JMX is not enabled by default in the Jetty distribution. To enable JMX in the Jetty distribution run the following, where {$jetty.home} is the directory where you have the Jetty distribution installed, and ${jetty.base} is the directory where you have your Jetty configuration (see the documentation for Jetty base vs. home examples):

$ cd ${jetty.base}
$ java -jar {$jetty.home}/start.jar --add-to-start=jmx

Running the above command will append the available configurable elements of the jmx module to the {$jetty.base}/start.ini file, or create the ${jetty.base}/start.d/jmx.ini file.

When running Jetty embedded into an application, create and configure an MBeanContainer instance as follows:

Server server = new Server();

// Setup JMX.
MBeanContainer mbeanContainer = new MBeanContainer(ManagementFactory.getPlatformMBeanServer());
server.addBean(mbeanContainer);

// Export the loggers as MBeans.
server.addBean(Log.getLog());

Because logging is initialized prior to the MBeanContainer (even before the Server itself), it is necessary to register the logger manually via server.addBean() so that the loggers may show up in the JMX tree as MBeans.

If you are using the Jetty Maven plugin you should copy the ${jetty.home}/etc/jetty-jmx.xml file into your webapp project somewhere, such as src/main/config/etc/, then add a <jettyXml> element to the <configuration> element of the Jetty Maven Plugin:

<plugin>
  <groupid>org.eclipse.jetty</groupid>
  <artifactid>jetty-maven-plugin</artifactid>
  <version>9.4.5.v20170502</version>
  <configuration>
    <scanintervalseconds>10</scanintervalseconds>
    <jettyXml>src/main/config/etc/jetty-jmx.xml</jettyXml>
  </configuration>
</plugin>

Similarly to enabling JMX in a standalone Jetty server, you enable the jmx-remote module:

$ cd ${jetty.base}
$ java -jar {$jetty.home}/start.jar --add-to-start=jmx-remote

When running Jetty embedded into an application, create and configure a ConnectorServer:

Server server = new Server();

// Setup JMX
MBeanContainer mbeanContainer = new MBeanContainer(ManagementFactory.getPlatformMBeanServer());
server.addBean(mbeanContainer);

// Setup ConnectorServer
JMXServiceURL jmxURL = new JMXServiceURL("rmi", null, 1999, "/jndi/rmi:///jmxrmi");
ConnectorServer jmxServer = new ConnectorServer(jmxURL, "org.eclipse.jetty.jmx:name=rmiconnectorserver");
server.addBean(jmxServer);

The JMXServiceURL above specifies that the RMI server binds to the wildcard address on port 1999, while the RMI registry binds to the wildcard address on port 1099 (the default RMI registry port).

The standard JMXConnectorServer provides several options to authorize access. For a complete guide to controlling authentication and authorization in JMX, see Authentication and Authorization in JMX RMI connectors.

To authorize access to the JMXConnectorServer you can use this configuration, where the jmx.password and jmx.access files have the format specified in the blog entry above:

<New id="ConnectorServer" class="org.eclipse.jetty.jmx.ConnectorServer">
  <Arg>
    <New class="javax.management.remote.JMXServiceURL">
      <Arg type="java.lang.String">rmi</Arg>
      <Arg type="java.lang.String" />
      <Arg type="java.lang.Integer">1099</Arg>
      <Arg type="java.lang.String">/jndi/rmi:///jmxrmi</Arg>
    </New>
  </Arg>
  <Arg>
    <Map>
      <Entry>
        <Item>jmx.remote.x.access.file</Item>
        <Item>
          <New class="java.lang.String"><Arg><Property name="jetty.base" default="." />/resources/jmx.access</Arg></New>
        </Item>
      </Entry>
      <Entry>
        <Item>jmx.remote.x.password.file</Item>
        <Item>
          <New class="java.lang.String"><Arg><Property name="jetty.base" default="." />/resources/jmx.password</Arg></New>
        </Item>
      </Entry>
    </Map>
  </Arg>
  <Arg>org.eclipse.jetty.jmx:name=rmiconnectorserver</Arg>
  <Call name="start" />
</New>

Similarly, in code:

JMXServiceURL jmxURL = new JMXServiceURL("rmi", null, 1099, "/jndi/rmi:///jmxrmi");
Map<String, Object> env = new HashMap<>();
env.put("jmx.remote.x.access.file", "resources/jmx.access");
env.put("jmx.remote.x.password.file", "resources/jmx.password");
ConnectorServer jmxServer = new ConnectorServer(jmxURL, env, "org.eclipse.jetty.jmx:name=rmiconnectorserver");
jmxServer.start();

Calling ConnectorServer.start() may be explicit as in the examples above, or can be skipped when adding the ConnectorServer as a bean to the Server, so that starting the Server will also start the ConnectorServer.

