Giter Club home page Giter Club logo

jmx2graphite's Introduction

example workflow name

jmx2graphite

jmx2graphite is a one liner tool for polling JMX and writes into Graphite (every 30 seconds by default). You install & run it on every machine you want to poll its JMX.

Currently it has two flavors:

  1. Docker image which reads JMX from a jolokia agent running on a JVM, since exposing JMX is the simplest and easiest through Jolokia agent (1 liner - see below).
  2. Run as a java agent, and get metrics directly from MBean Platform

The metrics reported have the following names template:

[service-name].[service-host].[metric-name]

  • service-name is a parameter you supply when you run jmx2graphite. For example "LogReceiever", or "FooBackend"
  • service-host is a parameter you supply when you run jmx2graphite. If not supplied it's the hostname of the jolokia URL. For example: "172_1_1_2" or "log-receiver-1_foo_com"
  • metric-name the name of the metric taken when polling Jolokia. For example: java_lang.type_Memory.HeapMemoryUsage.used

How to run?

Using Docker (preferred)

If you don't have docker, install it first - instructions here.

Run the docker either with environment variables or with a configuration file.

Docker with env variables

docker run -i -t -d --name jmx2graphite \
   -e "JOLOKIA_URL=http://172.1.1.2:11001/jolokia/" \
   -e "SERVICE_NAME=MyApp" \
   -e "GRAPHITE_HOST=graphite.foo.com" \
   -e "GRAPHITE_PROTOCOL=pickled" \
   -v /var/log/jmx2graphite:/var/log/jmx2graphite \
   --rm=true \
   logzio/jmx2graphite

Environment variables

  • JOLOKIA_URL: The full URL to jolokia on the JVM you want to sample. When jolokia (and the java app) is running inside a docker container there are two ways to specify the host in the jolokia URL so this URL will be reachable by jmx2graphite which also runs inside a docker instance:
    • The easy one: On the docker running your java app and Jolokia, makes sure to expose the jolokia port (using -v), and then use the host IP of the machine running the dockers.
    • Container linking: You can use a hostname you invent like "myapp.com", and then when running jmx2graphite using Docker, add the option: --link myservice-docker-name:myapp.com". So if your app is running in docker named "crazy_service" then you would write jolokia URL as "http://myapp.com:8778/jolokia", and when running jmx2graphite using docker add the option "--link crazy_service:myapp.com". What this does is add mapping between the host name myapp.com to the internal IP of the docker running your service to the /etc/hosts file.
  • SERVICE_NAME: The name of the service (it's role).
  • GRAPHITE_HOST: The hostname/IP of graphite
  • GRAPHITE_PROTOCOL: Protocol for graphite communication. Possible values: udp, tcp, pickled

Optional environment variables

  • GRAPHITE_PORT: Protocol port of graphite. Defaults to 2004.
  • SERVICE_HOST: By default the host is taken from Jolokia URL and serves as the service host, unless you use this variable.
  • INTERVAL_IN_SEC: By default 30 seconds unless you use this variable.
  • LOG_LEVEL: Configure Log Level [any of OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE, ALL]
  • WHITE_LIST_REGEX: filter out unwanted metrics with whitelist regex.
  • BLACK_LIST_REGEX: filter out unwanted metrics with blacklist regex.

Docker with config file

Create a .conf file, set the input parameter and provide it to the docker.

See our sample config file].

You can find a complete list of the required parameters here

docker run -d --name jmx2graphite -v path/to/config/myConfig.conf:/application.conf logzio/jmx2graphite

Note: The config file at the docker end must be name application.conf

Rest of command

  • --rm=true: removes the docker image created upon using docker run command, so you can just call docker run command again.

Using bash + Jolokia agent

  1. get the java agent jar from the releases page

  2. Create a config file that will contain the input parameters, see our sample config file - The mandatory items are:

    1. service.jolokiaFullUrl - Fill in the full URL to the JVM running Jolokia (It exposes your JMX as a REST service, normally under port 8778).
    2. service.name - The role name of the service.
    3. graphite.hostname - Graphite host name the metrics will be sent to
    4. graphite.port - The port which Graphite listen to.
    5. graphite.connectTimeout - Timeout in seconds for the connection with graphite.
    6. graphite.socketTimeout - Timeout in seconds for the socket.
  3. Run your app with Jolokia agent (instructions below)

  4. run the jar: java -jar jmx2graphite.jar

  5. If you wish to run this as a service you need to create a service wrapper for it. Any pull requests for making it are welcome!

As Java Agent

This lib can also get the metrics from MBean Platform instead of jolokia. In order to do so, we need to run inside the JVM.

  • First, get the java agent jar from the releases page
  • Modify your app JVM arguments and add the following: java -javaagent:/path/to/jmx2graphite-1.3.1-javaagent.jar=GRAPHITE_HOSTNAME=graphite.host,SERVICE_NAME=Myservice ...
  • The parameters are key-value pairs, in the format of key=value;key=value;... or key=value,key=value,...
  • The parameters names and functions are exactly as described in Environment Variables section. (Except no need to specify JOLOKIA_URL of course)
  • The javaagent.jar is an "Uber-Jar" that shades all of its dependencies inside, to prevent class collisions
  • For example: java -javaagent:jmx2graphite.jar=GRAPHITE_HOSTNAME=graphite.example.com,SERVICE_NAME=PROD.MyAwesomeCategory example.jar

How to expose JMX Metrics using Jolokia Agent

  1. Download Jolokia JVM Agent JAR file here.
  2. Add the following command line option to your line running java:
-javaagent:path-to-jolokia-jar-file.jar

For example:

-javaagent:/opt/jolokia/jolokia-jvm-1.3.2-agent.jar

By default it exposes an HTTP REST interface on port 8778. See here if you want to change it and configure it more. We run all of ours apps using Docker, so to avoid clashes when we map the 8778 port to a unique external port belonging only to this application.

Installing and Configuring Graphite

If you never installed Graphite, this small guide below might be a good place to start. I'm using Docker since it's very easy to install this way.

Installing Graphite

We will install Graphite using a great docker image by hopsoft. I tried several and it was by far the easiest to work with.

  1. Run the following to get basic Graphite up and running

    docker run -d \
      --name graphite \
      -p 80:80 \
      -p 2003:2003 \
      -p 2004:2004 \
      -p 8125:8125/udp \
      -p 8126:8126 \
      hopsoft/graphite-statsd
    
  2. Now, let's copy out all of its existing configuration files so it will be easy to modify. I will assume you will place it at /home/ubuntu

    cd /home/ubuntu
    mkdir graphite
    docker cp graphite:/opt/graphite/conf graphite
    docker cp graphite:/opt/graphite/webapp/graphite graphite/webapp
    
  3. Stop graphite by running docker stop graphite

  4. Configuring Graphite: Now edit the following files:

  5. /home/ubuntu/graphite/conf/carbon.conf:

    • MAX_CREATES_PER_MINUTE: Make sure to place high values - for example 10000. The default of 50 means that the first time you run jmx2graphite, all of your metrics are reported at once. If you have more than 50, all other metrics will be dropped.
    • MAX_UPDATES_PER_SECOND: I read a lot there should be a formula for calcualting the value for this field, but that is once you reach high I/O disk utilization. For now, simply place 10000 value there. Otherwise you will get a 1-2 minute lag from the moment jmx2graphite pushes the metric to Graphite until it is viewable in Graphite dashboard
  6. /home/ubuntu/graphite/conf/storage-schemas.conf:

