Splunk Java Agent ClassLoader test

[baptco]

Hello,

@Damien Dallimore : playing with https://github.com/damiendallimore/SplunkJavaAgent and tomcat-embedded Hybris solution, we couldn't forward much data to our Splunk instance...

The fact is the code checks if the agent classloader is equal to the current class loaded in the JVM. Using Java EE apps, we use many classloader and can't get the "right" data. So, for now, I commented out line 22 in SplunkClassFileTransformer.java (if (this.getClass().getClassLoader().equals(loader)) {)

This helped us to get all metric we were waiting for, thus using the agent whitelist mecanism.
What is your feedback about this?

Thank you for your time,
BC

[Damien_Dallimor]

I originally put that classloader check in to ensure that the instrumented application would't crash with ClassNotFoundExceptions.

It's a sibling classloader issue. The Java Agent is loaded by the System ClassLoader. So if you have some classes loaded by a sibling classloader to the System classloader , then these classes will get instrumented with calls to some code in the Java Agent librarys. And because sibling classloaders can't see each others classes , you get Exceptions.

I could probably make the classloader check a bit more flexible ie: check that the class file being instrumented is in the same heirarchy as the java agent and is not in the bootstrap classloader (which is the parent of the System Classloader).

I've updated the latest code and release with the below code :

@Override
public byte[] transform(ClassLoader loader, String className,
        Class classBeingRedefined, ProtectionDomain protectionDomain,
        byte[] classFileBuffer) throws IllegalClassFormatException {

    boolean proceed = true;

    try {
        //a hacky test to ensure that the class being instrumented
        //can see the required SplunkJavaEgent classes
        loader.loadClass("com.splunk.javaagent.SplunkLogEvent");
    } catch (ClassNotFoundException e) {
        proceed = false;
    }

    if (proceed) {

        if (!SplunkJavaAgent.isBlackListed(className)
                && SplunkJavaAgent.isWhiteListed(className))
            return processClass(className, classBeingRedefined,
                    classFileBuffer);
        else
            return classFileBuffer;
    } else {
        return classFileBuffer;
    }
}

[ppablo]

Hi @baptco

I'd suggest emailing Damien directly ddallimore@splunk.com