Graylog JMX Input Plugin

Graylog input plugin to monitor JMX end points with built-in support for JVM and Tomcat endpoints

Features

No agent required in the machines to be monitored
Support for Authentication
Support for SSL
Built-in support for monitoring JVM and Tomcat servers (more to come)
Monitor multiple servers from single input plugin instance
Support for monitoring custom JMX endpoints
Tested with Graylog 2.0.0

Setup

Download the plugin jar and copy to graylog plugin directory (restart the graylog server for the changes to take effect). From Graylog UI, launch System->Input and select "JMX" input type

Following parameters can be configured

Servers to monitor - Comma separated value of list of server IP Address or names to be monitored e.g. (10.220.5.123,webserver )
Port - Port on which the JMX endpoint is listening ( firewall should be configured for bidirectional access to this port)
JMX Object type - List of built-in JMX Object Types available. Select 'Custom' for monitoring custom endpoints.
In this case the json config file path has to be specified in 'Config File Path' parameter
Username - Username configured in JMX access file (applicable when JMX authentication is enabled)
Password - Password configured in JMX password file (applicable when JMX authentication is enabled)
Polling Interval - Interval to poll JMX endpoints (recommend to set the interval > 30 secs)
Polling Interval time unit - Polling interval time unit

To enable JMX monitoring in your Java application you need to pass certain command options to the application. e.g. To enable bare minimum JMX monitoring without security:

java \
-Dcom.sun.management.jmxremote \
-Dcom.sun.management.jmxremote.port=12345 \
-Dcom.sun.management.jmxremote.authenticate=false \
-Dcom.sun.management.jmxremote.ssl=false \
-jar /usr/share/doc/openjdk-6-jre-headless/demo/jfc/Notepad/Notepad.jar

For more info on authentication and options refer http://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html

Custom Configuration

To monitor custom JMX object types ( and to extend existing JMX type), a custom config file can be writtern and specified while launching the plugin. Example config file

{
  "type": "jvm", /* Type of the endpoint */
  "queries": [
    {
      "object": "java.lang:type=Memory", /* JMX ObjectName */
      "attributes": [
        {
          "name": "HeapMemoryUsage", /* JMX MBean Attribute Name */
          "key": "used", /* JMX Attribute Key if applicable */
          "label": "jvm.mem.heap.used" /* Maps to a field in the graylog message. Allowed characters are A-Z,a-z,0-9,.,_ */ 
        }
      ]
    },
    {
      "object": "java.lang:type=GarbageCollector,name=*",
      "attributes": [
        {
          "name": "CollectionCount",
          "label": "jvm.gc.{name}.count" /* Support for dynamic field names based on object name property values */
        }
      ]
    }
  ]
}

This plugin uses the JMX Query code from JMXTrans project

Enabling SSL

To enable SSL generate keystore and truststore using keytool. Refer to following like for detailed steps. https://pubs.vmware.com/continuent/tungsten-replicator-3.0/deployment-ssl-stores.html
Start the application to be monitored using following command line arguments:

java -Dcom.sun.management.jmxremote.port=1234
    -Djavax.net.ssl.keyStore=/home/user/Documents/keystore.jks
    -Djavax.net.ssl.keyStorePassword=keystorepass
    -Djavax.net.ssl.trustStore=/home/user/Documents/truststore.ts
    -Djavax.net.ssl.trustStorePassword=truststorepass
    -Dcom.sun.management.jmxremote.registry.ssl=true
    -Dcom.sun.management.jmxremote.authenticate=false
    MainClass

Configure Truststore path and password in Graylog plugin configuration window.
If you are using self-signed or untrusted certificates, remember to add them to trusted certificates in JRE lib/security
For more info refer to https://www.mkyong.com/webservices/jax-ws/suncertpathbuilderexception-unable-to-find-valid-certification-path-to-requested-target/