# Enabling and disabling JMX

You can use JMX management and monitoring both locally and remotely.

The term local means on the same host (machine) and running as the same user. For example, this means that local JMX access is possible only if the JVM you want to access is running on the same host and as the same user as the user who is running a JMX client such as JConsole (or a different user with sufficient file system permissions). In order to allow other users to access the JVM, or to allow access from other hosts, remote JMX must be enabled.

## Local JMX access

Local JMX management and monitoring are enabled by default on platforms that support JMX. (Java SE 8 Compact Profile 2, for example, does not support JMX.)

## Remote JMX access

Remote JMX management and monitoring is a powerful Java feature, allowing you to monitor a specific JVM from a remote location. Enabling remote JMX requires explicit actions by the JVM administrator, since it may involve exposing sensitive information about your system.

The most common way to enable remote JMX access to your JVM is to specify a TCP/IP port number and some basic security settings when you start the JVM. The security settings commonly include authentication and SSL (Secure Socket Layer). Derby attempts to use the JVM's built-in platform MBean server. For a list of current command line options (system properties) and their meanings, refer to the table in the Java SE Monitoring and Management Guide at http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html#gdeum .

The following topics describe ways to enable and disable remote JMX access.

- Enabling remote JMX with no authentication or SSL
  The following simple example starts the Derby Network Server on the command line with insecure remote JMX management and monitoring enabled, using an Oracle JDK JVM.
- Enabling remote JMX with password authentication only
  Some JVMs include built-in support for JMX password authentication.
- Enabling remote JMX with password authentication and SSL
  This example shows how to start the Network Server as follows.
- Simple authorization using an access file
  Some JVMs support a simple access file system for controlling JMX access.
- Fine-grained authorization using a security policy
  When you start the Network Server from the command line, it installs a security manager and a basic security policy by default.
- Disabling access to MBeans
  You may wish to disable or restrict access to MBeans in security-conscious environments. You can do this using either of the following techniques.

Parent topic: Using Java Management Extensions (JMX) technology
Related reference
Introduction to the Derby MBeans
Using JConsole to access the Derby MBeans
Using custom Java code to access the Derby MBeans
Troubleshooting JMX connection issues