title: Is a good idea to enable jmx (lambda probe) on a production server?
body: <p>We are experiencing some slowdowns on our web-app deployed on a Tomcat 5.5.17 running on a Sun VM 1.5.0_06-b05 and our hosting company doesn't gives enough data to find the problem.</p>
  
  <p>We are considering installing <a href="http://www.lambdaprobe.org" rel="noreferrer">lambda probe</a> on the production server but it requires to enable JMX (com.sun.management.jmxremote) in order to obtain memory and CPU statistics.</p>
  
  <p>Does enabling JMX incur a serious performance penalty?</p>
  
  <p>If we enable JMX, are we opening any security flaw? Do I need to setup secure authentication if we are only enabling local access to JMX?</p>
  
  <p>Is anyone using the same (tomcat + lambda probe) without problems on production?</p>
  
  <h3>UPDATE</h3>
  
  <p>Looking at the answers it seems that enabling JMX alone doesn't incur significant overhead to the VM. The extra work may come if the monitoring application attached to the VM, be it <em>JConsole</em>, <em>lambda probe</em> or any other, is polling with excessive dedication.</p>