Ora_java_audit - Ora Glass

[FranckM]

Hi all,

does anyone here already use the oracle Glas in combination with the ACC-V Content File based Discovery for an ORacle java audit?

I did it in my project and we are getting the data in the ora_java_audit

However the Commercial Fetaures Field isnt fulfilled correctly.

i check in the documentation and see by 2 commercial features are not collected.  DO YOU KNOW WHY? What should we do to collect them? are can we otherwise prepare for the audit witthout this ?

Any best practice?

Data collected during ACC-VC File-Based Discovery • Australia IT Operations Management • Docs | Serv...

[ajmalmuhamm · Accepted solution]

Hi @FranckM ,

This is an expected limitation of ACC-VC Content File-Based Discovery (FBD). File-Based Discovery only analyzes static files on the host and does not inspect the runtime state of Java processes.

The two fields you're referring to—Unlock Commercial Features and AMC Agent—are runtime-related attributes, which is why the documentation lists them as "Not collected during ACC-VC File-Based Discovery (FBD)" for the ora_java_audit table.

For Oracle Java audit preparation, the recommended approach is to:

• Use credentialed/process-based Discovery for systems where you need runtime information.
• If your organization uses Oracle Advanced Management Console (AMC), use it as the authoritative source for commercial feature and agent information.
• Validate a sample of Java startup scripts or service configurations to verify whether commercial feature flags are being used.
• Document this limitation as part of your audit evidence so auditors understand that these fields are not populated by the selected discovery method.

So, there isn't a configuration change in FBD that will populate these fields—they require a discovery method that can inspect running JVMs.

Kind regards,

[Vikram Reddy]

Hi @FranckM,

Stop expecting File-Based Discovery to fill those two fields in, it structurally can't. ACC-VC Content File-Based Discovery only reads files sitting on disk, it never touches a running JVM. Both Unlock Commercial features and AMC Agent are runtime states, not file artifacts: the first reflects whether commercial-feature flags (historically -XX:+UnlockCommercialFeatures, still relevant on older JDKs) were passed at process launch, and the second reflects whether Oracle's Advanced Management Console agent plugin is actively installed and reporting in. Neither leaves something FBD can parse from a static scan, which is exactly why the same documentation page you linked marks both as "Not collected during ACC-VC file-based discovery (FBD)" in the ora_java_audit table.

For audit prep, don't fight the tool, work around the gap:

• Run process-based Discovery (credentialed, not FBD) against the same hosts so it can inspect the live java process instead of just files on disk
• Pull straight from AMC if Oracle's Advanced Management Console is deployed anywhere, it's the authoritative source for commercial feature usage anyway
• Spot-check startup scripts and systemd/service units on a sample of hosts for commercial flags before the auditor does

Document the FBD limitation in your audit workpapers explicitly. When Oracle's auditors ask why those two fields are blank, "the discovery method doesn't collect it, here's the vendor documentation confirming that" is a defensible answer, guessing isn't.

Thank you,
Vikram Karety
Octigo Solutions INC

[ajmalmuhamm · Accepted solution]

Hi @FranckM ,

This is an expected limitation of ACC-VC Content File-Based Discovery (FBD). File-Based Discovery only analyzes static files on the host and does not inspect the runtime state of Java processes.

The two fields you're referring to—Unlock Commercial Features and AMC Agent—are runtime-related attributes, which is why the documentation lists them as "Not collected during ACC-VC File-Based Discovery (FBD)" for the ora_java_audit table.

For Oracle Java audit preparation, the recommended approach is to:

• Use credentialed/process-based Discovery for systems where you need runtime information.
• If your organization uses Oracle Advanced Management Console (AMC), use it as the authoritative source for commercial feature and agent information.
• Validate a sample of Java startup scripts or service configurations to verify whether commercial feature flags are being used.
• Document this limitation as part of your audit evidence so auditors understand that these fields are not populated by the selected discovery method.

So, there isn't a configuration change in FBD that will populate these fields—they require a discovery method that can inspect running JVMs.

Kind regards,

[FranckM · Accepted solution]

thank you for the deep dive