title: How to connect to Java instances running on EC2 using JMX
body: <p>We are having problem connecting to our Java applications running in Amazon's EC2 cluster. We definitely have allowed both the "JMX port" (which is usually the RMI registry port) <em>and</em> the server port (which does most of the work) to the security-group for the instances in question.  Jconsole connects but seems to hang and never show any information.</p>
  
  <p>We are running our java with something like the following:</p>
  
  <pre><code>java -server -jar foo.jar other parameters here &gt; java.log 2&gt;&amp;1
  </code></pre>
  
  <p>We have tried:</p>
  
  <ul>
  <li>Telnets to the ports <em>connect</em> but no information is displayed.</li>
  <li>We can run <code>jconsole</code> on the instance itself using remote-X11 over ssh and it connects and shows information.  So the JRE <em>is</em> exporting it locally.</li>
  <li>Opening all ports in the security group.  Weeee.</li>
  <li>Using <code>tcpdump</code> to make sure the traffic is not going to other ports.</li>
  <li>Simulating it locally.  We can always connect to our local JREs or those running elsewhere on our network using the same application parameters.</li>
  </ul>
  
  <p><code>java -version</code> outputs:</p>
  
  <pre><code>OpenJDK Runtime Environment (IcedTea6 1.11.5) (amazon-53.1.11.5.47.amzn1-x86_64)
  OpenJDK 64-Bit Server VM (build 20.0-b12, mixed mode)
  </code></pre>
  
  <p>As an aside, we are using my <a href="http://256.com/sources/simplejmx/" rel="noreferrer">Simple JMX</a> package which allows us to set <em>both</em> the RMI registry and server ports which are typically semi-randomly chosen by the RMI registry.  You can also force this with something like the following JMX URI:</p>
  
  <pre><code>service:jmx:rmi://localhost:" + serverPort + "/jndi/rmi://:" + registryPort + "/jmxrmi"
  </code></pre>
  
  <p>These days we use the same port for both the server and the registry.  In the past we have used <code>X</code> as the registry-port and <code>X+1</code> for the server-port to make the security-group rules easy.  You connect to the registry-port in <code>jconsole</code> or whatever JMX client you are using.</p>