    • in the default section (default_1min_for_1day) make sure retentions is set to the same interval as you are using in jmx2graphite (30seconds by default). Here is an example
    [default_1min_for_1day]
    pattern = .*
    retentions = 30s:24h,1min:7d,10min:1800d
    

    If you have 10s:24h then when doing derivative, you will get null values for each missing 2 points in the 30sec window and the graph will be empty

  7. Create some directories which normally are created by the docker image but since we're mounting /var/log to an empty directory of ours in the host, they don't exists:

    mkdir -p /home/ubuntu/log/nginx
    mkdir -p /home/ubuntu/log/carbon
    mkdir -p /home/ubuntu/log/graphite
  8. Run Graphite. I use the following short bash script run-graphite.sh:

    #!/bin/bash
     docker run -d \
      --name graphite \
      --rm=true \
      --restart=always \
      -p 80:80 \
      -p 2003:2003 \
      -p 2004:2004 \
      -p 8125:8125/udp \
      -p 8126:8126 \
      -v /home/ubuntu/graphite/storage:/opt/graphite/storage \
      -v /home/ubuntu/log:/var/log \
      -v /home/ubuntu/graphite/conf:/opt/graphite/conf \
      -v /home/ubuntu/graphite/webapp/graphite:/opt/graphite/webapp/graphite \
      hopsoft/graphite-statsd

Configuring Graphite

If you have an existing Graphite installation see the section above "configuring Graphite: Now edit the following files:".

Motivation

I was looking for a tool I can just drop in place, have a 1-liner run command which will then run every 10 seconds, poll my JVM JMX entirely and dump it to Graphite. Of course I started Googling and saw the following:

  • JMXTrans I had several issues which got me stomped:

    • You can't instruct it to sample all JMX metrics. Instead you have to specify exactly which MBeans which you want and also their attributes - this can be quite a long list. In order to compose this list you have to fire up JMX Console, find the bean you are interested at, extract its name and add several lines of config to your config file. Then you have to copy the attribute names you want from this mbean. Rinse and repeat for every bean. For me, I just wanted all, since when you benchmark a JVM you don't know where the problem is so you want to start with everything at hand. From my handful experience with JMX, polling all beans doesn't impact the running JVM. Graphite can be boasted with hardware if it will become the bottleneck. Essentially I would like to add blacklist/whitelist to jmx2graphite, but it should be straightforward wildcard expession and not regular expression based.
    • I had trouble understanding how to configure it polling several JVMs. It invovles writing a YAML file and then running a CLI for generating the configuration file for JMXTrans. Too complicated in my opinion.
  • jmxproxy It's an HTTP REST server allowing you to fetch mbeans from a given JVM using REST to it. You are supposed to have one per your cluster. Great work there. The biggest drawback here was that you have to specify a predefined list of mbeans to retrieve - I wanted it all - it's too much work to compose the list of mbeans for: Camel, Kafka, Zookeeper, your own, etc.

  • Sensu plugin - Aside from the prequisite of Sensu, again you must supply a predefined list of beans.

  • Collectd plugin - Must have collectd and also, same as before, specify a list of mbeans and their attributes in a quite complicated config file. This also requires installing another collectd plugin.

  • Fluentd JMX plugin - Must have fluentd installed. Must specify list of mbeans and their attributes. Works against Jolokia only (same as jmx2graphite)

So after spending roughly 1.5 days fighting with those tools and not getting what I wanted, I sat down to write my own.

Why Docker?

Docker enables jmx2graphite to install and run in one command line! Just about any other solution will requires more steps for installation, and not to mention the development efforts.

Why Jolokia?

  • When running JVM application inside docker it is sometime quite complex getting JMX to work, especially around ports.
  • Composing JMX URI seems very complicated and not intuitive. Jolokia REST endpoint is straight forward.
  • Can catch reading several MBeans into one call (not using this feature yet though)

Features Roadmap

  • Add Integration Tests using Vagrant
  • Add support for reading using JMX RMI protocol for those not using Jolokia.
  • Support whiltelisting/blacklisting for metrics

Contributing

We welcome any contribution! You can help in the following way:

  • Open an issue (Bug, Feature request, etc)
  • Pull requests for any addition you can think of

Building and Deploying

Build

Build Java Agent

mvn clean install

Deploy

docker login 
docker push logzio/jmx2graphite

Changelog

  • v1.4.4
    • dependencies
    • remove minor deprecation
  • v1.4.3
    • update dependencies
  • v1.4.0
    • add an option to filter out unwanted metrics with white/black-list regex
  • v1.3.2
    • add an option to configure the omitted log level.
  • v1.3.1
    • support external config file when using with jolokia agent
    • provide docker for jmx2graphite when using with jolokia agent
  • v1.3
    • jmx2graphite is now a maven project, Hooray!
  • v1.2.5
    • This release adds support for commas as argument delimiters when using as a Java agent. If you experience issues when using semicolons as argument delimiters, try using a comma.
  • v1.2.3
    • Fixed an NPE when poll() resulted in MBeanClient.MBeanClientPollingFailure
  • v1.2.1
    • Fixed a bug when no protocol was provided
    • Fixed log4j dependencies
  • v1.2.0
    • Changed Docker image to be based upon Alpine and OpenJDK
  • v1.1.1
    • Added support for 2 additional protocols when sending metrics to Graphite: tcp, udp. This is in addition to the existing Pickle protocol (Contributed by: jdavisonc)
  • v1.1.0
    • Major refactoring - jmx2graphite now comes in two flavors: standalone using docker as it was in 1.0.x, and as a Java Agent running alongside you app. This is useful if your app is running inside Docker on Mesos and coupling it with another container just to read its metrics contradicts the Mesos paradigm.
    • Added java agent capabilities, through MBeans Platform
    • Changed logback to log4j
  • v1.0.8
    • First migration step to Kotlin language
  • v1.0.7
    • Issue #2: Log file appender will show TRACE debug level as well
  • v1.0.6
    • Fixes #4: logback will save history for 7 days
  • v1.0.5
    • logback.xml now scan it self every 10 seconds instead of 30 to get that fast feedback loop
    • Added an XML element sample to logback.xml to trace the metrics that are sent to Graphite
  • v1.0.4
    • logback.xml now scan it self every 30 seconds. Improved error message printed to the log
  • v1.0.3
    • Wouldn't recover from Graphite server restart (failed on broken pipe for a long time)
  • v1.0.2
    • MBean name properties (the part that is after the ':') retrieved from jolokia were sorted lexically by property name. This removed any creation order of those properties which actually represent a tree path, thus the fix is to maintain the creation order.
  • v1.0.1
    • MBean name got its dots converted into _ which results in flattening your beans too much. Now the dot is kept.

