Set up Java application (JMX) monitoring, CentOS 7

If Java application is running on remote host then specify the binding address at "java.rmi.server.hostname": 
JAVA_OPTIONS="$JAVA_OPTIONS -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=12345 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=10.133.253.43"
More at:https://docs.oracle.com/javase/8/docs/technotes/guides/rmi/javarmiproperties.html

JMX stands for Java TM Management Extensions.

Install tomcat: 
yum install tomcat
Open tomcat configuration: 
vi /etc/tomcat/tomcat.conf
Make sure "JAVA_OPTS" has some options configured: 
JAVA_OPTS="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=12345 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false"
These are all custom settings which are active in "tomcat.conf": 
TOMCAT_CFG_LOADED="1"
TOMCATS_BASE="/var/lib/tomcats/"
JAVA_HOME="/usr/lib/jvm/jre"
CATALINA_HOME="/usr/share/tomcat"
CATALINA_TMPDIR="/var/cache/tomcat/temp"
JAVA_OPTS="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=12345 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false"
SECURITY_MANAGER="false"
Start tomcat: 
systemctl start tomcat
Check if it running: 
systemctl status tomcat
If not the try to disable selinux: 
setenforce 0
Start tomcat again: 
systemctl start tomcat
Check what exactly has been denied: 
grep "denied.*java" /var/log/audit/audit.log
This will output something like: 
type=AVC msg=audit(1523253480.533:93): avc:  denied  { name_bind } for  pid=996 comm="java" src=12345 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1523348846.615:93): avc:  denied  { name_bind } for  pid=998 comm="java" src=12345 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1523425859.329:93): avc:  denied  { name_bind } for  pid=985 comm="java" src=12345 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1523512263.912:93): avc:  denied  { name_bind } for  pid=989 comm="java" src=12345 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1523604058.805:93): avc:  denied  { name_bind } for  pid=991 comm="java" src=12345 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1523858025.936:92): avc:  denied  { name_bind } for  pid=987 comm="java" src=12345 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1523859520.663:142): avc:  denied  { name_bind } for  pid=1847 comm="java" src=12345 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1523859553.822:147): avc:  denied  { name_bind } for  pid=1890 comm="java" src=12345 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
Create a new policy with name "zabbix_java" and iclude all these denied definitions inside: 
grep "denied.*java" /var/log/audit/audit.log | audit2allow -M zabbix_java
semodule -i zabbix_java.pp
I can now enable back selinux security: 
setenforce 1
Restart tomcat and make sure it is still running: 
systemctl stop tomcat
systemctl start tomcat
systemctl status tomcat
Install zabbix java gateway: 
yum install zabbix-java-gateway -y
Look if there is any configuration files created: 
ls /etc/zabbix/*gateway*
Start java gateway: 
systemctl start zabbix-java-gateway
Check if gateway is running: 
systemctl status zabbix-java-gateway
Modify zabbix server conf: 
vi /etc/zabbix/zabbix_server.conf
Ensure I got the lines: 
JavaGateway=127.0.0.1
StartJavaPollers=5
Restart zabbix server: 
systemctl restart zabbix-server
Make sure server is running: 
systemctl status zabbix-server
Make sure gateway is running: 
systemctl status zabbix-java-gateway
Configure host at zabbix server side:
Add appropriate template:
Make sure the latest data come:
Take a not that some items are not supported it this test but at least half is supported :)
Byat