Building for the Splunk Platform

Splunk Java Agent ClassLoader test

baptco
New Member

Hello,

@Damien Dallimore : playing with https://github.com/damiendallimore/SplunkJavaAgent and tomcat-embedded Hybris solution, we couldn't forward much data to our Splunk instance...

The fact is the code checks if the agent classloader is equal to the current class loaded in the JVM. Using Java EE apps, we use many classloader and can't get the "right" data. So, for now, I commented out line 22 in SplunkClassFileTransformer.java (if (this.getClass().getClassLoader().equals(loader)) {)

This helped us to get all metric we were waiting for, thus using the agent whitelist mecanism.
What is your feedback about this?

Thank you for your time,
BC

Tags (3)
0 Karma

Damien_Dallimor
Ultra Champion

I originally put that classloader check in to ensure that the instrumented application would't crash with ClassNotFoundExceptions.

It's a sibling classloader issue. The Java Agent is loaded by the System ClassLoader. So if you have some classes loaded by a sibling classloader to the System classloader , then these classes will get instrumented with calls to some code in the Java Agent librarys. And because sibling classloaders can't see each others classes , you get Exceptions.

I could probably make the classloader check a bit more flexible ie: check that the class file being instrumented is in the same heirarchy as the java agent and is not in the bootstrap classloader (which is the parent of the System Classloader).

I've updated the latest code and release with the below code :

@Override
public byte[] transform(ClassLoader loader, String className,
        Class classBeingRedefined, ProtectionDomain protectionDomain,
        byte[] classFileBuffer) throws IllegalClassFormatException {

    boolean proceed = true;

    try {
        //a hacky test to ensure that the class being instrumented
        //can see the required SplunkJavaEgent classes
        loader.loadClass("com.splunk.javaagent.SplunkLogEvent");
    } catch (ClassNotFoundException e) {
        proceed = false;
    }

    if (proceed) {

        if (!SplunkJavaAgent.isBlackListed(className)
                && SplunkJavaAgent.isWhiteListed(className))
            return processClass(className, classBeingRedefined,
                    classFileBuffer);
        else
            return classFileBuffer;
    } else {
        return classFileBuffer;
    }
}
0 Karma

ppablo
Retired

Hi @baptco

I'd suggest emailing Damien directly ddallimore@splunk.com

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...