#License

See the LICENSE file for license rights and limitations (MIT).

jmx2graphite's People

Contributors

asafm avatar bbranquinho avatar christophkreutzer23 avatar danielfidalgo avatar dependabot[bot] avatar electron0zero avatar er-rishi avatar jdavisonc avatar jlleitschuh avatar luneo7 avatar nasis avatar roiravhon avatar snyk-bot avatar yyyogev avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

jmx2graphite's Issues

Documentation error for docker deployment with config file

The README.md file states the following command should be run to bring up a docker container with a configuration file:

docker run -d -name jmx2graphtite -v path/to/config/myConfig.conf:application.conf logizo/jmx2graphite

This seems to have several typos:

  • the name argument should be --name, not -name
  • typo in "jmx2graphtite" - doesn't cause issues, but confusing
  • typo in image - should be "logzio" not "logizo"

CVE-2020-9546 (Medium) detected in jackson-databind-2.9.10.2.jar

CVE-2020-9546 - Medium Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /tmp/ws-scm/jmx2graphite/pom.xml

Path to vulnerable library: downloadResource_735c409f-ec0a-4787-a1e7-5c39db3285be/20200211101557/jackson-databind-2.9.10.2.jar

Dependency Hierarchy:

  • jackson-databind-2.9.10.2.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Publish Date: 2020-03-02

URL: CVE-2020-9546

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9546

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3


  • Check this box to open an automated fix PR

WS-2017-3734 (Medium) detected in httpclient-4.5.1.jar

WS-2017-3734 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.5.1.jar

Apache HttpComponents Client

Library home page: http://hc.apache.org/httpcomponents-client

Path to dependency file: /jmx2graphite/pom.xml

Path to vulnerable library: /root/.m2/repository/org/apache/httpcomponents/httpclient/4.5.1/httpclient-4.5.1.jar

Dependency Hierarchy:

  • fluent-hc-4.5.1.jar (Root Library)
    • httpclient-4.5.1.jar (Vulnerable Library)

Found in HEAD commit: 8602a323d23ee90e4a17a1b87a682d8babadbc5d

Vulnerability Details

Apache httpclient before 4.5.3 are vulnerable to Directory Traversal. The user-provided path was able to override the specified host, resulting in giving network access to a sensitive environment.

Publish Date: 2019-05-30

URL: WS-2017-3734

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/HTTPCLIENT-1803

Release Date: 2019-05-30

Fix Resolution: httpcore-5.0-alpha3-RC1

WS-2018-0124 Medium Severity Vulnerability detected by WhiteSource

WS-2018-0124 - Medium Severity Vulnerability

Vulnerable Library - jackson-core-2.7.4.jar

Core Jackson abstractions, basic JSON streaming API implementation

path: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-core/2.7.4/b8f38a249116b66d804a5ca2b14a3459b7913a94/jackson-core-2.7.4.jar

Library home page: https://github.com/FasterXML/jackson-core

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Root Library)
    • jackson-core-2.7.4.jar (Vulnerable Library)

Vulnerability Details

In Jackson Core before version 2.8.6 if the REST endpoint consumes POST requests with JSON or XML data and data are invalid, the first unrecognized token is printed to server.log. If the first token is word of length 10MB, the whole word is printed. This is potentially dangerous and can be used to attack the server by filling the disk with logs.

Publish Date: 2018-06-24

URL: WS-2018-0124

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://issues.jboss.org/browse/JBEAP-6316

Release Date: 2018-01-24

Fix Resolution: 2.8.6


Step up your Open Source Security Game with WhiteSource here

CVE-2020-9548 (Medium) detected in jackson-databind-2.9.10.2.jar

CVE-2020-9548 - Medium Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /tmp/ws-scm/jmx2graphite/pom.xml

Path to vulnerable library: downloadResource_735c409f-ec0a-4787-a1e7-5c39db3285be/20200211101557/jackson-databind-2.9.10.2.jar

Dependency Hierarchy:

  • jackson-databind-2.9.10.2.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Publish Date: 2020-03-02

URL: CVE-2020-9548

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9548

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3


  • Check this box to open an automated fix PR

Support TLS Graphite endpoints

I'd like to have support for TLS connections. This should only involve adding a configuration flag, and using an SSLSocketFactory instead of a regular one when configured. If that a useful feature, I'll be happy to put up a PR.

WS-2009-0001 Low Severity Vulnerability detected by WhiteSource

WS-2009-0001 - Low Severity Vulnerability

Vulnerable Library - commons-codec-1.9.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

path: /root/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.9/9ce04e34240f674bc72680f8b843b1457383161a/commons-codec-1.9.jar

Library home page: http://commons.apache.org/proper/commons-codec/

Dependency Hierarchy:

  • fluent-hc-4.5.1.jar (Root Library)
    • httpclient-4.5.1.jar
      • commons-codec-1.9.jar (Vulnerable Library)

Vulnerability Details

Not all "business" method implementations of public API in Apache Commons Codec 1.x are thread safe, which might disclose the wrong data or allow an attacker to change non-private fields.

Updated 2018-10-07 - an additional review by WhiteSource research team could not indicate on a clear security vulnerability

Publish Date: 2007-10-07

URL: WS-2009-0001

CVSS 2 Score Details (0.0)

Base Score Metrics not available


Step up your Open Source Security Game with WhiteSource here

Problem with WHITE_LIST_REGEX

We are using jmx2graphite to export MBean metrics from our Ignite Cluster to Grafana. To filter out the number of metrics being exported, we are using WHITE_LIST_REGEX.

-javaagent:/opt/ignite/jmx2graphite-1.5.0-javaagent.jar=GRAPHITE_HOSTNAME=carbon.example.com,SERVICE_NAME=staging.ignite,GRAPHITE_PORT=30023,GRAPHITE_PROTOCOL=tcp,INTERVAL_IN_SEC=30,WHITE_LIST_REGEX=^.*java.lang.*$"

We are able to see the metrics in Grafana and here is the entry from /var/log/syslog

Jan 25 08:14:40 ignite-staging-0 service.sh[10830]: 21/01/25 08:14:40 INFO jmx2graphite.MetricsPipeline: Filtered out 12 metrics out of 28 after white/blacklisting

Now when we modify the WHITE_LIST_REGEX to filter type_Runtime path

-javaagent:/opt/ignite/jmx2graphite-1.5.0-javaagent.jar=GRAPHITE_HOSTNAME=carbon.example.com,SERVICE_NAME=staging.ignite,GRAPHITE_PORT=30023,GRAPHITE_PROTOCOL=tcp,INTERVAL_IN_SEC=30,WHITE_LIST_REGEX=^.*java.lang.type_Runtime.*$

we don't see the metrics for this path in Grafana. This is the entry from /var/log/syslog

Jan 25 09:19:59 ignite-staging-0 service.sh[12960]: 21/01/25 09:19:59 INFO jmx2graphite.MetricsPipeline: Filtered out 28 metrics out of 28 after white/blacklisting

Note: We are sure this path java.lang.type_Runtime exists because we were able to see its values in the first case.

Please help with this issue.
Thank you!

Can you filter metrics taken from jolokia?

Hello,
Seems like the jmx2graphite take all metrics and sends them to graphite. I am using jolokia to expose jmx from Cassandra clusters which finds around 4097 metric beans which translates to 15011 metrics per minute sent to my graphite cluster. It depletes the disk space in the graphite cluster really fast.
Is there a way in which I can specify what metric beans to be queried? I only want specific metrics to be sent to my graphite cluster not all of them.
Thank you

No versioned docker images

https://hub.docker.com/r/logzio/jmx2graphite/tags/ has only the 'latest' tag.

