FortiSIEM Redhat JBOSS Configuration

Leave a reply

Redhat JBOSS Configuration

What is Discovered and Monitored

Event Types

Rules

Reports

Configuration

JMX

Configuring JMX on the JBOSS Application Server

Configuring AccelOps to Use the JMX Protocol with JBOSS Application Server

Settings for Access Credentials

Sample Event for JBOSS Metrics

What is Discovered and Monitored

Protocol Information discovered Metrics collected Used for
JMX   Generic information: Application version, Application port

Availability metrics: Uptime, Application Server State

CPU metrics: Application server instance, CPU utilization

Memory metrics: Heap utilization, Heap used memory, Heap free memory, Heap max memory,  Heap commit memory, Max System dumps on disk, Max heap dumps on disk

Servlet metrics: Application name, Web application name, Servlet Name, Invocation count, Request errors

Database pool metrics: Application server instance, JDBC provider, Data source, Pool size, Closed connections, Active Connections, Requests wait for connections, Connection use time, Connection factory type, Peak connections

Thread pool metrics: Application server instance, Thread pool name, Execute threads, Peak execute threads

Application level metrics: Application name, Web application name, Application server instance, Web application context root, Active sessions, Peak active sessions

EJB metrics: Application name, Application server instance, EJB component name

 Performance

Monitoring

Event Types

In CMDB > Event Types, search for “boss” in the Description column to see the event types associated with this device.

Rules

There are no predefined rules for this device.

Reports

In Analytics > Reports, search for jobs” in the Name column to see the reports associated with this application or device. Configuration

JMX

 

  1. Enable authentication security check. Open the file ${JBoss_Home}\server\default\deploy\jmx-jboss-beans.xml, find the J MXConnector bean, and uncomment the securityDomain
  2. Modify the file ${JBoss_Home}\server\default\conf\props\jmx-console-roles.properties to configure the JMX administrator role.
  3. Modify the file ${JBoss_Home}\server\default\conf\props\jmx-console-users.properties to configure the username and password for JMX.
  4. Configure DNS resolution for the JBOSS application server in your AccelOps Supervsior, Workers, and Collectors by adding the IP address and DNS name of the JBOSS application server to their /etc/hosts If DNS is already configured to resolve the JBOSS application server name, you can skip this step.
  5. Start JBoss.

Configuring AccelOps to Use the JMX Protocol with JBOSS Application Server

To configure JMX communications between your JBOSS application server and AccelOps, you need to copy several files from your application server to the JBOSS configuration directory for each AccelOps virtual appliance that will be used for discovery and performance monitoring jobs. AccelOps does not include these files because of licensing restrictions.

JBOSS Version Files to Copy
4.x, 5.x, 6.x Copy ${JBoss_Home}/lib/jboss-bootstrap-api.jar  to /opt/phoenix/config/JBoss/
7.0 No copying is necessary
7.1 Copy ${JBoss_Home}/bin/client/jboss-client.jar  to /opt/phoenix/config/JBoss/

You can now configure AccelOps to communicate with your device by following the instructions in Setting Access Credentials for Device Discovery, and then initiate discovery of the device as described in the topics in Discovering Infrastructure.

<134>Feb 06 11:38:35 10.1.2.16 java: [PH_DEV_MON_JBOSS_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[ hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[appV ersion]=6.1.0.Final “Neo”,[appServerState]=STARTED,[sysUpTime]=6202359,[cpuUtil]=2

<134>Feb 06 11:38:36 10.1.2.16 java:

[PH_DEV_MON_JBOSS_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.1 6,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[a ppVersion]=6.1.0.Final “Neo”,[appServerState]=STARTED,[freeMemKB]=264776,[freeSwapMemKB]=142786

4,[memTotalMB]=4095,[memUtil]=94,[swapMemUtil]=83,[swapMemTotalMB]=8189, [virtMemCommitKB]=1167176,[heapUsedKB]=188629,[heapMaxKB]=466048,[heapCo mmitKB]=283840,[heapUtil]=66,[nonHeapUsedKB]=106751,[nonHeapMaxKB]=31129 6,[nonHeapCommitKB]=107264,[nonHeapUtil]=99 <134>Feb 06 11:38:36 10.1.2.16 java: [PH_DEV_MON_JBOSS_APP]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[ hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[appV ersion]=6.1.0.Final “Neo”,[webContextRoot]=//localhost/,[webAppState]=RUNNING,[cacheMaxSize]

=10240,[cacheTTL]=5000,[reqProcessTimeAvg]=10472,[startTime]=1353919592, [cookiesAllowed]=true,[cachingAllowed]=true,[linkingAllowed]=false,[cros sContextAllowed]=true

<134>Feb 06 11:38:36 10.1.2.16 java:

[PH_DEV_MON_JBOSS_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2. 16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[ appVersion]=6.1.0.Final “Neo”,[webAppName]=//localhost/admin-console,[servletName]=Faces

Servlet,[totalRequests]=6,[reqErrors]=0,[loadTime]=0,[reqProcessTimeAvg]

=10610

<134>Feb 06 11:38:36 10.1.2.16 java:

[PH_DEV_MON_JBOSS_DB_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2. 16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[ appVersion]=6.1.0.Final “Neo”,[dataSource]=DefaultDS,[dataSourceState]=Started

<134>Feb 06 11:38:36 10.1.2.16 java: [PH_DEV_MON_JBOSS_REQUEST_PROCESSOR]:[eventSeverity]=PHL_INFO,[destIpAdd r]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPo rt]=1090,[appVersion]=6.1.0.Final “Neo”,[reqProcessorName]=ajp-0.0.0.0-8009,[recvBytes]=0,[sentBytes]=0,[r eqProcessTimeAvg]=0,[reqProcessTimeMax]=0,[totalRequests]=0,[reqRate]=0, [reqErrors]=0

<134>Feb 06 11:38:36 10.1.2.16 java: [PH_DEV_MON_JBOSS_EJB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[ hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[appV ersion]=6.1.0.Final “Neo”,[ejbComponentName]=ejbjar.jar,[ejbBeanName]=HelloWorldBeanRemote,[ ejbAvailCount]=0,[ejbCreateCount]=0,[ejbCurrCount]=0,[ejbMaxCount]=0,[ej bRemovedCount]=0,[ejbInstanceCacheCount]=null,[ejbPassivations]=null,[ej bTotalInstanceCount]=null

<134>Feb 06 11:38:36 10.1.2.16 java:

[PH_DEV_MON_JBOSS_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.

1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=10

90,[appVersion]=6.1.0.Final


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

This entry was posted in Administration Guides, FortiSIEM on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.