I blog at allzhere . Being in a department that does not allow installing tools related to profiling and other monitoring features; following is a link about a concept i leveraged at work to monitor web applications memory usage :
In such situations I generally strive to enable remote JMX on the JVM, so that tools such as VisualVM can be used to connect to to and take a look at what's going on inside of the JVM (and get heap and thread dumps if necessary) The enabling consists merely of setting properties at JVM startup time, so nothing needs to be installed; that should make it palatable to most sys admins.
The problem with JMX console is that the port needs to be opened, and that can be problematic. Also, you can change things using JMX, and I believe also inspect your HTTP sessions. If for some reasons, your developers have to be isolated from client data, Sys admins will not give you access because it is too versatile to give in developer hands. For us, the happy medium has been that when there are performance problems, the support team gives us thread/heap dumps, and we analyze it using the tools that we have. You don't need to install anything on the production machines
Obviously having JConsole is very nice, and I've been trying to educate our support people in JConsole, so they see the value in it, and install it