VisualVM over ssh

Question

I've read Visual VM remotely over ssh but I think I've not fully understood because it was not working for me :-( Please can someone give some example?

ssh -D 9696 [email protected] and visualvm.exe -J-Dnetbeans.system_socks_proxy=localhost:9696 -J-Djava.net.useSystemProxies=true starts visualvm, but no processes of external machine are shown (only the local ones like visualvm itself). Moreover sometimes (but not always) I got the message "channel 3: open failed: connect failed: Connection refused" in my ssh window.

Any help?

Tunnell

Don't you have to connect to the remote host from VisualVM? I don't have a machine right now to test, but you only created a socks proxy, you still have to do something with it. – Natishanative

Thanks for your comment - I've tried several 'variations', but none of them was working. – Tunnell

As of 2015 you can tunnel both jmx and rmi ports see my answer – Plasmosome

Answer 1

You either need to run jstatd on the remote side, or specify a JMX connection using host:port.

Jstatd:

jstatd -J-Djava.security.policy=permissions.txt [-p port]

After that: add a remote connection to the target machine, and on the properties of that remote connection configure the jstatd connection.

(permissions.txt contains for example this:

grant {
  permission java.security.AllPermission;
};

Edit: (Answer to comment)

1. ssh -D 9696 me@remote, and run jstatd as above on the remote command line. If you want jstatd to be on a different port than the default 1099, use the -p argument to jstatd.

2. run visualvm.exe -J-Dnetbeans.system_socks_proxy=localhost:9696 -J-Djava.net.useSystemProxies=true on the local machine

3. in visual vm: add new remote connection, and specify remote as host and the port for jstatd (1099 for default, or what you specified with -p when running jstatd)

   You should now see the processes on the remote side in visualvm

Limbo

I'm sorry, but I don't get it. I'm able to start the jstatd line on the remote side, but do I have to go there with "ssh -D 9696 me@remote" or is "ssh me@remote" sufficient? I still need the proxy stuff for visualvm - and so on. It's embarrassing but I think I need a step by step guide. – Tunnell

1) ssh -D 9696 me@remote, and run jstatd as above on the remote command line. If you want jstatd to be on a different port than the default 1099, use the -p argument to jstatd. 2) run visualvm.exe -J-Dnetbeans.system_socks_proxy=localhost:9696 -J-Djava.net.useSystemProxies=true on the local machine 3) in visual vm: add new remote connection, and specify remote as host and the port for jstatd (1099 for default, or what you specified with -p when running jstatd) You should now see the processes on the remote side in visualvm – Limbo

I tried this but no luck. What exactly do you put as the remote host? Usually you'd want 'localhost' (with respect to the proxy server), but VisualVM complains that Local is already being monitored. I tried the internal and external IPs of the destination host, but I don't see any processes. – Reorganize

@Yang worked for me with the internal IP of the destination host – Morocco

Answer 2

I have another solution using standard SSH tunneling and no firewall ports to open. For me, SOCKS proxy does not work.

Start your JVM with options:
-Dcom.sun.management.jmxremote=true
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false
-Dcom.sun.management.jmxremote.port=[port1]
-Djava.rmi.server.hostname=localhost
-Dcom.sun.management.jmxremote.rmi.port=[port2]

The important part is "rmi.server.hostname=localhost". Additionally, you explicitly define both ports (connect + "random" RMI port), "jmxremote.rmi.port" needs at least Java 7 update 4 (I read somewhere, did not check this info - use "lsof -i" or "netstat -at --numeric-ports" on your server machine to check the really used ports).
port1 and port2 can be the same and reduces ssh tunneling config.

(Of course, you may use authentication or SSL, depending on your security requirements.)

Connect via ssh to the server and forward your local port1 and port2 to localhost:port1|2 an the server. Important: port2 must be forwarded to the same port number on your local machine. (Reason: After connecting via port1 the JVM tells the JMX client the number port2 and the client connects to this port on the same host - i.e. localhost.)

In VisualVM open a JMX connection to localhost:port1 (without any proxy setting).