The JMX communication via RMI happens by default in clear-text.

It is possible to configure the ConnectorServer with a SslContextFactory so that the JMX communication via RMI is encrypted:

<New id="ConnectorServer" class="org.eclipse.jetty.jmx.ConnectorServer">
  <Arg>
    <New class="javax.management.remote.JMXServiceURL">
      <Arg type="java.lang.String">rmi</Arg>
      <Arg type="java.lang.String" />
      <Arg type="java.lang.Integer">1099</Arg>
      <Arg type="java.lang.String">/jndi/rmi:///jmxrmi</Arg>
    </New>
  </Arg>
  <Arg />
  <Arg>org.eclipse.jetty.jmx:name=rmiconnectorserver</Arg>
  <Arg><Ref refid="sslContextFactory" /></Arg>
</New>

Similarly, in code:

SslContextFactory sslContextFactory = new SslContextFactory();
sslContextFactory.setKeyStorePath();
sslContextFactory.setKeyStorePassword("secret");

JMXServiceURL jmxURL = new JMXServiceURL("rmi", null, 1099, "/jndi/rmi:///jmxrmi");
ConnectorServer jmxServer = new ConnectorServer(jmxURL, null, "org.eclipse.jetty.jmx:name=rmiconnectorserver", sslContextFactory);

It is possible to use the same SslContextFactory used to configure the Jetty ServerConnector that supports TLS for the HTTP protocol. This is used in the XML example above: the SslContextFactory configured for the TLS ServerConnector is registered with an id of sslContextFactory which is referenced in the XML via the Ref element.

The keystore must contain a valid certificate signed by a Certification Authority.

The RMI mechanic is the usual one: the RMI client (typically a monitoring console) will connect first to the RMI registry (using TLS), download the RMI server stub that contains the address and port of the RMI server to connect to, then connect to the RMI server (using TLS).

This also mean that if the RMI registry and the RMI server are on different hosts, the RMI client must have available the cryptographic material to validate both hosts.

Having certificates signed by a Certification Authority simplifies by a lot the configuration needed to get the JMX communication over TLS working properly.

If that is not the case (for example the certificate is self-signed), then you need to specify the required system properties that allow RMI (especially when acting as an RMI client) to retrieve the cryptographic material necessary to establish the TLS connection.

For example, trying to connect using the JDK standard JMXConnector with both the RMI server and the RMI registry to domain.com:

// System properties necessary for an RMI client to trust a self-signed certificate.
System.setProperty("javax.net.ssl.trustStore", "/path/to/trustStore");
System.setProperty("javax.net.ssl.trustStorePassword", "secret");

JMXServiceURL jmxURL = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://domain.com:1100/jmxrmi")
Map<String, Object> clientEnv = new HashMap<>();
// Required to connect to the RMI registry via TLS.
clientEnv.put(ConnectorServer.RMI_REGISTRY_CLIENT_SOCKET_FACTORY_ATTRIBUTE, new SslRMIClientSocketFactory());
try (JMXConnector client = JMXConnectorFactory.connect(jmxURL, clientEnv))
{
    Set<ObjectName> names = client.getMBeanServerConnection().queryNames(null, null);
}

Similarly, to launch JMC:

$ jmc -vmargs -Djavax.net.ssl.trustStore=/path/to/trustStore -Djavax.net.ssl.trustStorePassword=secret

Note that these system properties are required when launching the ConnectorServer too, on the server, because it acts as an RMI client with respect to the RMI registry.

You can access JMX MBeans on a remote machine when the RMI ports are not open, for example because of firewall policies, but you have SSH access to the machine using local port forwarding via a SSH tunnel.

In this case you want to configure the ConnectorServer with a JMXServiceURL that binds the RMI server and the RMI registry to the loopback interface only: service:jmx:rmi://localhost:1099/jndi/rmi://localhost:1099/jmxrmi.

Then you setup the local port forwarding with the SSH tunnel:

$ ssh -L 1099:localhost:1099 <user>@<machine_host>

Now you can use JConsole or JMC to connect to localhost:1099 on your local computer. The traffic will be forwarded to machine_host and when there, SSH will forward the traffic to localhost:1099, which is exactly where the ConnectorServer listens.

When you configure ConnectorServer in this way, you must set the system property -Djava.rmi.server.hostname=localhost, on the server.

This is required because when the RMI server is exported, its address and port are stored in the RMI stub. You want the address in the RMI stub to be localhost so that when the RMI stub is downloaded to the remote client, the RMI communication will go through the SSH tunnel.