Chapter 16. Management

16.1. JMX Classes

Red5's implementation consists of the following classes and various other MBeans:

org.red5.server.jmx.JMXFactory - Provides access to the platform MBeanServer as well as registration, unregistration, and creation of new MBean instances. Creation and registration is performed using StandardMBean wrappers.

org.red5.server.jmx.JMXAgent - Provides the HTML adapter and registration of MBeans.

org.red5.server.jmx.JMXUtil - Helper methods for working with ObjectName or MBean instances.

16.2. Spring configuration

The Spring configuration for the JMX implementation allows you to configure the "domain" for MBean registration and listener port for the HTML adaptor. The default entries are shown below.



<!-- JMX server --> 
<!-- JMX server --> 
 <bean id="jmxFactory" class="org.red5.server.jmx.JMXFactory"> 
  <property name="domain" value="org.red5.server"/> 
 </bean> 
 <bean id="jmxAgent" class="org.red5.server.jmx.JMXAgent" init-method="init"> 
  <!-- The RMI adapter allows remote connections to the MBeanServer --> 
  <property name="enableRmiAdapter" value="true"/> 
  <property name="rmiAdapterPort" value="${jmx.rmi.port.registry}"/> 
  <property name="rmiAdapterRemotePort" value="${jmx.rmi.port.remoteobjects}"/> 
  <property name="rmiAdapterHost" value="${jmx.rmi.host}"/> 
  <!-- SSL 
   To use jmx with ssl you must also supply the location of the keystore and its password 
   when starting the server with the following JVM options: 
    -Djavax.net.ssl.keyStore=keystore 
        -Djavax.net.ssl.keyStorePassword=password 
  --> 
  <property name="enableSsl" value="${jmx.rmi.ssl}"/> 
  <!-- Starts a registry if it doesnt exist --> 
  <property name="startRegistry" value="true"/> 
  <!-- Authentication --> 
  <property name="remoteAccessProperties" value="${red5.config_root}/access.properties"/> 
  <property name="remotePasswordProperties" value="${red5.config_root}/password.properties"/> 
  <property name="remoteSSLKeystore" value="${red5.config_root}/keystore.jmx"/> 
  <property name="remoteSSLKeystorePass" value="${rtmps.keystorepass}"/> 
  <!-- The HTML adapter allows connections to the MBeanServer via a web browser --> 
  <property name="enableHtmlAdapter" value="${jmx.http}"/> 
  <property name="htmlAdapterPort" value="${jmx.http.port}"/> 
  <!-- Mina offers its own Mbeans so you may integrate them here --> 
  <property name="enableMinaMonitor" value="true"/> 
 </bean> 

The config settings for the jmxAgent bean is located in the red5.properties, these are:

red5.properties -


 # JMX 
jmx.rmi.port.registry=9999 
jmx.rmi.port.remoteobjects= 
jmx.rmi.host=0.0.0.0 
jmx.rmi.ssl=false 
jmx.http=false 
jmx.http.port=8082 

  1. jmx.rmi.port.registry - The RMI registry port. The RMI adapter may only be used if an

RMI registry is running. The RMI registry is enabled by default.

  1. jmx.rmi.port.remoteobjects - The RMI remote objects export port to specify for access

through firewalls. The default port is generated from the RMI stack.

  1. jmx.rmi.host - For RMI remote access specify the host to bind to usually the public

address.

  1. jmx.rmi.ssl - Enable RMI / JMX SSL. SSL is off by default.

  2. jmx.http - Enable HTTP RMI adapter. The HTML adapter is disabled by default, but it

allows easy management of MBeans from a web browser.

16.3. RMI Authentication

RMI authentication is configured and enabled by default. This is to secure the RMI connection from anonymous clients. The bean properties remoteAccessProperties and remotePasswordProperties set the JMX access and password config files. The access.properties and password.properties config files define the JMX user rights and clear text password. access.properties contains a user and group rights config

access.properties -


red5user readwrite 

Where red5user is the JMX username and readwrite is the rights which is usually left as default. password.properties contains the JMX user and password

password.properties -


red5user changeme 

Where red5user is the JMX username and changeme is the JMX password.

[Tip]Tip

It is advisable to change the default login, aswell as configure with SSL enabled as the login is cleartext.

16.4. JMX / RMI / SSL

When RMI is enabled with SSL, the bean properties remoteSSLKeystore and remoteSSLKeystorePass are required to load the SSL keystore and the keystore password for the SSL request. The default keystore loaded is the conf/keystore.jmx file which can also share the keystore required for RTMPS connections. The java properties javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword are transparently set. To generate the keystore / and truststore for client / server connections run from the source


  ant truststore

This will generate a keystore.jmx, red5server.cer and truststore.jmx certificate.

16.5. jConsole / JMX Client

JConsole is a utility that ships with the JRE (since 1.5), it allows you to manage local and remote JMX implementations. To enable introspection you must add the following VM parameter to your startup:


-Dcom.sun.management.jmxremote 

16.5.1. Local Management

After the parameter is set and the application initialized you can start jConsole at the command line by typing:


  jconsole

A Swing application will appear and you must select the implementation (agent) you wish to manage, for local simply select "org.red5.server.Standalone".

16.5.2. Remote Management

For remote connections with jconsole / JMX clients the command is


jconsole service:jmx:rmi://host:port/jndi/rmi://host:port/red5 

16.5.3. SSL Remote Management

For remote ssl connections with jconsole / JMX clients the client is required to load the truststore certificate generated previouslly.

The command for setting the truststore properties


jconsole -J-Djavax.net.ssl.trustStore=truststore.jmx \ 
-J-Djavax.net.ssl.trustStorePassword=password \ 
service:jmx:rmi://host:port/jndi/rmi://host:port/red5 

16.6. Links