Traditional

Great info... this solved it for me using SSH tunnelling. The key was the 2 ports having to be configured and forwarded. – Transducer

FYI port1 can be equal to port2 so you can use only one port – Plasmosome

ssh -L <local_port_1>:<ip_target_jvm_is_running>:<remote_port_1> -L <local_port_2>:<ip_target_jvm_is_running>:<remote_port_2> localhost is this the corresponding part to Connect via ssh to the server and forward your local port1 and port2 to localhost:port1|2 an the server. ? – Blah

Answer 3

I was having the same issue while connecting jVisualVM to a remote application over ssh.

This Tutorial helped me solve my issue. http://issamben.com/how-to-monitor-remote-jvm-over-ssh/

To solve this issue make sure :

• you set two port in the jvm configuration

   -Dcom.sun.management.jmxremote.ssl=false 
   -Dcom.sun.management.jmxremote.authenticate=false 
   -Dcom.sun.management.jmxremote.port=9010
   -Dcom.sun.management.jmxremote.rmi.port=9011
   -Djava.rmi.server.hostname=localhost
   -Dcom.sun.management.jmxremote.local.only=false
  

• ssh tunnel is properly established

   ssh -i yourPermissionFile.pem -l username 101.101.101.101 -L 9010:localhost:9010 -L 9011:localhost:9011
  

Fattal

Answer 4

I had the issue of jstatd binding on localhost, so i had to type

jstatd -J-Djava.security.policy=allPerm.policy -J-Djava.rmi.server.logCalls=true -p <port> -J-Djava.rmi.server.hostname=<my ip>

also for jvisualvm i use this parameters instead

jvisualvm -J-DsocksProxyHost=localhost -J-DsocksProxyPort=<socks-port>

this way, connecting by the ssh proxy, i could use the real ip address of my remote machine.

Stealing from this answer i made myself a full reminder on my site .. i hope you don't mind ankon Thanks for this by the way :)

Curvature

Set proxy in the UI doesn't work for me, specify it on the command line works. Thanks. BTW, I'm using version 1.8.0_25 (Build 140407) – Opec

Defining SOCKS proxy in visualvm GUI didn't worked for me. These CLI args worked fine, though. – Tonitonia

Answer 5

I also found that the jvm arguments:

-J-Dnetbeans.system_socks_proxy=localhost:9696 -J-Djava.net.useSystemProxies=true

did not work on the build i am using 1.3.2.

Therefore I used the Tools > Options > Network and set it manually under the SOCKS settings.

BUT VisualVM did did still not find the remote processes. I then removed the "No proxy hosts" listening of localhost, since this probably blocked it.

User

I also had to open the local properties and add a jstat configuration port 1099 (or whatever port you chose for jstatd) – Flinty

Answer 6

I found that in the jvm arguments for the proxy do not work. At least in version 1.3.3 (build 111013). Setting the proxy in Tools > Options > Network worked for me. Also system wide proxy settings should work though by definition it affects all other network connections.

Anglaangle

Answer 7

I know this question is old but i suggest the easier solution instead of using jstat.

just only use SSH and Jvisualvm

1. ssh with sockproxy (ex ssh -D 6666 [email protected] )
2. run jvisualvm with sock ( jvisualvm.exe -J-DsocksProxyHost=localhost -J-DsocksProxyPort=6666 )
3. add JXM host (ex : 234.234.234.234:16000 )

Use jvisualvm easy way to detect memory leak and monitor CPU, RAM of application

Photometry

Answer 8

Try a different version of jvisualvm (e.g. the newest from https://visualvm.github.io/download.html)

I couldn't make it work with jvisualvm, as it didn't use the SOCKS proxy (I didn't see anything related to jvisualvm in ssh -v -D 9696). Remote applications never appeared in jvisualvm. VisualVM however showed them after some seconds.

Snook

Answer 9

Google Cloud gcloud that works for me:

• Create a SOCKS tunnel with putty/ssh (putty connection > ssh > tunnel > dynamic source port 61099 for ssh -D61099)
• Java options (!remove all the other advice you have taken):

-Dcom.sun.management.jmxremote
-Dcom.sun.management.jmxremote.port=1099
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false

• VisualVM: Tools > Options > Network > Manual > SOCKS Proxy: localhost port: 61099
• Press OK, in applications tree, right click and "Add remote host"
• !use the internal ip of the VM (10.128.x.x)
• Right click that host node and add JMX
• Enter 10.128.x.x:1099

Deathly