X

Proactive insights, news and tips from Oracle WebLogic Server Support. Learn Oracle from Oracle.

  • November 5, 2015

Application MBeans Visibility in Oracle WebLogic Server 12.2.1

Oracle WebLogic Server (WLS) version 12.2.1 supports a feature called Multi-Tenancy (WLS MT). WLS MT introduces the partition, partition administrator, and partition resource concepts.  Partition isolation is enforced when accessing resources (e.g., MBeans) in a domain. WLS administrators can see MBeans in the domain and the partitions. But a partition administrator as well as other partition roles are only allowed to see the MBeans in their partition, not in other partitions. 

In this article, I will explore the visibility support on the application MBeans to demonstrate partition isolation in WLS MT in 12.2.1. This includes

  • An overview of application MBean visibility in WLS MT
  • A simple user case that demonstrates what MBeans are registered on a WLS MBeanServer, what MBeans can be visible by WLS administrators or partition administrators
  • Links to reference materials for more information

The use case used in this article is run based on a domain created in another article "Create WebLogic Server Domain with Partitions using WLST in 12.2.1". In this article, I will 

  • Briefly show the domain topology
  • Demonstrate how to deploy an application to the domain and partitions
  • Demonstrate how to access the application MBeans via JMX clients using global/domain url or partition specific url
  • Demonstrate how to enable debugging/logging

1. Overview

An application can be deployed to WLS servers per partition, so the application is multiplied for multiple partitions. WLS contains three MBeanServers: Domain Runtime MBeanServer, Runtime MBeanServer. Each MBeanServer can be used for all partitions. WLS needs to ensure that the MBeans registered on each MBeanServer by the application are unique for each partition.

The application MBean visibility in WLS MT can be illustrated by several parts:

  • Partition Isolation
  • Application MBeans Registration
  • Query Application MBeans
  • Access Application MBeans

1.1 Partition Isolation

A WLS administrator can see application MBeans in partitions. But a partition administrator for a partition is not able to see application MBeans from the domain or other partitions.  

1.2 Application MBeans Registration

When an application is deployed to a partition, application MBeans are registered during the application deployment. WLS adds a partition specific key (e.g. Partition=<partition name>) to the MBean Object Names when registering them onto the WLS MBeanServer. This will ensure that MBean object names are unique when registered from a multiplied application.

Figure on the right shows how application MBean ObjectNames are different when registered onto the WLS MBeanServer on the domain and the partitions.

Figure on the right shows there is a WLS domain and an application.

WLS domain is configured with two partitions: cokePartition and pepsiPartition.

An application registers one MBean, e.g., testDomain:type=testType, during the application deployment.

The application is deployed to WLS domain, cokePartition and pepsiPartition. Since an WLS MBeanServer instance is shared by the domain, cokePartition and pepsiPartition, there are three application MBeans registered on the same MBeanServer after three application deployments:

  • An MBean belongs to domain:          testDomain:type=testType
  • An MBean belongs to cokePartition: testDomain:Partition=cokePartition,type=testType
  • An MBean belongs to cokePartition: testDomain:Partition=pepsiPartition,type=testType

The MBeans belong to the partitions contains an Partition key property in the ObjectNames.

1.3 Query Application MBeans

JMX clients, e.g., WebLogic WLST, JConsole etc., connect to a global/domain URL or partition specific URL, then do a query on the WebLogic MBeanServer. The query results are different:

  • When connecting to a global/domain URL, the application MBeans that belong to the partitions can be visible to those JMX clients.
  • When connecting to a partition specific URL, WLS filters the query results. Only the application MBeans that belong to that partition are returned. MBeans belonging to the domain and other partitions are filtered out.

1.4 Access Application MBeans

JMX clients, e.g., WebLogic WLST, JConcole, etc., connect to a partition specific URL, and do an JMX operation, e.g., getAttribute(<MBean ObjectName>, <attributeName>), the JMX operation is actually done on different MBeans:

  • When connecting to a global/domain URL, the getAttribute() is called on the MBean that belongs to the domain. (The MBean without the Partition key property on the MBean ObjectName.)
  • When connecting to a partition specific URL, the getAttribute() is called on the MBean that belongs to that partition. (The MBean with the Partition key property on the MBean ObjectName.)