Since I'm struggling with memory leaks (#22) I wanted to use a previous image. Building the v1.2.3 version fails for some reason and your docker hub doesn't store any previous images.

Could you please store previous images (and also the current one with a version tag) so that we have a consistent reference that will never change?

WS-2018-0125 Medium Severity Vulnerability detected by WhiteSource

WS-2018-0125 - Medium Severity Vulnerability

Vulnerable Library - jackson-core-2.7.4.jar

Core Jackson abstractions, basic JSON streaming API implementation

path: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-core/2.7.4/b8f38a249116b66d804a5ca2b14a3459b7913a94/jackson-core-2.7.4.jar

Library home page: https://github.com/FasterXML/jackson-core

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Root Library)
    • jackson-core-2.7.4.jar (Vulnerable Library)

Vulnerability Details

OutOfMemoryError when writing BigDecimal In Jackson Core before version 2.7.6.
When enabled the WRITE_BIGDECIMAL_AS_PLAIN setting, Jackson will attempt to write out the whole number, no matter how large the exponent.

Publish Date: 2018-06-24

URL: WS-2018-0125

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-core#315

Release Date: 2018-01-24

Fix Resolution: 2.7.6


Step up your Open Source Security Game with WhiteSource here

CVE-2016-4970 High Severity Vulnerability detected by WhiteSource

CVE-2016-4970 - High Severity Vulnerability

Vulnerable Library - netty-all-4.0.33.Final.jar

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

path: null

Library home page: http://netty.io/netty-all/

Dependency Hierarchy:

  • netty-all-4.0.33.Final.jar (Vulnerable Library)

Vulnerability Details

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).

Publish Date: 2017-04-13

URL: CVE-2016-4970

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-4970

Release Date: 2017-04-13

Fix Resolution: 4.0.37.Final,4.1.1.Final


Step up your Open Source Security Game with WhiteSource here

CVE-2018-19361 High Severity Vulnerability detected by WhiteSource

CVE-2018-19361 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.7.4.jar

General data-binding functionality for Jackson: works on core streaming API

path: radle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.7.4/1e9c6f3659644aeac84872c3b62d8e363bf4c96d/jackson-databind-2.7.4.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19361

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19361

Release Date: 2019-01-02

Fix Resolution: 2.9.8


Step up your Open Source Security Game with WhiteSource here

Localhost doesn't work in Jolokia URL definition

I notice following problem.

Setting 'localhost' in URL for Jolokia in jmx2grahpite I see following error:
16/03/11 12:39:02 WARN i.l.j.MetricsPoller: Failed polling metrics from Jolokia: Failed retrieving list of beans from Jolokia. Error = Connect to localhost:31338 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused

The port is definitely open, because I can get URL content via telnet localhost 31338.
After replacing localhost with 127.0.0.1
16/03/11 12:54:28 WARN i.l.j.MetricsPoller: Failed polling metrics from Jolokia: Failed retrieving list of beans from Jolokia. Error = Connect to 127.0.0.1:31338 [/127.0.0.1] failed: Connection refused

Finally using IP address (in my case it was 10.0.1.4) make it works, so I'm fine at the moment.

I'm using Docker as suggested at the moment on Ubuntu 14.04 on Azure. Any idea what's wrong? I think it might be Docker thing. One of the obvious test I'm planning to do is not to use Docker, but it might need to wait a bit.

Configurable LOG LEVEL

Currently MetricsPipeline.java spits out too much logging that goes on top of application log.
Adding a way to configure log level at agent invocation should solve this

CVE-2020-9547 (Medium) detected in jackson-databind-2.9.10.2.jar

CVE-2020-9547 - Medium Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /tmp/ws-scm/jmx2graphite/pom.xml

Path to vulnerable library: downloadResource_735c409f-ec0a-4787-a1e7-5c39db3285be/20200211101557/jackson-databind-2.9.10.2.jar

Dependency Hierarchy:

  • jackson-databind-2.9.10.2.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Publish Date: 2020-03-02

URL: CVE-2020-9547

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9547

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3


  • Check this box to open an automated fix PR

CVE-2018-19362 High Severity Vulnerability detected by WhiteSource

CVE-2018-19362 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.7.4.jar

General data-binding functionality for Jackson: works on core streaming API

path: radle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.7.4/1e9c6f3659644aeac84872c3b62d8e363bf4c96d/jackson-databind-2.7.4.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19362

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19362

Release Date: 2019-01-02

Fix Resolution: 2.9.8


Step up your Open Source Security Game with WhiteSource here

CVE-2017-17485 High Severity Vulnerability detected by WhiteSource

CVE-2017-17485 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.7.4.jar

General data-binding functionality for Jackson: works on core streaming API

path: radle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.7.4/1e9c6f3659644aeac84872c3b62d8e363bf4c96d/jackson-databind-2.7.4.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

Publish Date: 2018-01-10

URL: CVE-2017-17485

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: FasterXML/jackson-databind@2235894

Release Date: 2017-12-19

Fix Resolution: Replace or update the following files: SubTypeValidator.java, BeanDeserializerFactory.java


Step up your Open Source Security Game with WhiteSource here

Latest docker image broken

The latest docker image (v1.4.4?) fails repeatedly when attempting to send metrics with the following exception:

20/07/07 13:35:11 ERROR jmx2graphite.MetricsPipeline: Unexpected error occured while polling and sending. Error = com/fasterxml/jackson/core/exc/InputCoercionException
java.lang.NoClassDefFoundError: com/fasterxml/jackson/core/exc/InputCoercionException
        at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory.createMapDeserializer(BasicDeserializerFactory.java:1375) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.deser.DeserializerCache._createDeserializer2(DeserializerCache.java:387) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.deser.DeserializerCache._createDeserializer(DeserializerCache.java:349) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCache2(DeserializerCache.java:264) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCacheValueDeserializer(DeserializerCache.java:244) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.deser.DeserializerCache.findValueDeserializer(DeserializerCache.java:142) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.DeserializationContext.findRootValueDeserializer(DeserializationContext.java:491) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._findRootDeserializer(ObjectMapper.java:4669) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4478) ~[jmx2graphite.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3471) ~[jmx2graphite.jar:?]
        at io.logz.jmx2graphite.JolokiaClient.getBeans(JolokiaClient.java:60) ~[jmx2graphite.jar:?]
        at io.logz.jmx2graphite.MetricsPipeline.poll(MetricsPipeline.java:55) ~[jmx2graphite.jar:?]
        at io.logz.jmx2graphite.MetricsPipeline.pollAndSend(MetricsPipeline.java:83) ~[jmx2graphite.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_121]
        at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_121]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_121]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_121]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_121]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_121]
        at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121]
Caused by: java.lang.ClassNotFoundException: com.fasterxml.jackson.core.exc.InputCoercionException
        at java.net.URLClassLoader.findClass(URLClassLoader.java:381) ~[?:1.8.0_121]
        at java.lang.ClassLoader.loadClass(ClassLoader.java:424) ~[?:1.8.0_121]
        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331) ~[?:1.8.0_121]
        at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ~[?:1.8.0_121]
        ... 20 more

Error HTTP 403 Code when accessing Jolokia URL

Hi,
I want to monitor Spring Boot applications but the following issue occurs.

