Why does JMX connection to Amazon EC2 fail?

Question

I set up JMX on one of services running on Amazon EC2 instance but it doesn't work properly. I'm using VisualVM to connect and after short period of pending it fails with timeout. Looks like it fails because of missing response data or lags. I checked that JMX port is enabled in security group and also tried with different port with no JMX enabled and also with port not enabled in security group settings and both fails immediately, so it looks different. My EC2 instance and desktop both have Ubuntu 12.04 and JDK 7 installed.

It turns out ports don't make sense since connection is SSL secured. I have a private key and have no idea how to use it with JConsole or VisualVM.

Answer 1

JMX needs an RMI registry operating on an open port. By default the RMI registry port is chosen randomly at the startup time and it doesn't play well with firewalls. Since JDK7u4 you can use

-Dcom.sun.management.jmxremote.rmi.port=<port>

to set the RMI port to be used. Then you can enable that port in the security group.

Note the .rmi. part of the above setting because this usually gets confused with the com.sun.management.jmxremote.port setting. You should not!

Answer 2

This works for me. Set the JMX options on your server:

-Dcom.sun.management.jmxremote 
-Dcom.sun.management.jmxremote.port=<some port>
-Dcom.sun.management.jmxremote.ssl=false 
-Dcom.sun.management.jmxremote.authenticate=false 
-Djava.rmi.server.hostname=localhost

Open up an SSH tunnel:

ssh -i /path/to/key -D <some port> username@public_dns_address

Start VisualVM:

jvisualvm -J-Dnetbeans.system_socks_proxy=localhost:<some port> -J-Djava.net.useSystemProxies=true

Add a remote connection to the server. Add a JMX connection using the port you've specified for JMX.

To be clear, in all three cases above, should be the same port.