2. Use case

Now I will demonstrate how MBean visibility works in WebLogic Server MT in 12.2.1 to support partition isolation. 

2.1 Domain with Partitions

In the article "Create WebLogic Server Domain with Partitions using WLST in 12.2.1", a domain with 2 partitions: coke and pepsi is created. This domain is also used for the use case in this article. Here is the summary of the domain topology:

  • A domain is configured with one AdminServer named "admin", one partition named "coke", one partition named "pepsi". 
  • The "coke" partition contains one resource group named "coke-rg1", targeting to a target named "coke-vt". 
  • The "pepsi" partition contains one resource group named "pepsi-rg1", targeting to a virtual target named "pepsi-vt". 

More specifically, each domain/partition has the following configuration values:



 Domain NameUser NamePassword
Domainbase_domainweblogicwelcome1
Coke Partitioncokemtadmin1welcome1
Pepsi Partitionpepsimtadmin2welcome2

Please see details in the article "Create Oracle WebLogic Server Domain with Partitions using WLST in 12.2.1" on how to create this domain.

2.2 Application deployment

When the domain is set up and started, an application "helloTenant.ear" is deployed to the domain. It is also deployed to the "coke-rg1" in the "coke" partition and to the "pepsi-rg1" in the "pepsi" partition. The deployment can be done using different WLS tools, like FMW Console, WLST, etc.. Below are the WLST commands that deploy an application to the domain and the partitions:



startEdit()

deploy(appName='helloTenant',target='admin,path='${path-to-the-ear-file}/helloTenant.ear')

deploy(appName='helloTenant-coke',partition='coke',resourceGroup='coke-rg1',path='${path-to-the-ear-file}/helloTenant.ear')

deploy(appName='helloTenant-pepsi',partition='pepsi',resourceGroup='pepsi-rg1',path='${path-to-the-ear-file}/helloTenant.ear')

save()

activate()


For other WLS deployment tools, please see the "Reference" section.

2.3 Access Application MBeans


During the application deployment, application MBeans are registered onto the WebLogic Server MBeanServer. As mentioned in the previous section 1.2 Application MBean Registration, multiple MBeans are registered, even though there is only one application.

To access application MBeans, there are multiple ways to achieve this

  • WLST
  • JConsole
  • JSR 160 apis

2.3.1 WLST

The WebLogic Scripting Tool (WLST) is a command-line scripting interface that system administrators and operators use to monitor and manage WebLogic Server instances and domains. To start WLST:

$MW_HOME/oracle_common/common/bin/wlst.sh

Once WLST is started, user can connect to the server by providing a connection url. Below will show different values of an application MBean attribute by the WLS administrator or partition administrator when providing different connection urls.

2.3.1.1 WLS administrator

WLS administrator 'weblogic' connects to the domain using the following connect command:

connect("weblogic", "welcome1", "t3://localhost:7001")

The picture below shows there are 3 MBeans registered on the WebLogic Server MBeanServer, whose domain is "test.domain", and the value of the attribute "PartitionName" on each MBean.

  • test.domain:Partition=coke,type=testType,name=testName
    • belongs to the coke partition. The value of the PartitionName attribute is "coke"
  • test.domain:Partition=pepsi,type=testType,name=testName
    • belongs to the pepsi partition. The value of the PartitionName attribute is "pepsi"
  • test.domain:type=testType,name=testName
    • belongs to the domain. No Partition key property in the ObjectName. The value of the PartitionName attribute is "DOMAIN"

The MBean belonging to the partition will contain a Partition key property in the ObjectName. The Partition key property is added by WLS internally when they are registered in a partition context.

2.3.1.2 Partition administrator for coke

Similarly, the partition administrator 'mtadmin1' for coke can connect to the coke partition. The connection url uses "/coke" which is the uri prefix defined in the virtual target coke-vt. (Check the config/config.xml in the domain.)

connect("mtadmin1", "welcome1", "t3://localhost:7001/coke")

From the picture below, when connecting to the coke partition, there is only one MBean listed:

test.domain:type=testType,name=testName

Even though there is no Partition key property in the ObjectName, this MBean still belongs to the coke partition. The value of the PartitionName attribute is "coke".

