Configuration issue with - Monitoring of Java Virtual Machines with JMX

[gregbujak]

Splunk 6
linux cluster - distributed search head/2 indexers
Monitoring of Java Virtual Machines with JMX - jmx_ta - 2.0.3

Configuring the default config.xml file and then enabling the modular (default) input. I have activemq enabled with JMX. I am able to connect and get jmx data.

First issue: I am getting a number of the following ERROR(s):

11-13-2013 12:05:45.664 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://helloworld : No such attribute: value
11-13-2013 12:05:45.666 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://helloworld : No such attribute: used
...

What do I need to change (on the JVM) to enable these? And how do I figure out which attributes these are on the config.xml - these repeat over and over for the different mbeans.

---

Next issue (and it very well may not have anything to do with the app):

The following query returns all Threading related performance counters -

index=jmx sourcetype=jmx host="validationdemo" mbean_domain="java.lang" mbean_property_type="Threading" jvmDescription=activemq

Changing

mbean_property_type="Threading" 

to

mbean_property_type="*"

Should return the world of types. Instead it only returns GC related performance counters. Am I missing something obvious?
Thanks.

[Damien_Dallimor · Accepted solution]

Question 1

The default config.xml file is just an exmaple.I've tried to make it as generic as possible for the multitude of JVM environments that it can potentially be deployed against. So you may see some MBean attributes that are not present in your target JVM.

You should use a tool such as JConsole to browse the target JVM to see what MBeans and MBean attributes are available , and configure your config.xml file accordingly.

Question 2

index=jmx mbean_domain=java.lang mbean_property_type=*

[Damien_Dallimor]

My answer to 2 is that search string works perfectly well for me.Note, quote marks are not around the asterisk.

[gregbujak]

Thanks. It makes sense. For some reason I was thinking that it was targeting the oracle jvm (staring to long at it).

Not following your answer to question 2 as thats what returns only GC related info (at least in the field extractions). This might looks more like a upper limit to the number of field extractions you get, but its odd that it targets a single type.