1. Java Management Extensions (JMX) Technology

2. Enabling the default JMX agent

3. Connecting to the JMX agent

4. Monitoring the CPU utilization of a Java process and its threads

5. Monitoring the heap memory of a Java process

6. Firewall considerations

1. Java Management Extestions (JMX) Technology

JMX provides tools for managing and monitoring Java-based applications. JMX can be used, but is not limited to monitoring the CPU usage of the Java threads as well as the Heap and Non-Heap Memory Usage of a particular Java process. The data that can be collected with JMX can be used for performance and resource optimization and also for detecting memory leaks or potential causes of an increased CPU usage.

2. Enabling the default JMX agent

JMX is disabled by default for all ST services as it is not used for the day-to-day server operations. Because it is also a tool for management of Java processes, enabling it without the required security precautions is a security risk. When enabling the JMX agent on a specific port you need to consider that only one or a few secure hosts have direct access to the JMX agent listening port of the ST service for which you enable the JMX agent.

To enable the default JMX agent for your service add the following lines to the startup options:

com.sun.management.jmxremote.authenticate=false
com.sun.management.jmxremote.ssl=false
com.sun.management.jmxremote.port=portNum

Example: If you want to enable the default JMX agent for the TM process, you need to add the following lines to the start_tm (ST versions up to 5.1) or start_tm_console (ST 5.2 and later) script located in the <FILEDRIVEHOME>/bin folder. Under the last line that starts with JAVA_OPTS add:

JAVA_OPTS="-Dcom.sun.management.jmxremote.port=5000 $JAVA_OPTS"
JAVA_OPTS="-Dcom.sun.management.jmxremote.ssl=false $JAVA_OPTS"
JAVA_OPTS="-Dcom.sun.management.jmxremote.authenticate=false $JAVA_OPTS"

Note that the above options are a good starting point and in most cases will be enough to enable the default JMX agent, however, you want to add encryption and authentication for example. In that case you may refer to Oracle documentation for complete list of options:
http://docs.oracle.com/javase/7/docs/technotes/gui...

3. Connecting to the JMX agent

Connections to the JMX agent are initiated from JMX Console, e.g. ‘jconsole’ supplied with the JDK installed. The connections are made over a Remote Method Invocation (RMI) interface from the JMX console client to the RMI Registry port on which the JMX agent is listening. The JMX agent then send instructions back to the client on which host name and port number to connect to start receiving JMX RMI connection objects and data.
By default the host name and the port number for the JMX RMI connection object and data returned to the client are the local IP address of the server and a random high port. This specific can cause connection issues in multi-homed servers and Firewall as shown in section 6. "Firewall considerations".

The JConsole is part of the JDK package distributed but Oracle Corporation. As a general recommendation the JDK version to download should match the version of the Java that comes with ST. The JDK is to be installed on the client workstation from which the JMX connections are to be made.

To check the current version of the Java used by ST logon to the ST Server or ST Edge Operating System and from a command line terminal navigate to the <FILEDRIVEHOME>/jre/bin. Then for:

*NIX platforms run: ./java -version
Windows OS run: java.exe -version

After installing the JDK on your workstation:
1. Navigate to the directory where you have installed it
2. Run the jconsole.exe located under the 'bin' folder.
3. Check the "Remote Process" radio button
4. Enter the IP address and the JMX port of the ST service. Separate them with the ':' sign.
5. Select "Connect".

4. Monitoring the heap memory of a Java process

One of the JConsole's most useful features is the 'Memory' tab that allows you to monitor the memory allocation by the Java process. This can serve dual purpose - fine tuning the Java Heap Space to improve performance and help prevent "Out of Memory" conditions and inspect for potential memory leaks.

The "Memory" tab of JConsole looks like this.

5. Monitoring CPU utilization of a Java process and its threads

The JConsole can also be used to inspect the CPU utilization by the different Java threads that "live" within the Java process of the corresponding ST Service - TM, ADMIND, FTPD, etc.

To enable the inspection of the separate Java threads, you can download the attached topthreads-1.1.jar file and place in under the installation folder of the JDK on your workstation under the lib folder. To run the JConsole with the TopThreads plugin enabled:

1. Open Windows Command Prompt
2. Navigate to the 'lib' folder under the JDK installation folder.
3. Run: jconsole.jar -pluginpath topthreads-1.1.jar
4. Enter the IP address and the JMX port of the ST service and separate them with the ':' sign.
5. Select "Connect".

The "Top threads" tab is now available. It shows the overall % CPU usage by all threads, the percent of CPU used by each thread separately and the threads stack.

The "Top threads" tab of JConsole looks like this.

6. Firewall considerations

When there is a Firewall between the connecting JMX client and the ST service on which JMX listener is enabled the connections sometimes can prove to be a challenging. This is mainly due to the fact that apart from the listening port specified in the default JMX agent configuration, there is another random port that is used for the actual RMI transfer objects.
To overcome this and "anchor" the random port and the RMI register port to be the same, the attached "dist.agent.jar" can be used.

To use it, it needs to be placed in the <FILEDRIVEHOME>/lib/jars folder. Then in the corresponding startup script the below option needs to be added:

JAVA_OPTS="-Daxway.rmi.agent.port=5000 -javaagent:<FILEDRIVEHOME>/lib/jars/dist.agent.jar $JAVA_OPTS"

<FILEDRIVEHOME> in the command above needs to be replaced with the full path to the ST installation folder. E.g. if <FILEDRIVEHOME>=/opt/axway/SecureTransport the above command will be

JAVA_OPTS="-Daxway.rmi.agent.port=5000 -javaagent:/opt/axway/SecureTransport/lib/jars/dist.agent.jar $JAVA_OPTS"

If there are already options to enable the default JMX agent as specified in section 2, they need to be disabled and the service restarted.

When the ST server has more than one IP address the JMX agent may not bind to the desired network interface and IP address. To bind the JMX listener to the desired IP address the following configuration Java option can be used.

java.rmi.server.hostname="<server_IP_address>"