2.3.1.3 Partition administrator for pepsi

Similarly, the partition administrator 'mtadmin2' for pepsi can connect to the pepsi partition. The connection url uses "/pepsi" which is the uri prefix defined in the virtual target pepsi-vt.

connect("mtadmin2", "welcome2", "t3://localhost:7001/pepsi")

From the picture below, when connecting to the pepsi partition, there is only one MBean listed:

test.domain:type=testType,name=testName

Even though there is no Partition key property in the ObjectName, same as the one seen by the partition administrator for coke, this MBean still belongs to the pepsi partition. The value of the PartitionName attibute is "pepsi".

2.3.2 JConsole

The JConsole graphical user interface is a build-in tool in JDK. It's a monitoring tool that complies to the Java Management Extensions (JMX) specification.  By using JConsole you can get a overview of the MBeans registered on the MBeanServer.

To start JConsole, do this:

$JAVA_HOME/bin/jconsole
-J-Djava.class.path=$JAVA_HOME/lib/jconsole.jar:
$JAVA_HOME/lib/tools.jar:$MW_HOME/wlserver/server/lib/wljmxclient.jar
 -J-Djmx.remote.protocol.provider.pkgs=weblogic.management.remote

where <MW_HOME> is the location where WebLogic Server is installed.

Once JConsole is started, WLS administrator and partition administrator can use it to browse the MBeans given the credentials and the JMX service URL.

2.3.2.1 WLS administrator

The WLS administrator "weblogic" provides an JMX service URL to connect to the WLS Runtime MBeanServer like below:

service:jmx:t3://localhost:7001/jndi/weblogic.management.mbeanservers.runtime

When connected by a WLS administrator, an MBean tree in JConsole shows 3 MBeans with the "test.domain" in the ObjectName:

The highlighted ObjectName in the right pane in the picture below is the MBean that belongs to the coke partition. It has the Partition key property: Partition=coke.

The highlighted below is the MBean that belongs in the pepsi partition. It has the Partition key property: Partition=pepsi.

The highlighted below is the MBean that belongs to the domain. It does not have the Partition key property.

The result here is consistent with what we have seen in WLST for WLS administrator.

2.3.2.2 Partition administrator for coke

The partition administrator "mtadmin1" provides a different JMX service URL to JConsole:

service:jmx:t3://localhost:7001/coke/jndi/weblogic.management.mbeanservers.runtime

When connected via partition specific JMX service url,, the partition administrator can only see one MBean:

test.domain:type=testType,name=testName

This MBean belongs to the coke partition and the value of the PartitionName is coke as shown in the picture below. However, there is no Partition key property in the ObjectName.

2.3.2.3 Partition administrator for pepsi

The partition administrator "mtadmin2" provides a different JMX service URL to JConsole:

service:jmx:t3://localhost:7001/pepsi/pepsi/weblogic.management.mbeanservers.runtime

When connected via partition specific JMX service url, the partition administrator "mtadmin2" can only see one MBean:

test.domain:type=testType,name=testName

This MBean belongs to the pepsi partition and the value of the PartitionName is pepsi as shown in the picture below.

2.3.3 JSR 160 APIs

JMX clients can use JSR 160 APIs to access the MBeans registered on the MBeanServer. For example, the code below shows how to get the JMXConnector by providing a service url and the env, to get the MBean attribute:

import javax.management.*;

import javax.management.remote.JMXConnector;

import javax.management.remote.JMXServiceURL;

import javax.management.remote.JMXConnectorFactory;

import java.util.*

 

public class TestJMXConnection {

public static void main(String[] args) throws Exception {

JMXConnector jmxCon = null;

try {

// Connect to JMXConnector

JMXServiceURL serviceUrl = new JMXServiceURL(
"service:jmx:t3://localhost:7001/jndi/weblogic.management.mbeanservers.runtime");

Hashtable env = new Hashtable();

env.put(JMXConnectorFactory.PROTOCOL_PROVIDER_PACKAGES, "weblogic.management.remote");

env.put(javax.naming.Context.SECURITY_PRINCIPAL, "weblogic");

env.put(javax.naming.Context.SECURITY_CREDENTIALS, "welcome1");

jmxCon = JMXConnectorFactory.newJMXConnector(serviceUrl, env);

jmxCon.connect();