I have a Spring Boot application inside a Docker Swarm. The Jolokia Endpoint is functional:

curl http://10.xxx.xx.x:10210/jolokia/list
Curl shows all availabe metrics

I started jmx2graphite like this:
docker run -i -t -d --name jmx2graphite -e "JOLOKIA_URL=http://10.xxx.xx.x::10210/jolokia/" -e "SERVICE_NAME=servicex" -e "GRAPHITE_HOST=graphite" -e "GRAPHITE_PROTOCOL=tcp" -e "GRAPHITE_PORT=2003" -v /var/log/jmx2graphite:/var/log/jmx2graphite --rm=true logzio/jmx2graphite

/var/log/jmx2graphite shows a 403 Http error code:

2017-10-23 15:40:07 INFO  MetricsPipeline:40 - Found 145 metric beans. Time = 63ms, for 2017-10-23T15:40:00.000+0000
2017-10-23 15:40:07 ERROR MetricsPipeline:77 - Unexpected error occured while polling and sending. Error = Failed reading beans from jolokia. Response = HTTP/1.1 403
java.lang.RuntimeException: Failed reading beans from jolokia. Response = HTTP/1.1 403
        at io.logz.jmx2graphite.JolokiaClient.getMetrics(JolokiaClient.java:88) ~[jmx2graphite-1.2.0.jar:?]
        at io.logz.jmx2graphite.MetricsPipeline.poll(MetricsPipeline.java:45) ~[jmx2graphite-1.2.0.jar:?]
        at io.logz.jmx2graphite.MetricsPipeline.pollAndSend(MetricsPipeline.java:63) ~[jmx2graphite-1.2.0.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_121]
        at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_121]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_121]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_121]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_121]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_121]
        at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121]
/var/log/jmx2graphite/jmx2graphite.log                                                                        

I checked if I was able to GET the jolokia endpoint from inside the jmx2graphite container and it worked fine:

docker exec -it jmx2graphite /bin/bash 

# curl http://10.201.35.2:10210/jolokia/list
{"request":{"type":"list"},"value":{"java.util.logging":{"type=Logging":{"op":{"getLoggerLevel":{"args":[{"name":"p0","type":"java.lang.String","desc":"p0"}],"ret":"java.lang.String","desc":"getLoggerLevel"},"getParentLoggerName":{"args":[{"name":"p0","type":"java.lang.String","desc":"p0"}],"ret":"java.lang.String","desc":"getParentLoggerName"},"setLoggerLevel":{"args":[{"name":"p0","type":"java.lang.String","desc":"p0"},{"name":"p1","type":"java.lang.String","desc":"p1"}],"ret":"void","desc":"setLoggerLevel"}},"attr":{"LoggerNames":{"rw":false,"type":"[Ljava.lang.String;","desc":"LoggerNames"},"ObjectName":{"rw":false,"type"

Why is it showing the 403 code in the log?

Kafka metrics registering as invalid in Graphite

I am using seeing the following error in graphite:

09/05/2016 23:34:38 :: [listener] invalid line (tta(S'kafka.kafka.kafka.network.type_RequestMetrics.name_ThrottleTimeMs.request_GroupCoordinator.50thPercentile') received from client 172.18.0.7:51748, ignoring

I have jmx2graphite listening to a Kafka jmx port, and publishing to a container started using the image https://hub.docker.com/r/kamon/grafana_graphite/.

The schema looks like:

cat /opt/graphite/conf/storage-schemas.conf
[default]
pattern = .*
retentions = 10s:7d

I believe the image is of graphite 0.9.15, and I'm using Jolokia 1.3.3.

I can see that the graphite code isn't doing much:

  def lineReceived(self, line):
    try:
      metric, value, timestamp = line.strip().split()
      datapoint = (float(timestamp), float(value))
    except ValueError:
      log.listener('invalid line (%s) received from client %s, ignoring' % (line, self.peerName))
      return

I suspect jmx2graphite is not sending the right format since I could see an extra tta(S' at the beginning of the line per the above error. The same log entry with trace level logging from jmx2graphite was:

16/05/09 23:34:38 TRACE i.l.j.MetricsPoller: MetricValue{name='kafka.network.type_RequestMetrics.name_LocalTimeMs.request_GroupCoordinator.50thPercentile', value=0.0, timestampSeconds=1462836878}

listening only /list/java.lang beans

Hi, i would like to export a part of a whole jolokia tree, at this moment it's java.lang:*
i am able to change this url in JolokiaClient.java and recompile, but then i'm getting:
java.lang.ClassCastException: java.lang.String cannot be cast to java.util.Map at io.logz.jmx2graphite.JolokiaClient.extractMetricsBeans(JolokiaClient.java:137) ~[jmx2graphite-1.2.0.jar:?] at io.logz.jmx2graphite.JolokiaClient.getBeans(JolokiaClient.java:65) ~[jmx2graphite-1.2.0.jar:?] at io.logz.jmx2graphite.MetricsPipeline.poll(MetricsPipeline.java:39) ~[jmx2graphite-1.2.0.jar:?] at io.logz.jmx2graphite.MetricsPipeline.pollAndSend(MetricsPipeline.java:63) ~[jmx2graphite-1.2.0.jar:?] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_131] at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_131] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_131] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_131] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_131] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_131] at java.lang.Thread.run(Thread.java:748) [?:1.8.0_131] 2017-10-25 06:51:01 DEBUG JolokiaClient:50 - Retrieving /list/java.lang of bean from Jolokia (http://127.0.0.1:8080/jolokia/)... 2017-10-25 06:51:05 DEBUG JolokiaClient:55 - GET /list/java.lang from jolokia took 3638 ms 2017-10-25 06:51:05 ERROR MetricsPipeline:77 - Unexpected error occured while polling and sending. Error = java.lang.String cannot be cast to java.util.Map java.lang.ClassCastException: java.lang.String cannot be cast to java.util.Map at io.logz.jmx2graphite.JolokiaClient.extractMetricsBeans(JolokiaClient.java:137) ~[jmx2graphite-1.2.0.jar:?] at io.logz.jmx2graphite.JolokiaClient.getBeans(JolokiaClient.java:65) ~[jmx2graphite-1.2.0.jar:?] at io.logz.jmx2graphite.MetricsPipeline.poll(MetricsPipeline.java:39) ~[jmx2graphite-1.2.0.jar:?] at io.logz.jmx2graphite.MetricsPipeline.pollAndSend(MetricsPipeline.java:63) ~[jmx2graphite-1.2.0.jar:?] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_131] at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_131] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_131] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_131] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_131] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_131] at java.lang.Thread.run(Thread.java:748) [?:1.8.0_131]
could you help me with this?

