Steffo's Echolot

Monitoring Identity Manager

Sun Java System Identity Manager has decent JMX capabilities which allows you to

• check reconciliation status
• check whether all connected systems (resources) are available
• monitor the status of the server
• many, many other things

In order to use these features, you only have to enable JMX (disabled by default) via "Configure > Servers" from the HTTPS admin interface. Additionally, you have to 'enable' JMX at the application server level. For Tomcat, you can add the following to the catalina.sh

JAVA_OPTS="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false
    -Dcom.sun.management.jmxremote.port=9002 
    -Dcom.sun.management.jmxremote.password.file=/System/Library/Frameworks/JavaVM.framework/Versions/1.5.0/Home/lib/management/management.jmxremote.password 
    -D java.rmi.server.hostname=localhost 
    -Dcom.sun.management.jmxremote.ssl=false"

You can see a bunch of JMX data at e.g. http://localhost:8080/idm/debug/Show_MBeanInfo.jsp. You could also tools like jconsole to set and query JMX attributes.

The big question is "How to integrate IDM into a system monitoring tool?" is quite easy to answer since there is a small Java program called 'jmxquery'. Unfortunately I do not know who the author is but all credits go to her or him. What we want to achieve is that IDM‘s status and the resources health check show in our monitoring tool. E.g. with nagios you'll get the following screen

The basic idea is that Nagios calls an external programm like a (modified) version of jmxquery which able to retrieve and set IDM's JMX objects. Three things are sufficient

• jmxquery tool
• a modification of Nagios' command.cfg
• a modification of Nagios' localhost.cfg

You can find the modified jmxquery as a NetBeans project file here:

IDM-Nagios.zip
Add the following lines to command.cfg

##############################
#
#
# Sample commands for Sun Java System Identity Manager
#
##############################


define command{
        command_name     check-idm-resources
        command_line    /opt/lib/nagios/check_jmx -IDM resources
}

define command{
        command_name     check-idm-server-status
        command_line    /opt/lib/nagios/check_jmx -IDM serverStatus
}

define service{
       use                             local-service         ; Name of service template to use
       host_name                       localhost
        service_description             IDM Status
        check_command                                           check-idm-server-status
        }

define service{
       use                             local-service         ; Name of service template to use
        host_name                       localhost
        service_description             IDM Connected Systems
        check_command                                           check-idm-resources
       }

Posted at 01:31PM Nov 05, 2007 by steffo in Identity Systems  |  Comments[3]