To help you work through a problem with Tableau Server, Tableau Support may ask you to enable the server's JMX ports. These ports can be useful for monitoring and troubleshooting, usually with a tool like JConsole. In versions 2022.1 and later, the JMX ports can be enabled securely and this is the recommended method. In versions earlier than 2022.1, you can only enable the ports unsecured.

Enable secure JMX ports

Beginning with version 2022.1 of Tableau Server, you can enable JMX ports securely. This procedure explains how to enable secure JMX. To enable JMX in earlier versions, see Enable unsecured JMX ports below.

To enable secure JMX ports on Tableau Server:

  1. Open a command prompt as a user with administrator access to the computer where TSM is installed.

  2. Run this command:

    tsm maintenance jmx enable

    The command has several options you can provide when running it. If you do not provide any options when you run the command, you will be prompted for options based on the answers you give.

    For example:

    C:\Windows\system32>tsm maintenance jmx enable
    We do not recommend you enable JMX unsecured on a production environment. Would you like to enable security features for JMX?
    (y/n): y
    JMX access is readonly by default. Would you like to add readwrite access?
    (y/n): n
    Would you like to enable SSL?
    (y/n): y
    Would you like to require client authentication (mTLS)?
    (y/n): n
    Enabling JMX with the specified settings. This will perform a server restart. Do you want to continue?
    (y/n): y
    Starting enable JMX asynchronous job.

    For more information on the command and its options, see tsm maintenance jmx enable.

Enable unsecured JMX ports

For versions of Tableau Server earlier than 2022.1.0, if you are enabling JMX ports they can only be enabled unsecured.

Important Enabling unsecured JMX ports can introduce some security risk. We strongly recommend using secure JMX. If you do not have a version of Tableau Server that supports this, be aware of the risk and mitigate it by limiting access to the JMX ports to the fewest number of clients that's practical for your scenario. You typically limit access using the host's firewall rules, an external security device, or routing rules.

To enable unsecured JMX ports on Tableau Server:

  1. Stop the server.

  2. Enter the following command:

                                            tsm configuration set -k service.jmx_enabled -v true
                                        
  3. Apply pending changes:

                                            tsm pending-changes apply
                                        

    If the pending changes require a server restart, the pending-changes apply command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the --ignore-prompt option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see tsm pending-changes apply.

  4. Restart the Coordination Service and TSM Administration Controller:

    net stop appzookeeper_0

    net start appzookeeper_0

    net stop tabadmincontroller_0

    net start tabadmincontroller_0

    Note: You must run these commands as an administrator from a command prompt. Depending on how your computer is configured, you may need to run them in the C:\Windows\System32 folder.

    It may take a few minutes for tabadmincontroller to restart. If you attempt to apply pending changes in the next step before the controller has fully restarted, TSM will not be able to connect to the controller. You can verify that the controller is running by using the tsm status -v command. Tableau Server Administration Controller should be listed as "is running".

  5. Start the server.

How the JMX Ports Are Determined

By default, the JMX ports assigned dynamically, from within a range of available ports. For details on how port assignment is done, and how to override dynamic mapping, see Tableau Services Manager Ports.

Thanks for your feedback!