CVE-2017-15095 High Severity Vulnerability detected by WhiteSource

CVE-2017-15095 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.7.4.jar

General data-binding functionality for Jackson: works on core streaming API

path: radle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.7.4/1e9c6f3659644aeac84872c3b62d8e363bf4c96d/jackson-databind-2.7.4.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Vulnerable Library)

Vulnerability Details

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Publish Date: 2018-02-06

URL: CVE-2017-15095

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-15095

Release Date: 2018-02-06

Fix Resolution: 2.8.10,2.9.1


Step up your Open Source Security Game with WhiteSource here

CVE-2018-10237 Medium Severity Vulnerability detected by WhiteSource

CVE-2018-10237 - Medium Severity Vulnerability

Vulnerable Library - guava-18.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

path: radle/caches/modules-2/files-2.1/com.google.guava/guava/18.0/cce0823396aa693798f8882e64213b1772032b09/guava-18.0.jar

Library home page: http://code.google.com/p/guava-libraries/guava

Dependency Hierarchy:

  • guava-18.0.jar (Vulnerable Library)

Vulnerability Details

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Publish Date: 2018-04-26

URL: CVE-2018-10237

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-10237

Release Date: 2018-04-26

Fix Resolution: 24.1.1


Step up your Open Source Security Game with WhiteSource here

WS-2019-0379 (Medium) detected in commons-codec-1.12.jar

WS-2019-0379 - Medium Severity Vulnerability

Vulnerable Library - commons-codec-1.12.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Path to dependency file: /tmp/ws-scm/jmx2graphite/pom.xml

Path to vulnerable library: downloadResource_13441175-5a70-46fd-9bd1-16f58b00e3c3/20200310104446/commons-codec-1.12.jar

Dependency Hierarchy:

  • commons-codec-1.12.jar (Vulnerable Library)

Found in HEAD commit: 7a1da02d3aa5888c5efe430f0c6aa93bc5527114

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2020-03-05

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: apache/commons-codec@48b6157

Release Date: 2020-03-05

Fix Resolution: 1.13-RC1


  • Check this box to open an automated fix PR

CVE-2018-5968 High Severity Vulnerability detected by WhiteSource

CVE-2018-5968 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.7.4.jar

General data-binding functionality for Jackson: works on core streaming API

path: radle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.7.4/1e9c6f3659644aeac84872c3b62d8e363bf4c96d/jackson-databind-2.7.4.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

Publish Date: 2018-01-22

URL: CVE-2018-5968

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: FasterXML/jackson-databind@038b471

Release Date: 2018-01-22

Fix Resolution: Replace or update the following files: SubTypeValidator.java, VERSION


Step up your Open Source Security Game with WhiteSource here

Coredump when using javagent

I'm trying to use jmx2graphite 1.2.5 as a javaagent to monitor WildFly. Unfortunately I'm getting an error when starting the service.

JAVA_OPTS: -server -ea -Xms1g -Xmx2g -XX:+UseConcMarkSweepGC -XX:+CMSClassUnloadingEnabled -XX:SurvivorRatio=4 -XX:+DisableExplicitGC -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -Djava.net.preferIPv4Stack=true -Dcom.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize=true -javaagent:/opt/wildfly/jmx2graphite-1.2.5-javaagent.jar=GRAPHITE_HOST=X.X.X.X,SERVICE_NAME=wildfly

=========================================================================

SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
Exception in thread "main" java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at sun.instrument.InstrumentationImpl.loadClassAndStartAgent(InstrumentationImpl.java:386)
at sun.instrument.InstrumentationImpl.loadClassAndCallPremain(InstrumentationImpl.java:401)
Caused by: java.io.FileNotFoundException: /Users/yogevmets/logzio/jmx2graphite/args (No such file or directory)
at java.io.FileOutputStream.open0(Native Method)
at java.io.FileOutputStream.open(FileOutputStream.java:270)
at java.io.FileOutputStream.(FileOutputStream.java:213)
at java.io.FileOutputStream.(FileOutputStream.java:101)
at java.io.FileWriter.(FileWriter.java:63)
at io.logz.jmx2graphite.Jmx2GraphiteJavaAgent.premain(Jmx2GraphiteJavaAgent.java:26)
... 6 more
FATAL ERROR in native method: processing of -javaagent failed
Aborted (core dumped)

CVE-2020-10673 (Medium) detected in jackson-databind-2.9.10.3.jar

CVE-2020-10673 - Medium Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /tmp/ws-scm/jmx2graphite/pom.xml

Path to vulnerable library: downloadResource_13441175-5a70-46fd-9bd1-16f58b00e3c3/20200310104446/jackson-databind-2.9.10.3.jar

Dependency Hierarchy:

  • jackson-databind-2.9.10.3.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Publish Date: 2020-03-18

URL: CVE-2020-10673

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

CVE-2017-7525 High Severity Vulnerability detected by WhiteSource

CVE-2017-7525 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.7.4.jar

General data-binding functionality for Jackson: works on core streaming API

path: radle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.7.4/1e9c6f3659644aeac84872c3b62d8e363bf4c96d/jackson-databind-2.7.4.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Vulnerable Library)

Vulnerability Details

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Publish Date: 2018-02-06

URL: CVE-2017-7525

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-7525

Release Date: 2018-02-06

Fix Resolution: 2.6.7.1,2.7.9.1,2.8.9


Step up your Open Source Security Game with WhiteSource here

JMX2Graphite not exposing connector and task status metrics

Deployed Kafka Connect with JMX2Graphite but not able to get all the metrics. As per the Kafka Documentation, we should be getting kafka.connect:type=connector-metrics & status for kafka.connect:type=connector-task-metrics,connector

Steps to reproduce

Added jmx2graphite jar in kafka-connect docker image and pass the required jar environments as KAFKA_OPTS env to kafka-connect docker image as:

KAFKA_OPTS="-javaagent:jmx2graphite-1.4.1-javaagent.jar=GRAPHITE_HOSTNAME=localhost,GRAPHITE_PORT=80,SERVICE_HOST=svc-host,SERVICE_NAME=kafka"

Here, I'm able to get all the kafka connect specified metrics except:

type attributes
connector-metrics all
connector-task-metrics status

Please help me to enable these metrics.

wrong entrypoint/cmd in Dockerfile

from docker inspect logzio/jmx2graphite:

            "Cmd": [
                "/bin/sh",
                "-c",
                "java -cp jmx2graphite.jar:slf4j-simple-1.7.25.jar io.logz.jmx2graphite.Jmx2GraphiteJolokia application.conf"
            ],

this results in /bin/sh having pid1 in the container and java pid >1.

on docker kill the signal gets passed to /bin/sh which exits, but java has no clue what happened and gets surprised with a SIGKILL 60 seconds later.

Can we please set the cmd to exec java -cp ... or use a proper init?