 

// Access the MBean

MBeanServerConnection con = jmxCon.getMBeanServerConnection();

ObjectName oname = new ObjectName("test.domain:type=testType,name=testName,*");

Set queryResults = (Set)con.queryNames(oname, null);

for (ObjectName theName : queryResults) {

System.out.print("queryNames(): " + theName);

String partitionName = (String)con.getAttribute(theName, "PartitionName");

System.out.println(", Attribute PartitionName: " + partitionName);

}

} finally {

if (jmxCon != null)

jmxCon.close();

}

To compile and run this code, provide the wljmxclient.jar on the classpath, like:

$JAVA_HOME/bin/java -classpath $MW_HOME/wlserver/server/lib/wljmxclient.jar:. TestJMXConnection

You will get the results below:

Connecting to: service:jmx:t3://localhost:7001/jndi/weblogic.management.mbeanservers.runtime

queryNames(): test.domain:Partition=pepsi,type=testType,name=testName, Attribute PartitionName: pepsi

queryNames(): test.domain:Partition=coke,type=testType,name=testName,  Attribute PartitionName: coke

queryNames(): test.domain:type=testType,name=testName, Attribute PartitionName: DOMAIN

When change the code to use partition administrator "mtadmin1",

JMXServiceURL serviceUrl = new JMXServiceURL(
"service:jmx:t3://localhost:7001/coke/jndi/weblogic.management.mbeanservers.runtime");

env.put(javax.naming.Context.SECURITY_PRINCIPAL, "mtadmin1");

env.put(javax.naming.Context.SECURITY_CREDENTIALS, "welcome1");

Running the code will return only one MBean:

Connecting to: service:jmx:t3://localhost:7001/coke/jndi/weblogic.management.mbeanservers.runtime

queryNames(): test.domain:type=testType,name=testName,  Attribute PartitionName: coke

Similar results would be seen for the partition administrator for pepsi. If provide a pepsi specific JMX service url, only the MBean that belongs to the pepsi partition is returned.

2.4 Enable logging/debugging flags

If it appears the MBean is not behaving correctly in WebLogic Server 12.2.1, for example:

  • Partition administrator can see MBeans from global domain or other partitions when quiery the MBeans, or
  • Got JMX exceptions, e.g., javax.management.InstanceNotFoundException, when accessing an MBean

Try the followings to triage the errors:

  • If it's a connection problem in JConsole, add -debug on the JConsole command line when starting JConsole.
  • Partition administrator can see MBeans from global domain or other partitions when query the MBeans:
    • When connected by JMX clients, e.g., WLST, JConsole, JSR 160 APIs, make sure the host name on the service url matches the host name defined in the virtual target in the config/config.xml in the domain.
    • Make sure the uri prefix on the service url matches the uri prefix defined in the virtual target in the config/config.xml in the domain.
  • Got JMX exceptions, e.g., javax.management.InstanceNotFoundException, when accessing an MBean:

    • When the MBean belongs to a partition, make sure the partition is started. The application deployment is only happened when the partition is started.
    • Enable the debug flags during the server startup, like this:
      • -Dweblogic.StdoutDebugEnabled=true -Dweblogic.log.LogSeverity=Debug -Dweblogic.log.LoggerSeverity=Debug -Dweblogic.debug.DebugPartitionJMX=true -Dweblogic.debug.DebugCIC=false
    • Search server logs for the specific MBean ObjectName you are interested. Make sure the MBean you are debugging is registered in a correct partition context. Make sure the MBean operation is called in a correct partition context.

Here are sample debug messages for the MBean "test.domain:type=testType,name=testName" related to the MBean registration, queryNames() invocation, and getAttribute() invocation.

