> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt
> Use this file to discover all available pages before exploring further.

# JMX

> Runtime metrics from Java apps that expose Java Management Extensions.

The JMX integration requires CXDOT Collector 1.4.0 or greater.

Use the JMX integration to collect runtime metrics from Java apps that expose
Java Management Extensions (JMX) in your environment.

The JMX integration supports Java 8 or greater.

## Supported telemetry types

The JMX integration supports these telemetry types:

| Type    | Supported |
| ------- | --------- |
| Logs    | No        |
| Metrics | Yes       |
| Traces  | No        |
| Events  | No        |

## Prerequisites

The JMX integration has the following prerequisites:

* Enable remote monitoring through
  [Java Management Extensions (JMX)](https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html)
  when you start each Java app. Set the remote registry and Remote Method
  Invocation connector to ports that the Collector can reach. It's recommended to
  use the same port for both connections and advertise a reachable host or IP address. For example,
  add these Java system properties:

  ```shell theme={null}
  -Dcom.sun.management.jmxremote
  -Dcom.sun.management.jmxremote.port=9012
  -Dcom.sun.management.jmxremote.rmi.port=9012
  -Djava.rmi.server.hostname=<reachable-host>
  ```

* Make the JMX registry and remote connector reachable from the Collector.

## Configure

The JMX integration runs by default. To configure manual targets, follow these
steps:

1. Configure the JMX targets. For example, add the following to the `values.yaml`
   for your Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       jmx:
         endpoints:
           - endpoint: java.example.com:9012
   ```

   The integration collects from exactly the configured targets.

2. Optional: Configure the integration's authentication and Transport Layer Security
   (TLS) settings to match the remote JMX agent. Supply the username and password
   together. If a remote stub advertises an address that the Collector can't reach,
   override its advertised host or port in the integration configuration.

### Validate

To validate the JMX integration, follow these steps:

1. In Live Telemetry Analyzer, filter for
   `cxdot.integration.name=jmx`.

2. In Metrics Explorer, run the following query:

   ```text theme={null}
   count by ("server.address", "server.port") ({"jvm.thread.count", "cxdot.integration.name"="jmx"})
   ```

   Confirm that the query returns a nonzero value for each target.

For more information about diagnosing a failing integration, see
[Troubleshooting](https://docs.chronosphere.io/ingest/cxdot-collector/troubleshooting).

## Configuration reference

Configure one JMX integration instance with the following settings. In Helm values, place these
settings under `config.integrations.jmx`. In a Collector configuration file, place them under
`cxdot.integrations.jmx`.

### Optional settings

* **`enabled`**
  Type: `boolean`. Optional. Default: `true`.
  Whether to run the JMX integration. If true, the Collector collects JMX metrics. If false, the
  Collector doesn't run this integration.

* **`endpoints`**
  Type: `array of object`. Optional.
  Static JMX targets. Each endpoint can be a `host:port` Remote Method Invocation (RMI) registry
  address or a `service:jmx:rmi` URL. When this list isn't empty, the integration collects from
  exactly these targets instead of discovered targets.

* **`endpoints[].endpoint`**
  Type: `string`. Required.
  JMX target as a `host:port` RMI registry address or a `service:jmx:rmi` URL.

* **`registry_tls`**
  Type: `boolean`. Optional. Default: `false`.
  Whether to use TLS for the RMI registry connection. If true, the Collector uses TLS. If false,
  it uses an unencrypted registry connection.

* **`advertised_host_override`**
  Type: `string`. Optional. Default: \`\`.
  Host to use instead of the host advertised by returned Remote Method Invocation (RMI) stubs.
  When empty, the integration uses the host from the endpoint.

* **`advertised_port_override`**
  Type: `integer`. Optional. Default: `0`. Minimum: `0`. Maximum: `65535`.
  Port to use instead of the port advertised by returned RMI stubs. A value of `0` uses the
  advertised port.

* **`username`**
  Type: `string`. Optional.
  JMX authentication username. Configure with password.

* **`password`**
  Type: `string`. Optional.
  JMX authentication password. Configure with username.

* **`collection_interval`**
  Type: `duration`. Optional. Default: `15s`.
  Time between metric collections from each JMX target.

* **`bean_detection_interval`**
  Type: `duration`. Optional. Default: `10m`.
  Time between JMX bean discovery refreshes.

* **`target_system`**
  Type: `string`. Optional. Default: `jvm`.
  Comma-delimited attribute mapping names. Names must start with a lowercase letter or digit and
  contain only lowercase letters, digits, underscores, and hyphens. The JVM mapping is included
  automatically; add -jvm to disable it when at least one other mapping is configured.

* **`attribute_mapping_paths`**
  Type: `array of string`. Optional. Default: `[]`.
  Directories and files searched before the built-in Java Virtual Machine (JVM) attribute
  mapping.

* **`tls`**
  Type: `object`. Optional.
  TLS settings for registry and RMI connections.

* **`tls.ca_file`**
  Type: `string`. Optional.
  Path to the CA cert. For a client this verifies the server certificate. For a server this
  verifies client certificates. If empty uses system root CA. (optional)

* **`tls.ca_pem`**
  Type: `string`. Optional.
  In memory PEM encoded cert. (optional)

* **`tls.cert_file`**
  Type: `string`. Optional.
  Path to the TLS cert to use for TLS required connections. (optional)

* **`tls.cert_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS cert to use for TLS required connections. (optional)

* **`tls.cipher_suites`**
  Type: `array of string`. Optional.
  CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a
  safe default list is used. See
  [https://go.dev/src/crypto/tls/cipher\_suites.go](https://go.dev/src/crypto/tls/cipher_suites.go)
  for a list of supported cipher suites.

* **`tls.curve_preferences`**
  Type: `array of string`. Optional.
  contains the elliptic curves that will be used in an ECDHE handshake, in preference order
  Defaults to empty list and "crypto/tls" defaults are used, internally.

* **`tls.include_system_ca_certs_pool`**
  Type: `boolean`. Optional.
  If true, load system CA certificates pool in addition to the certificates configured in this
  struct.

* **`tls.insecure`**
  Type: `boolean`. Optional.
  In gRPC and HTTP when set to true, this is used to disable the client transport security. See
  [https://godoc.org/google.golang.org/grpc#WithInsecure](https://godoc.org/google.golang.org/grpc#WithInsecure)
  for gRPC. Please refer to
  [https://godoc.org/crypto/tls#Config](https://godoc.org/crypto/tls#Config) for more
  information. (optional, default false)

* **`tls.insecure_skip_verify`**
  Type: `boolean`. Optional.
  InsecureSkipVerify will enable TLS but not verify the certificate.

* **`tls.key_file`**
  Type: `string`. Optional.
  Path to the TLS key to use for TLS required connections. (optional)

* **`tls.key_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS key to use for TLS required connections. (optional)

* **`tls.max_version`**
  Type: `string`. Optional.
  MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls
  for defaults. (optional)

* **`tls.min_version`**
  Type: `string`. Optional.
  MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used.
  (optional)

* **`tls.reload_interval`**
  Type: `duration`. Optional.
  ReloadInterval specifies the duration after which the certificate will be reloaded If not set,
  it will never be reloaded (optional)

* **`tls.server_name_override`**
  Type: `string`. Optional.
  ServerName requested by client for virtual hosting. This sets the ServerName in the TLSConfig.
  Please refer to [https://godoc.org/crypto/tls#Config](https://godoc.org/crypto/tls#Config) for
  more information. (optional)

* **`tls.tpm`**
  Type: `object`. Optional.
  Trusted platform module configuration

* **`tls.tpm.auth`**
  Type: `string`. Optional.
  Authorization value for the trusted platform module key.

* **`tls.tpm.enabled`**
  Type: `boolean`. Optional.
  Whether to use a trusted platform module for the TLS private key. If true, the Collector loads
  the key from the configured device or socket. If false, the Collector uses the configured key
  file or in-memory key.

* **`tls.tpm.owner_auth`**
  Type: `string`. Optional.
  Owner authorization value for the trusted platform module.

* **`tls.tpm.path`**
  Type: `string`. Optional.
  The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.


## Related topics

- [Tomcat](/ingest/xcor/integrations/collector/tomcat.md)