--- title: "Using SSH tunneling with JMX for Alfresco · Appnovation" url: "https://www.appnovation.com/insights/using-ssh-tunneling-jmx-alfresco" description: "How to monitor Alfresco with JMX when your server sits behind a firewall, using SSH tunneling, with step-by-step configuration." --- Article # Using SSH tunneling with JMX for Alfresco [![](https://cdn.sanity.io/images/ey850001/production/36eb314260fb474cacc1b3a473d7e8402d997898-68x68.png?w=68&auto=format) Appno Blogger Appnovation Coop](/people/appno-blogger.md) Jun 27, 2013 2 min read ![Using SSH tunneling with JMX for Alfresco](https://cdn.sanity.io/images/ey850001/production/9efe1c26d9584ecfb3dfef5a63e698bf4567d305-1440x600.jpg?w=1400&auto=format) JMX is a great tool to monitor a Java application like Alfresco, but it can be tricky to configure, especially if you are not on the same internal network as your server and you have to pass through a firewall. Usually, this is what happens when you deploy your application in the cloud : you have only a SSH connection to admin your server. In that case, SSH tunneling is a good solution to access the JMX server. You can connect to your Alfresco JMX server from 2 different URL's: * service:jmx:rmi:///jndi/rmi://localhost:50500/jmxrmi : this is the standard Java JMX URL * service:jmx:rmi:///jndi/rmi://localhost:50500/alfresco/jmxrmi : this is the JMX Alfresco URL Both URL's give access to the same services; you just don’t customize them the same way. JMX communications use the RMI protocol, which connects through 2 connections. The first one is to the RMI registry that pushes your request to the JMX server which is dynamically allocated, by default. Dynamic ports don’t give us the consistency we need so we will want to configure Alfresco to use a static port. Also, the second (server) connection requires you to set the hostname to connect. The latter is the local client that initiates communication with the JMX server. Here are the different steps: * set a static port for the second (server) RMI connection * set the hostname for the second (server) RMI connection * creates a tunnel for the first (registry) connection * creates a tunnel for the second (server) connection On the server: * We need to add the property `monitor.rmi.services.port=50510` to alfresco-global.properties, in order to set the static port for the RMI server connection * We need to modify alfresco.sh to set the hostname by adding `-Djava.rmi.server.hostname=jmxhost` to the JAVA\_OPTS. On the client: * We need to add `127.0.0.1 jmxhost` to /etc/hosts * Then we can create the 2 ssh tunnels for the RMI registry and server connections: `ssh -f user@theserver.com -L 2000:localhost:50500 -Nssh -f user@theserver.com -L jmxhost:50510:localhost:50510 -N` Finally, we can connect by using jconsole (or any other JMX client) to the following URL: service:jmx:rmi:///jndi/rmi://localhost:2000/alfresco/jmxrmi NB: Here, we connected through the Alfresco JMX URL. Note that we can connect through the standard Java URL, as well. Since Java 7 update 4, a new Java property can be used to set a static port for the server RMI connection : `com.sun.management.jmxremote.rmi.port`. As the next Alfresco 4.2 will support Java 1.7, it will become an option. [![](https://cdn.sanity.io/images/ey850001/production/36eb314260fb474cacc1b3a473d7e8402d997898-68x68.png?w=68&auto=format) Appno Blogger Appnovation Coop · Appnovation](/people/appno-blogger.md) ## Keep reading [![What is Sovereign AI](https://cdn.sanity.io/images/ey850001/production/a5889abdd5e80376912546622e046e3fbef234b4-2496x1664.png?w=640&auto=format)](/insights/what-is-open-source-sovereign-ai.md) Article · 7 min AI ### [What Is Open Source, Sovereign AI?](/insights/what-is-open-source-sovereign-ai.md) Every company is encouraging more AI, and almost every AI bill is climbing. Sovereign AI is about two kinds of control: over your data and over your costs. Here's why open source sits at its foundation. [Iain MacNeil](/people/iain-macneil.md) Article [![AI-first experience design](https://cdn.sanity.io/images/ey850001/production/8bbc2418e87924ef10f36115478a2e10d5bed95e-1584x624.jpg?w=640&auto=format)](/insights/how-build-ai-first-experience-without-throwing-out-everything-youve-already-built.md) Article · 6 min AI Sep 10, 2026 ### [How to Build an AI-First Experience Without Throwing Out Everything You've Already Built](/insights/how-build-ai-first-experience-without-throwing-out-everything-youve-already-built.md) Users now expect a direct answer, not a list of links to click through. Here's how organizations can layer an AI-First experience onto their existing website or app, in weeks rather than years. [Andrew Douglas](/people/andrew-douglas.md) Article [![What Becomes Possible When AI Can Read All the Data](https://cdn.sanity.io/images/ey850001/production/c28ab0bd26753421ee42937e13adc7a7f19b47f0-1296x510.jpg?w=640&auto=format)](/insights/what-becomes-possible-when-ai-can-read-all-data.md) Article · 4 min AI Sep 09, 2026 ### [What Becomes Possible When AI Can Read All the Data](/insights/what-becomes-possible-when-ai-can-read-all-data.md) Most of the world's data has never been analyzed, only sampled. AI changes that. How AI-ready data platforms unlock questions no one could ask before. [Appnovation](/people/appnovation.md) Article ## Get the thinking, *before everyone else.* One considered email a month. New essays, field notes from live engagements, and the occasional strong opinion. No noise.