<Oct 21, 2015 11:36:43 PM PDT> <Debug> <PartitionJMX> <BEA-000000> <Calling register MBean test.domain:type=testType,name=testName in partition DOMAIN>

<Oct 21, 2015 11:36:44 PM PDT> <Debug> <PartitionJMX> <BEA-000000> <Calling register MBean test.domain:Partition=coke,type=testType,name=testName in partition coke>

<Oct 21, 2015 11:36:45 PM PDT> <Debug> <PartitionJMX> <BEA-000000> <Calling register MBean test.domain:Partition=pepsi,type=testType,name=testName in partition pepsi>

<Oct 21, 2015 11:36:56 PM PDT> <Debug> <PartitionJMX> <BEA-000000> <queryNames on MBean test.domain:Partition=coke,type=testType,name=testName,* in partition coke>

<Oct 21, 2015 11:36:56 PM PDT> <Debug> <MBeanCIC> <BEA-000000> <getAttribute: MBean: test.domain:Partition=coke,type=testType,name=testName, CIC: (pId = 2d044835-3ca9-4928-915f-6bd1d158f490, pName = coke, appId = helloTenant$coke, appName = helloTenant, appVersion = null, mId = null, compName = null)>

 

    • To check why the partition context is not right, turn on this debug flag, in addition to the debug flags mentioned above, when starting WLS servers:
      • -Dweblogic.debug.DebugCIC=true. Once this flag is used, there are a lot of messages logged into the server log. Search for the messages logged by DebugCIC logger, like 
        ExecuteThread: '<thread id #>' for queue: 'weblogic.kernel.Default (self-tuning)'): Pushed 

        and the messages logged by DebugPartitionJMX logger.

<Oct 21, 2015, 23:59:34 PDT> INVCTXT (24-[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'): Pushed [(pId = 0, pName = DOMAIN, appId = null, appName = null, appVersion = null, mId = null, compName = null)] on top of [(pId = 0, pName = DOMAIN, appId = null, appName = null, appVersion = null, mId = null, compName = null)]. New size is [2]. Pushed by [weblogic.application.ComponentInvocationContextManagerImpl.pushComponentInvocationContext(ComponentInvocationContextManagerImpl.java:173)

...

<Oct 21, 2015 11:59:34 PM PDT> <Debug> <PartitionJMX> <BEA-000000> <Calling register MBean test.domain:type=testType,name=testName in partition DOMAIN>

...

<Oct 21, 2015, 23:59:37 PDT> INVCTXT (29-[STANDBY] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'): Pushed [(pId = 2d044835-3ca9-4928-915f-6bd1d158f490, pName = coke, appId = helloTenant$coke, appName = helloTenant, appVersion = null, mId = null, compName = null)] on top of [(pId = 2d044835-3ca9-4928-915f-6bd1d158f490, pName = coke, appId = null, appName = null, appVersion = null, mId = null, compName = null)]. New size is [3]. Pushed by
[weblogic.application.ComponentInvocationContextManagerImpl.pushComponentInvocationContext(ComponentInvocationContextManagerImpl.java:173)

...

<Oct 21, 2015 11:59:37 PM PDT> <Debug> <PartitionJMX> <BEA-000000> <Calling register MBean test.domain:Partition=coke,type=testType,name=testName in partition coke>

3. Conclusion

WebLogic Server 12.2.1 provides a new feature: Multi-Tenancy (MT). With this feature, partition isolation is enforced. Applications can deploy to the domain and the partitions. Users in one partition cannot see the resources in other partitions, including MBeans registered by applications. In this article, a use case is used to briefly demonstrate how application MBeans are affected by partition isolation in regards to MBean visibility. For more detailed information, see "References" section.

4. References

WebLogic Server domain

Config Wizard

WLST command reference 

JConsole

Managing WebLogic Server with JConsole

JSR 160: Java Management Extensions Remote JMX api

WebLogic Server Security

WebLogic Server Deployment

 

 

Join the discussion

Comments ( 1 )
  • guest Tuesday, December 29, 2015

    Hi,

    I am trying to connect to non 12.2.1 weblogic instance from 12.2.1 WLST connect method. But, it errors out stating

    Traceback (innermost last):

    File "<console>", line 1, in ?

    File "<iostream>", line 19, in connect

    File "<iostream>", line 553, in raiseWLSTException

    WLSTException: Error occurred while performing connect : Error connecting to the server : The requested attribute is not exposed through JMX: getEditSessionConfigurationManager: com.bea:Name=sb2_domain,Type=DomainRuntime:EditSessionConfigurationManager

    Use dumpStack() to view the full stacktrace :

    I am using wlst.sh from $MW_HOME/oracle_common/common/bin as per Oracle standards


Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.