"inetquestion" <inetquestion@hotmail.com> said:

You wrote there were things disabled because of security reasons.
Now, you'll need to dig out what are these security reasons.
Is the reason for removal that an implementation of some functionality
is seen as a risk to security, or is the risk in the fuctionality
itself. So, f.ex. you tell that the "application that comes with tomcat
for status" is disabled. Now, is the risk in:
- the functionality of providing status
 (in which case you'd break your security model with any piece of
  code providing this functionality)
- the Tomcat status implementation for providing status
 (in which case providing status is ok, but someone considers the
  Tomcat implementation of this unsafe, and an alternative
  implementation for the same functionality would be acceptable,
  but bringing back in the Tomcat status implementation would
  be considered a security risk)

JMX is "Java Management Extension"; a standard for providing an API
for extracting management information from a Java application.

Here's one article discussing JMX and Tomcat; however this
also mixes in Tomcat clustering, but not too much; the information
can also be used for a standalone Tomcat;
http://www.javaworld.com/javaworld/jw-08-2005/jw-0801-jmx.html