Oracle Java Inventory

[mbartosh]

I have a need to gather Oracle Java usage because Oracle is going to start charging for maintenance releases of Java. The maintenance releases will be required for security reasons. We want to install Java only on machines that need to use Java. I was hoping that BFI would supply the needed usage data.

The problem I am having with BFI is that it usage data for java.exe is not separated by vendor or path. We have at least 4 different paths for Java.exe, and only one of them would be stand alone Oracle Java. The other java.exe would come bundled with another vendors product.

[itsmpro92]

@mbartosh Try looking at Reports -> Software Inventory -> Software Installations Report with a filter of Publisher Name contains Oracle.

In my environment I can see several entries for OpenJDK and Java Run Time Environment which have usage data, and the underlying signature points to java.exe.

[mbartosh]

@itsmpro92 - I did what you suggested, and I get the same results. When I click on details for one of the systems reporting java.exe, I get at least 3 different paths.

C:\Program Files (x86)\Java\jre1.8.0_181\bin
C:\Program Files (x86)\IBM\Client Access\JRE\bin
C:\Program Files (x86)\Calabrio\WFO_QM\Java\bin

Which java.exe is creating the usage?

[itsmpro92]

@mbartosh In addition to the list of locations where java.exe is found, there is also the detected Installation Path: C:\Program Files (x86)\Java\jre1.8.0_181\bin, which is required to identify Java Runtime Environment from Oracle.

This is not quite definitive as to which exact java executable has the usage data, but it does seem to point in the direction of Oracle Java. I will keep poking into the usage data and see if the file path is captured somewhere.

[itsmpro92]

@mbartosh You were right to be skeptical. I was disappointed to find that the matching of usage data is purely by process name alone.

I ran the following Relevance query on the machine showing Oracle Java Runtime Environment usage:

q: image paths of instances of application usage summaries "java.exe"
A: C:\IBM\TDI\V7.2\jvm\jre\bin\java.exe
A: C:\IBM\SMP\maximo\tools\java\jre\bin\java.exe

Both of these javas are from IBM, obviously. I then queried BigFix for the Total number of Runs:

q: total run count of application usage summaries "java.exe"
A: 192

This matches the reporting in BFI, as seen in the screenshot below. Clearly, the path of the executable is not taken into account when matching usage data from BigFix with usage signatures in BFI.

This is what the documentation has to say on the subject.

The usage data is first collected when the BigFix client is installed on an endpoint, and an application usage statistics is enabled. The statistics are displayed on the Metering Data report. When the processes are matched against usage signatures from the software catalog, or custom usage signatures, the statistics are available on the Software Classification panel.

You will have better results using an analysis in BigFix to capture the paths of the running java.exe processes.

[mbartosh]

@itsmpro92 Thanks for your great work on this. I wonder if an analysis would make any difference since there seems to be only one number stored for java.exe usage.

Do you have an idea what the relevance for an analysis would look like?

I have a case open with support. I will let you know what comes out of that.

[Tomasz_Stopa]

Mike - we are working on enabling Java detailed discovery and usage monitoring. I know you are in contact with BFI L3 support and already received some guidance how to achieve the goal, but let me briefly describe our plans here.

1. In December 2018 catalog we delivered update allowing for detailed Java discovery and added usage signatures (on Windows) so that use can be monitored. The solution works fully for situations when there is only one Java installed on computer. The limitation as of now is that we do not have binding of java process to java instance. This means that in case when there is multiple Java instances all of them show usage when even one of them is run

2. We have a limited availability code which you received (and which can be enabled by any other customer after contacting BFI support) which allows to monitor usage for each Java instance individually (based on matching paths from installation and process). At the moment this solution though is not yet available out of the box in BFI.

3. In next stage we plan to enable the solution from point 2) in BFI out of the box for Java. There is no committed delivery date yet for it but we hope to have it rather sooner than later.

[mbartosh]

Tomasz,

Will this Bigfix issue affect the results in BFI? It appears that the task “Initiate Software Scan” does use the Bigfix directory C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__Global\UsageData. To calculate usage.

Issue 159724 - Instances of Application Usage Summary wrongly calculates values for the same process in many paths

[Tomasz_Stopa]

Mike - that is correct. This issue will affect the usage data BFI provides, so you should use BigFix version (including Client) which has the issue already fixed. Which BigFix version are you running currently?

[mbartosh]

We are currently using 9.5.8.38. We are planning to upgrade to 9.5.11 next week.

[mbartosh]

Tomasz, I am still trying to get a handle on our Java inventory. I am using Bigfix inspectors to look at the usage data to determine the last used time. This is working well, and maybe it is the only answer to this problem. But, we continue to want to look at usage by path, and unfortunately Java can have multiple paths. I know you said that we can apply a patch to BFI to report usage by path, but I am not convinced that I am still going to get the data I want. I don’t see how you can get usage by path if there is only one usage number recorded in the .exe.stat file. Maybe this assumption is wrong, but the Bigfix inspector will only return one usage number, but it will return multiple paths.

Additionally, another problem I have is that the usage path is never removed. It seems to be a history of all paths that were ever used. For example, we had Tripwire installed on a number of machines. Tripwire uses java.exe. After removing Tripwire, the path is still reported even though Java is not being used from that path any longer. Also, we were using Java 7u51 and now we are using Java 8u181, but both paths appear.

[rafal_kudlacik]

Hi Mike,
single stat file can hold process usage data separately for different paths. QNA inspector will also show this:
Q: (name of it, total run counts of it, image paths of it) of instances of application usage summaries "java.exe"
A: java.exe, 227, C:\Program Files\ibm\BFI\jre\jre\bin\java.exe
A: java.exe, 3, C:\app\oracleuser\product\12.1.0\dbhome_1\jdk\bin\java.exe
A: java.exe, 108, C:\Program Files\ibm\BFI\jre\jre\bin\java.exe
A: java.exe, 44, C:\Program Files\ibm\BFI\jre\jre\bin\java.exe
A: java.exe, 0, C:\Program Files\ibm\LMT\jre\jre\bin\java.exe
T: 10637

Regarding second part of your question, I think this will not be a problem. Java usage will be matched by path, if a product will no longer under given path, then java usage from that path will not be matched with anything and will not be reported.

[mbartosh]

(name of it, total run counts of it, image paths of it) of instances of application usage summaries “java.exe”

Rafal, thank you so much. That solves a really big problem for me.