Java Mission Controller, Flight Recorder - Access denied

Question

Dear Ivy Team

Doing some performance analysis since our app is using a lot of CPU. I've activated

JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.port=9003 -Dcom.sun.management.jmxremote.login.config=jmx -Djava.security.auth.login.config=configuration/jaas.config -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.autodiscovery=true"

JAVA_OPTS="$JAVA_OPTS -Djava.rmi.server.hostname=<ip>"

When I connect with Java Mission Controller to Ivy 7 I get the following results :

Start JMX Console : works
Start Flight Recorder : Access denied! Invalid access level for requested MBeanServer operation.

java.lang.RuntimeException: Access denied! Invalid access level for requested MBeanServer operation. at com.jrockit.mc.flightrecorder.controlpanel.ui.FlightRecorderProvider.refresh(FlightRecorderProvider.java:110) at com.jrockit.mc.browser.views.JVMBrowserView$1.run(JVMBrowserView.java:100) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) at Caused by: java.lang.SecurityException: Access property for this identity should be similar to: readwrite create com.sun.management.MissionControl at ....

According to https://community.oracle.com/thread/2588377 :

You need to ensure that the user you want to access the flight recorder has permission to create the relevant MBeans. You have probably defined the roles in the jmxremote.access file. Try adding:

<your-role-name-goes-here> readwrite \ create com.sun.management.,com.oracle.jrockit. \ unregister

=> where can I change this for Ivy ?

Thanks & Regards John

Accepted Answer

0

Follow this guide to login with your ivy admin user.: https://developer.axonivy.com/doc/7.0.14/EngineGuideHtml/monitoring.html#monitoring-jmx

link

answered 24.01.2020 at 08:12

Alex Suter ♦♦
3.1k●12●22●47
accept rate: 84%

visualvm 1.4.4 (latest) contains stacktraces re hot methods.

(31.01.2020 at 12:46) John Moser

Maybe need to define -Dcom.sun.management.jmxremote.port=9003 -Dcom.sun.management.jmxremote.rmi.port=9003

(03.02.2020 at 05:16) Alex Suter ♦♦

with visualvm 1.4.4 it's ok

(03.02.2020 at 06:32) John Moser

Accepted Answer

Hi John

You are right if you want to access JFR from Java Mission Control on a remote machine then you have to enable this in the jmxremote.access file as follows:

Change from:

monitorRole   readonly
controlRole   readwrite \
              create javax.management.monitor.*,javax.management.timer.* \
              unregister

to:

monitorRole   readonly
controlRole   readwrite \
              create javax.management.monitor.*,javax.management.timer.*,com.sun.management.*,com.oracle.jrockit.* \
              unregister

as described in the articel https://community.oracle.com/thread/2588377

The file can be found here:

Windows:

Axon.ivy Engine < 7.4: {engine installation dir}/jre/lib/management/jmxremote.access

Axon.ivy Engine >= 7.4: {engine installation dir}/jre/conf/management/jmxremote.access

Linux:

Axon.ivy Engine < 7.4: {java installation dir}/jre/lib/management/jmxremote.access

Axon.ivy Engine >= 7.4: {java installation dir}/conf/management/jmxremote.access

Java Mission Controller, Flight Recorder - Access denied

Follow this question

Related questions