Monitoring an application in a process virtual machine
View Patent ↗An application that runs in a process virtual machine is monitored by injecting listening code into a target class of the application. The listening code collects and forwards data to a monitoring agent. The target class is configured for monitoring according to alternative embodiments. In response to the process virtual machine providing notification of an event, such a loading the target class, the listening code may be injected into the target class. In another embodiment, the process virtual machine is configured to load a first mirror class containing a mirror entry point to the application. A mirror target class is loaded in response to a request to load the target class. The mirror target class contains a mirror entry point to the target class and the listening code. In another embodiment, listening code may be added to the target class before running the application.
1. A computer-implemented method, comprising:
receiving an identification of a target class of an application that runs in a process virtual machine on a computer system by a monitoring agent;
configuring the target class for monitoring by injecting listening code into the target class to generate a first mirror class and integrating the first mirror class into the application, the first mirror class including at least a sequence of computer executable code, including the listening code, not present in computer executable code of the target class;
running the monitoring agent, the process virtual machine, and the application on the computer system;
collecting data by executing the listening code within the first mirror class integrated into the application to collect data;
sending the collected data directly to the monitoring agent by the listening code; and
sending the collected data to a collector by the monitoring agent, wherein the collector is operable to analyze the collected data to identify an unauthorized access to the application.
2. The method of claim 1 , wherein the configuring the target class for monitoring by listening code includes:
configuring the process virtual machine to provide a notification of an event concerning the target class; and
installing the listening code in the target class in response to the notification of the event.
3. The method of claim 2 , wherein the event is a request to load the target class.
4. The method of claim 1 , wherein the first mirror class includes a mirror entry point to the application and configuring the target class for monitoring by listening code includes:
configure the process virtual machine to use a first class loader to load the first mirror class; and
load the first mirror class in response to a request to load the target class, the first mirror target class further containing a mirror entry point to the target class.
5. The method of claim 1 , wherein the configuring the target class for monitoring by listening code includes:
injecting listening virtual machine code into the target class before running the application.
6. The method of claim 1 , further comprising serializing the collected data by the monitoring agent.
7. The method of claim 1 , wherein the collected data includes an argument of a target method the target class.
8. A computer program product, the computer program product comprising a computer readable storage medium having program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program code executable by a computer to cause the computer to:
receive an identification of a target class of an application that runs in a process virtual machine on a computer system by a monitoring agent;
configure the target class for monitoring by injecting listening code into the target class to generate a first mirror class and integrating the first mirror class into the application, the first mirror class including at least a sequence of computer executable code, including the listening code, not present in computer executable code of the target class;
run the monitoring agent, the process virtual machine, and the application on the computer system;
collect data by executing the listening code within the first mirror class integrated into the application to collect data;
send the collected data directly to the monitoring agent by the listening code; and
send the collected data to a collector by the monitoring agent, wherein the collector is operable to analyze the collected data to identify an unauthorized access to the application.
9. The computer program product of claim 8 , wherein the program code is further executable by the computer to cause the computer to:
configure the process virtual machine to provide a notification of an event concerning the target class; and
install the listening code in the target class in response to the notification of the event.
10. The computer program product of claim 8 , wherein the first mirror class includes a mirror entry point to the application and the program code is further executable by the computer to cause the computer to:
configure the process virtual machine to use a first class loader to load the first mirror class; and
load the first mirror class in response to a request to load the target class, the first mirror class further containing a mirror entry point to the target class.
11. The computer program product of claim 8 , wherein the program code is further executable by the computer to cause the computer to:
inject listening virtual machine code into the target class before running the application.
12. The computer program product of claim 8 , wherein the collected data includes a field of the target class.
13. The computer program product of claim 8 , wherein the collected data includes an identification of a client causing a target method of the target class to be invoked.