io.logz.jmx2graphite.TestGraphiteClient > testOnServerShutdown FAILED

$ java -version
java version "1.8.0_162"
Java(TM) SE Runtime Environment (build 1.8.0_162-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.162-b12, mixed mode)
$ ./gradlew build --debug 
...
17:01:16.346 [DEBUG] [TestEventLogger] Gradle Test Executor 1 STARTED
17:01:16.349 [QUIET] [system.out] 17:01:16.349 [DEBUG] [org.gradle.api.internal.tasks.testing.junit.JUnitTestClassProcessor] Executing test class io.logz.jmx2graphite.TestGraphiteCl
ient
17:01:16.350 [DEBUG] [TestEventLogger] 
17:01:16.350 [DEBUG] [TestEventLogger] io.logz.jmx2graphite.TestGraphiteClient STARTED
17:01:17.032 [DEBUG] [TestEventLogger] 
17:01:17.033 [DEBUG] [TestEventLogger] io.logz.jmx2graphite.TestGraphiteClient > testOnServerRestart STARTED
17:01:17.046 [DEBUG] [TestEventLogger] 
17:01:17.047 [DEBUG] [TestEventLogger] io.logz.jmx2graphite.TestGraphiteClient > testOnServerRestart STANDARD_OUT
17:01:17.047 [DEBUG] [TestEventLogger]     17:01:17.043 [Test worker] INFO  io.logz.jmx2graphite.GraphiteClient - Graphite metrics prefix: bla-service.bla-host_com.
17:01:17.049 [DEBUG] [TestEventLogger]     17:01:17.045 [Test worker] INFO  io.logz.jmx2graphite.GraphiteClient - Graphite Client: using writeTimeoutMs of 20000 [ms]. Establishing c
onnection...
17:01:17.070 [DEBUG] [TestEventLogger]     17:01:17.069 [Test worker] INFO  io.logz.jmx2graphite.TestGraphiteClient - Starting dummy graphite server on port 12329
17:01:17.088 [DEBUG] [TestEventLogger]     17:01:17.088 [Test worker] INFO  io.logz.jmx2graphite.TestGraphiteClient - Shutting down mock graphite server
17:01:17.091 [DEBUG] [TestEventLogger]     17:01:17.090 [Test worker] INFO  io.logz.jmx2graphite.DummyGraphiteServer - Waiting for server to finish shutdown...
17:01:17.091 [DEBUG] [TestEventLogger]     17:01:17.090 [Thread-4] INFO  io.logz.jmx2graphite.DummyGraphiteServer - Client closed connection
17:01:17.091 [DEBUG] [TestEventLogger]     17:01:17.091 [Test worker] INFO  io.logz.jmx2graphite.DummyGraphiteServer - Dummy graphite server closed
17:01:20.094 [DEBUG] [TestEventLogger]     17:01:20.093 [Test worker] INFO  io.logz.jmx2graphite.TestGraphiteClient - Starting dummy graphite server on port 12329
17:01:20.242 [DEBUG] [TestEventLogger] 
17:01:20.242 [DEBUG] [TestEventLogger] io.logz.jmx2graphite.TestGraphiteClient > testOnServerRestart PASSED
17:01:20.243 [DEBUG] [TestEventLogger] 
17:01:20.243 [DEBUG] [TestEventLogger] io.logz.jmx2graphite.TestGraphiteClient > testOnServerShutdown STARTED
17:01:20.245 [DEBUG] [TestEventLogger] 
17:01:20.245 [DEBUG] [TestEventLogger] io.logz.jmx2graphite.TestGraphiteClient > testOnServerShutdown STANDARD_OUT
17:01:20.245 [DEBUG] [TestEventLogger]     17:01:20.242 [Time-limited test] INFO  io.logz.jmx2graphite.GraphiteClient - Graphite metrics prefix: bla-service.bla-host_com.
17:01:20.245 [DEBUG] [TestEventLogger]     17:01:20.243 [Time-limited test] INFO  io.logz.jmx2graphite.GraphiteClient - Graphite Client: using writeTimeoutMs of 2000 [ms]. Establish
ing connection...
17:01:20.246 [DEBUG] [TestEventLogger]     17:01:20.243 [Time-limited test] INFO  io.logz.jmx2graphite.TestGraphiteClient - Starting dummy graphite server on port 48622
17:01:20.248 [DEBUG] [TestEventLogger]     17:01:20.247 [Time-limited test] INFO  io.logz.jmx2graphite.TestGraphiteClient - Shutting down mock graphite server
17:01:20.249 [DEBUG] [TestEventLogger]     17:01:20.248 [Thread-6] INFO  io.logz.jmx2graphite.DummyGraphiteServer - Client closed connection
17:01:20.250 [DEBUG] [TestEventLogger]     17:01:20.248 [Time-limited test] INFO  io.logz.jmx2graphite.DummyGraphiteServer - Waiting for server to finish shutdown...
17:01:20.251 [DEBUG] [TestEventLogger]     17:01:20.248 [Time-limited test] INFO  io.logz.jmx2graphite.DummyGraphiteServer - Dummy graphite server closed
17:01:20.379 [QUIET] [system.out] 17:01:20.379 [INFO] [org.gradle.api.internal.tasks.testing.worker.TestWorker] Gradle Test Executor 1 finished executing tests.
17:01:20.383 [QUIET] [system.out] 17:01:20.382 [DEBUG] [org.gradle.process.internal.child.ActionExecutionWorker] Completed Gradle Test Executor 1.
17:01:20.413 [DEBUG] [TestEventLogger] 
17:01:20.413 [DEBUG] [TestEventLogger] io.logz.jmx2graphite.TestGraphiteClient > testOnServerShutdown FAILED
17:01:20.414 [DEBUG] [TestEventLogger]     java.lang.AssertionError: Send metrics succeeded but server is down
17:01:20.414 [DEBUG] [TestEventLogger]         at org.junit.Assert.fail(Assert.java:88)
17:01:20.414 [DEBUG] [TestEventLogger]         at io.logz.jmx2graphite.TestGraphiteClient.testOnServerShutdown(TestGraphiteClient.java:59)
17:01:20.414 [DEBUG] [TestEventLogger]         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
17:01:20.414 [DEBUG] [TestEventLogger]         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
17:01:20.414 [DEBUG] [TestEventLogger]         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
17:01:20.414 [DEBUG] [TestEventLogger]         at java.lang.reflect.Method.invoke(Method.java:498)
17:01:20.414 [DEBUG] [TestEventLogger]         at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
17:01:20.414 [DEBUG] [TestEventLogger]         at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
17:01:20.414 [DEBUG] [TestEventLogger]         at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
17:01:20.414 [DEBUG] [TestEventLogger]         at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
17:01:20.415 [DEBUG] [TestEventLogger]         at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:298)
17:01:20.416 [DEBUG] [TestEventLogger]         at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:292)
17:01:20.416 [DEBUG] [TestEventLogger]         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
17:01:20.416 [DEBUG] [TestEventLogger]         at java.lang.Thread.run(Thread.java:748)
17:01:20.417 [DEBUG] [TestEventLogger] 
17:01:20.417 [DEBUG] [TestEventLogger] io.logz.jmx2graphite.TestGraphiteClient FAILED
17:01:20.417 [QUIET] [system.out] 17:01:20.416 [DEBUG] [org.gradle.process.internal.child.ActionExecutionWorker] Stopping client connection.
17:01:20.417 [DEBUG] [TestEventLogger] 
17:01:20.418 [DEBUG] [TestEventLogger] Gradle Test Executor 1 FAILED
...

CVE-2017-5645 High Severity Vulnerability detected by WhiteSource

CVE-2017-5645 - High Severity Vulnerability

Vulnerable Library - log4j-core-2.8.1.jar

The Apache Log4j Implementation

path: null

Library home page: https://logging.apache.org/log4j/2.x/log4j-core/

Dependency Hierarchy:

  • log4j-core-2.8.1.jar (Vulnerable Library)

Vulnerability Details

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Publish Date: 2017-04-17

URL: CVE-2017-5645

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-5645

Release Date: 2017-04-17

Fix Resolution: 2.8.2


Step up your Open Source Security Game with WhiteSource here

CVE-2018-19360 High Severity Vulnerability detected by WhiteSource

CVE-2018-19360 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.7.4.jar

General data-binding functionality for Jackson: works on core streaming API

path: radle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.7.4/1e9c6f3659644aeac84872c3b62d8e363bf4c96d/jackson-databind-2.7.4.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19360

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19360

Release Date: 2019-01-02

Fix Resolution: 2.9.8


Step up your Open Source Security Game with WhiteSource here

CVE-2018-7489 High Severity Vulnerability detected by WhiteSource

CVE-2018-7489 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.7.4.jar

General data-binding functionality for Jackson: works on core streaming API

path: radle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.7.4/1e9c6f3659644aeac84872c3b62d8e363bf4c96d/jackson-databind-2.7.4.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

  • jackson-databind-2.7.4.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Publish Date: 2018-02-26

URL: CVE-2018-7489

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-7489

Release Date: 2018-02-26

Fix Resolution: 2.8.11.1,2.9.5


Step up your Open Source Security Game with WhiteSource here

Poll metrics failure on Docker container.

