Tomcat 7 fails to start due to absence of jmxremote.access file while JMX authentication is disabled

Question

My tomcat 7 (hosting at amazon-eu, java 1.7.0_51) fails to start with the following exception:

SEVERE: Catalina.start:org.apache.catalina.LifecycleException: Failed to start component [StandardServer[8005]]
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:154)
        at org.apache.catalina.startup.Catalina.start(Catalina.java:684)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:616)
        at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:322)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:456)
Caused by: java.lang.IllegalArgumentException: jmxremote.access (No such file or directory)
        at javax.management.remote.rmi.RMIConnectorServer.start(RMIConnectorServer.java:372)
        at org.apache.catalina.mbeans.JmxRemoteLifecycleListener.createServer(JmxRemoteLifecycleListener.java:304)
        at org.apache.catalina.mbeans.JmxRemoteLifecycleListener.lifecycleEvent(JmxRemoteLifecycleListener.java:258)
        at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)
        at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:90)
        at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:402)
        at org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:347)
        at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:725)
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
        ... 7 more
Caused by: java.io.FileNotFoundException: jmxremote.access (No such file or directory)
        at java.io.FileInputStream.open(Native Method)
        at java.io.FileInputStream.<init>(FileInputStream.java:137)
        at java.io.FileInputStream.<init>(FileInputStream.java:96)
        at com.sun.jmx.remote.security.MBeanServerFileAccessController.propertiesFromFile(MBeanServerFileAccessController.java:294)
        at com.sun.jmx.remote.security.MBeanServerFileAccessController.<init>(MBeanServerFileAccessController.java:133)
        at javax.management.remote.rmi.RMIConnectorServer.start(RMIConnectorServer.java:370)
        ... 15 more

JMX is enabled, because I have the following line in /usr/share/tomcat7/conf/tomcat7.conf:

$CATALINA_OPTS=-Dcom.sun.management.jmxremote -Djava.rmi.server.hostname=ec2-<ip>.eu-west-1.compute.amazonaws.com -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false

and the following one in /usr/share/tomcat7/conf/server.xml:

<Listener className="org.apache.catalina.mbeans.JmxRemoteLifecycleListener"
           rmiRegistryPortPlatform="9998" rmiServerPortPlatform="9998"/>

If I comment both these lines, everything is fine.

The question is: why jmxremote.access is required while "authenticate" was set to false.

Answer 1

You're absolutely right, if you set com.sun.management.jmxremote.authenticate=false you shouldn't need the jmxremote.access file, I believe the problem is that the JMX parameters aren't getting picked up by tomcat, for what I know, tomcat7.conf isn't a standard config file for tomcat ( check this ), try adding them instead to /usr/share/tomcat7/bin/catalina.sh , like this:

CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote -Djava.rmi.server.hostname=ec2-<ip>.eu-west-1.compute.amazonaws.com -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false"

fore more info on how to configure tomcat check this , you'll see some more doc in the header of catalina.sh .

Answer 2

Try enclosing the command-line parameters in double quotes, eg:

$CATALINA_OPTS="-Dcom.sun.management.jmxremote -Djava.rmi.server.hostname=ec2-<ip>.eu-west-1.compute.amazonaws.com -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false"

My guess is that it's only taking the first paramter into account because of the missing quotes.