](https://docs-xcor.paloaltonetworks.com/investigate/querying/metrics/explorer),
   run the following query:

   ```text theme={null}
   count by ("server.address", "server.port") ({"jvm.thread.count", "cxdot.integration.name"="jmx"})
   ```

   Confirm that the query returns a nonzero value for each target.

## Configuration reference

Configure one JMX integration instance with the following settings. In Helm values, place these
settings under `config.integrations.jmx`. In a Collector configuration file, place them under
`cxdot.integrations.jmx`.

### Optional settings

* **`enabled`**
  Type: `boolean`. Optional. Default: `true`.
  Whether to run the JMX integration. If true, the Collector collects JMX metrics. If false, the
  Collector doesn't run this integration.

* **`endpoints`**
  Type: `array of object`. Optional. Default: `[]`.
  Static JMX targets. Each endpoint can be a `host:port` Remote Method Invocation (RMI) registry
  address or a `service:jmx:rmi` URL. When this list isn't empty, the integration collects from
  exactly these targets instead of discovered targets.

* **`endpoints[].endpoint`**
  Type: `string`. Required.
  JMX target as a `host:port` RMI registry address or a `service:jmx:rmi` URL.

* **`registry_tls`**
  Type: `boolean`. Optional. Default: `false`.
  Whether to use TLS for the RMI registry connection. If true, the Collector uses TLS. If false,
  it uses an unencrypted registry connection.

* **`advertised_host_override`**
  Type: `string`. Optional. Default: \`\`.
  Host to use instead of the host advertised by returned Remote Method Invocation (RMI) stubs.
  When empty, the integration uses the host from the endpoint.

* **`advertised_port_override`**
  Type: `integer`. Optional. Default: `0`. Minimum: `0`. Maximum: `65535`.
  Port to use instead of the port advertised by returned RMI stubs. A value of `0` uses the
  advertised port.

* **`username`**
  Type: `string`. Optional.
  JMX authentication username. Configure with password.

* **`password`**
  Type: `string`. Optional.
  JMX authentication password. Configure with username.

* **`collection_interval`**
  Type: `duration`. Optional. Default: `15s`.
  Time between metric collections from each JMX target.

* **`bean_detection_interval`**
  Type: `duration`. Optional. Default: `10m`.
  Time between JMX bean discovery refreshes.

* **`bean_limit`**
  Type: `integer`. Optional. Default: `35000`. Minimum: `1`.
  Maximum number of JMX bean matches collected from each endpoint. When the number of matches
  exceeds this value, the integration drops beans according to the attribute mapping priority.

* **`target_system`**
  Type: `string`. Optional. Default: `jvm`.
  Comma-delimited attribute mapping names. Names must start with a lowercase letter or digit and
  contain only lowercase letters, digits, underscores, and hyphens. The JVM mapping is included
  automatically; add -jvm to disable it when at least one other mapping is configured.

* **`attribute_mapping_paths`**
  Type: `array of string`. Optional. Default: `[]`.
  Directories and files searched before the built-in Java Virtual Machine (JVM) attribute
  mapping.

* **`tls`**
  Type: `object`. Optional. Default: `{}`.
  TLS certificate and client authentication settings for RMI registry and server connections.

* **`tls.ca_file`**
  Type: `string`. Optional.
  Path to the CA cert. For a client this verifies the server certificate. For a server this
  verifies client certificates. If empty uses system root CA. (optional)

* **`tls.ca_pem`**
  Type: `string`. Optional.
  In memory PEM encoded cert. (optional)

* **`tls.cert_file`**
  Type: `string`. Optional.
  Path to the TLS cert to use for TLS required connections. (optional)

* **`tls.cert_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS cert to use for TLS required connections. (optional)

* **`tls.cipher_suites`**
  Type: `array of string`. Optional.
  CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a
  safe default list is used. See
  [https://go.dev/src/crypto/tls/cipher\_suites.go](https://go.dev/src/crypto/tls/cipher_suites.go)
  for a list of supported cipher suites.

* **`tls.curve_preferences`**
  Type: `array of string`. Optional.
  contains the elliptic curves that will be used in an ECDHE handshake, in preference order
  Defaults to empty list and "crypto/tls" defaults are used, internally.

* **`tls.include_system_ca_certs_pool`**
  Type: `boolean`. Optional.
  If true, load system CA certificates pool in addition to the certificates configured in this
  struct.

* **`tls.insecure`**
  Type: `boolean`. Optional.
  Whether to disable transport security. This setting must be false. Use `registry_tls` to
  control transport security for the RMI registry.

* **`tls.insecure_skip_verify`**
  Type: `boolean`. Optional.
  Whether to skip verification of the JMX server certificate. If true, the connection is
  encrypted but isn't authenticated and is vulnerable to man-in-the-middle attacks. If false,
  the Collector verifies the certificate.

* **`tls.key_file`**
  Type: `string`. Optional.
  Path to the TLS key to use for TLS required connections. (optional)

* **`tls.key_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS key to use for TLS required connections. (optional)

* **`tls.max_version`**
  Type: `string`. Optional.
  MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls
  for defaults. (optional)

* **`tls.min_version`**
  Type: `string`. Optional.
  MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used.
  (optional)

* **`tls.reload_interval`**
  Type: `duration`. Optional.
  ReloadInterval specifies the duration after which the certificate will be reloaded If not set,
  it will never be reloaded (optional)

* **`tls.server_name_override`**
  Type: `string`. Optional.
  Server name to verify in the JMX certificate instead of the endpoint hostname. Use this
  setting when the certificate name differs from the endpoint hostname.

* **`tls.tpm`**
  Type: `object`. Optional.
  Trusted platform module configuration

* **`tls.tpm.auth`**
  Type: `string`. Optional.
  Authorization value for the trusted platform module key.

* **`tls.tpm.enabled`**
  Type: `boolean`. Optional.
  Whether to use a trusted platform module for the TLS private key. If true, the Collector loads
  the key from the configured device or socket. If false, the Collector uses the configured key
  file or in-memory key.

* **`tls.tpm.owner_auth`**
  Type: `string`. Optional.
  Owner authorization value for the trusted platform module.

* **`tls.tpm.path`**
  Type: `string`. Optional.
  The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.


## Related topics

- [Apache Tomcat](/ingest/xcor/integrations/collector/tomcat.md)
- [CXDOT Collector integrations](/ingest/xcor/integrations/collector.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.