I'm getting the following error with the Docker container:

2017-02-09 13:55:24 INFO  MetricsPipeline:40 - Found 779 metric beans. Time = 85ms, for 2017-02-09T13:55:00.000+0000
2017-02-09 13:55:24 WARN  MetricsPipeline:54 - Failed polling metrics from client (class io.logz.jmx2graphite.JolokiaClient): Failed reading beans from Jolokia. Error = C
an not deserialize instance of java.util.ArrayList out of START_OBJECT token
 at [Source: java.io.ByteArrayInputStream@7b7427b2; line: 1, column: 1]
2017-02-09 13:55:24 ERROR MetricsPipeline:77 - Unexpected error occured while polling and sending. Error = null
java.lang.NullPointerException
	at io.logz.jmx2graphite.GraphiteClient.sendMetrics(GraphiteClient.java:97) ~[jmx2graphite-1.1.1.jar:?]
	at io.logz.jmx2graphite.MetricsPipeline.sendToGraphite(MetricsPipeline.java:101) ~[jmx2graphite-1.1.1.jar:?]
	at io.logz.jmx2graphite.MetricsPipeline.pollAndSend(MetricsPipeline.java:65) ~[jmx2graphite-1.1.1.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_111]
	at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_111]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_111]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_111]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_111]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_111]
	at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111]

System is a RHEL7 with Java reported as

java version "1.8.0_77"
Java(TM) SE Runtime Environment (build 1.8.0_77-b03)
Java HotSpot(TM) 64-Bit Server VM (build 25.77-b03, mixed mode)

And Jolokia (running on the same host) is v1.3.5

Any suggestions how to fix?

CVE-2020-8840 (Medium) detected in jackson-databind-2.9.10.2.jar

CVE-2020-8840 - Medium Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /tmp/ws-scm/jmx2graphite/pom.xml

Path to vulnerable library: downloadResource_735c409f-ec0a-4787-a1e7-5c39db3285be/20200211101557/jackson-databind-2.9.10.2.jar

Dependency Hierarchy:

  • jackson-databind-2.9.10.2.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Publish Date: 2020-02-10

URL: CVE-2020-8840

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2620

Release Date: 2020-02-10

Fix Resolution: 2.8.115,2.9.10.3

CVE-2019-20330 (High) detected in jackson-databind-2.9.10.1.jar

CVE-2019-20330 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.1.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /tmp/ws-scm/jmx2graphite/pom.xml

Path to vulnerable library: epository/com/fasterxml/jackson/core/jackson-databind/2.9.10.1/jackson-databind-2.9.10.1.jar

Dependency Hierarchy:

  • jackson-databind-2.9.10.1.jar (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Publish Date: 2020-01-05

URL: CVE-2019-20330

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/FasterXML/jackson-databind/tree/jackson-databind-2.9.10.2

Release Date: 2020-01-03

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.2


  • Check this box to open an automated fix PR

Picking only first parameter when running jmx2graphite as java agent

When running the below command:
java -javaagent:./jmx2graphite-1.2.4-javaagent.jar=GRAPHITE_HOSTNAME=localhost;SERVICE_NAME=MyApp example.jar

getting below error:

Exception in thread "main" java.lang.reflect.InvocationTargetException
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at sun.instrument.InstrumentationImpl.loadClassAndStartAgent(InstrumentationImpl.java:386)
	at sun.instrument.InstrumentationImpl.loadClassAndCallPremain(InstrumentationImpl.java:401)
Caused by: io.logz.jmx2graphite.IllegalConfiguration: SERVICE_NAME must be one of the arguments
	at io.logz.jmx2graphite.Jmx2GraphiteJavaAgent.premain(Jmx2GraphiteJavaAgent.java:30)
	... 6 more
FATAL ERROR in native method: processing of -javaagent failed

It looks like that it is picking only first parameter, not all. Please let me know if I am doing something wrong or this is really a bug ?

JMX2Graphite needs to support Java version 11

$ ./gradlew build --stacktrace

FAILURE: Build failed with an exception.

* What went wrong:
Could not determine java version from '11.0.1'.

* Try:
Run with --info or --debug option to get more log output.

* Exception is:
java.lang.IllegalArgumentException: Could not determine java version from '11.0.1'.
	at org.gradle.api.JavaVersion.toVersion(JavaVersion.java:63)
	at org.gradle.api.JavaVersion.current(JavaVersion.java:72)
	at org.gradle.launcher.cli.JavaRuntimeValidationAction.execute(JavaRuntimeValidationAction.java:32)
	at org.gradle.launcher.cli.JavaRuntimeValidationAction.execute(JavaRuntimeValidationAction.java:24)
	at org.gradle.launcher.cli.CommandLineActionFactory$WithLogging.execute(CommandLineActionFactory.java:206)
	at org.gradle.launcher.cli.CommandLineActionFactory$WithLogging.execute(CommandLineActionFactory.java:169)
	at org.gradle.launcher.cli.ExceptionReportingAction.execute(ExceptionReportingAction.java:33)
	at org.gradle.launcher.cli.ExceptionReportingAction.execute(ExceptionReportingAction.java:22)
	at org.gradle.launcher.Main.doAction(Main.java:33)
	at org.gradle.launcher.bootstrap.EntryPoint.run(EntryPoint.java:45)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.gradle.launcher.bootstrap.ProcessBootstrap.runNoExit(ProcessBootstrap.java:54)
	at org.gradle.launcher.bootstrap.ProcessBootstrap.run(ProcessBootstrap.java:35)
	at org.gradle.launcher.GradleMain.main(GradleMain.java:23)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.gradle.wrapper.BootstrapMainStarter.start(BootstrapMainStarter.java:30)
	at org.gradle.wrapper.WrapperExecutor.execute(WrapperExecutor.java:129)
	at org.gradle.wrapper.GradleWrapperMain.main(GradleWrapperMain.java:61)
$ java -version
openjdk version "11.0.1" 2018-10-16
OpenJDK Runtime Environment 18.9 (build 11.0.1+13)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.1+13, mixed mode)
$ grep distributionUrl gradle/wrapper/gradle-wrapper.properties 
distributionUrl=https\://services.gradle.org/distributions/gradle-2.8-all.zip
$

Maybe a Gradle update will help.

Memory leaks

jmx2graphite seems to be leaking memory.

This is the graph of the memory usage:

screenshot from 2018-09-06 19-17-02

I was running a previous version of this and it didn't leak any memory.

Can you please help me?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.