FAQ

End of Public updates, Oracle will not continue to release public updates of Java SE 8, see Oracle Java SE Support Roadmap.

This mean in effect from January 2019: “If you are acting on behalf of an ENTERPRISE, Oracle recommends you review the roadmap information for Java SE 8 and beyond and begin to assess your ongoing Java support requirements in order to migrate to a later release or obtain a Java SE Subscription, as appropriate, on a timely basis.”

Our tool focusses on the critcal issues of Oracle Java Licensing, it collects more data about Java than most Discovery and Invetory tools. Most tools do not yet look at the commercial features in use that are need to understand whether you have risks in your Oracle Java Licensing. For example:

• Is you tool checking if the Java Flight recorder has saved any files?
• Is your tool checking for procesess running relating to Advanced Management Console?
• Has your tool been updated to include recognition techniques to understand Oracle Java Commercial usage.
  

Our tool collects all the relevant data you need to make sure you understand and minimize your risks.

The following scenarios would need licensing

• Production Environments
• Not General Desktop Computing Environments
• Provided free with some versions of Weblogic

Usage of the Following Commercial Features:

Java Flight Recorder

“Java Flight Recorder (JFR) is a tool for collecting diagnostic and profiling data about a running Java application.” It needs to be activated by running the Java Application with the following switch:

-XX:+UnlockCommercialFeatures

Java Mission Control

“Java Flight Recorder and Java Mission Control together create a complete tool chain to continuously collect low level and detailed runtime information enabling after-the-fact incident analysis”

 Basically, it uses the data collected by the Flight recorder to enable you to understand any performance related issues with your Java applications.

Java Advanced Management Console

According to Oracle “The Java Advanced Management Console (AMC) offers system administrators greater and easier control in managing Java version compatibility and security updates for desktops within their enterprise and for ISVs with Java-based applications and solutions.”

What is it really? The AMC, is a tool for collecting usage and version information about deployed Java in your business. “Track and manage at scale, Usage Tracking and Deployment rule sets”

Microsoft Windows Installer (MSI) Enterprise JRE Installer

Again according to Oracle: “The “MSI Enterprise JRE Installer”, or “Java MSI Installer”, allows system administrators to quickly and consistently roll out pre-configured Oracle JRE updates to Windows systems via automation tools. It is a commercial feature entitlement for Java SE Advanced and Java SE Advanced Desktop customers. The alternative to the Java MSI Installer is to use the public “exe” installer, which is designed for manual installation on one machine at a time.”

What is it? Why use it? Oracle now releases 4 Java updates a year, and they believe that for large enterprises to update Java that much is a burden, so they have created an MSI updater that makes it easier.

JRockit Flight Recorder

Very similar to the Java Flight recorder, it tracks how the JRockit  Java application is working, again needs a command line to execuite:

-XX:StartFlightRecording=duration=<duration>,filename=<filename>

What is it? Why use it? If you are using JRockit in your organization then you are very likely using this feature already.

JRockit is a Java Virtual Machine.

JRockit Mission Control Console

According to Oracle “Oracle JRockit Mission Control is a set of powerful tools running on the Oracle JRockit JVM. These tools deliver advanced, unobtrusive JVM monitoring and management, suitable for use both in development and production environments. “

JRockit Mission Control Memory Leak Detector and JRockit Real Time, Deterministic GC

What is it? Why use it? Again, this is all part of the JRockit tool sets as described above.

JRE Usage Tracking

In Oracle’s own words: “Java Usage Tracker tracks how Oracle Java SE Advanced and Oracle Java SE Suite Java Runtime Environments (JREs) are being used in your systems. The output of Java Usage Tracker is a plain text, comma-separated record that contains the JRE version, the application being run, and other details. This record is appended to a file or sent over the network in a User Datagram Protocol (UDP) packet.”

In fact this is the tool Oracle recommend you use to check what you need to license, however you need a license for it first.

All our customers are consistant with demanding that our products are Secure. We have designed our tools to ensure that:

• We never ask for or get access to any customer data.
• The customer can expressly indiactes that wish to share data, in which case we will sign an NDA for that purpose. Please get in touch with us on our Contact Page 
• Our tools not trasmit any data to us.
• All the data the tool collects is held within your environment.
• The tool is collecting only the data required to fo the job, for example, we are looking for specific files, so we search the operating system for those files, we do not collect and store all the files and locations when collecting the data.

Application Security Overview
Application Highlights
The application is installed locally. It is a WPF C# application with an SQLite Backend Database.
The application has no connectivity to the internet, updates are manually applied via software download. Our team has no access to the systems or backend Database.
Passwords:

Passwords entered into the application are stared out on entry.
Passwords are used for connection to assets that will be audited.
Passwords are stored encrypted in the Backend Database. SQLite Databases are encrypted using a 128-bit RC4 stream algorithm
Connection to the Backend Database is not possible outside of the application as it is encrypted as above. The connection string is encrypted to the application when installed

Asset Connectivity:
We recommend a Service account is used to connect to any asset, for Windows and Linux.
SSH is used for Linux connections.
WMI and WIN RM are used to collect data for windows connections.

Collected data
IP address, Hostname, Application and version of Java installed, Running Processes.

Please see our website terms and condition for more information.