- 2 minutes to read
What permissions does the Monitoring Agent need on WSO2 servers?
Network access to the JMX remote port of each WSO2 JVM; nothing else on the WSO2 server. Nodinite monitors WSO2 with the JMX Monitoring Agent. Its Spring Boot JMX Gateway connects to the JMX port, and the agent itself runs on the Agent Server.
On the WSO2 Server
- A JMX remote port on the WSO2 JVM (Enable JMX Remote Monitoring).
- A firewall opening for that port from the Agent Server (JMX firewall section).
- No operating system account, SSH keys, file system access, database access, Carbon management console login, or Micro Integrator Management API user.
If you protect the JMX port with authentication, the credentials are the ones you define for JMX, not a WSO2 administrator account; see FAQ - Carbon Credentials.
On the Agent Server
The JMX Monitoring Agent and the gateway need a service account with Log on as a service rights and network access to the WSO2 servers and the Monitoring Service. The full list is in What Windows User Rights does the JMX Monitoring Agent require?
Security Best Practices
- Allow the JMX port only from the Agent Server; a JMX port open to the network gives control over the JVM.
- Use JMX authentication and TLS where your policy requires it (Enable JMX Remote Monitoring).
- Run the agent with a dedicated domain account.