Visit Azul.com Support

What Info is Transmitted Between Your System and Azul Intelligence Cloud

Table of Contents
Need help?
Schedule a consultation with an Azul performance expert.
Contact Us

Azul Intelligence Cloud is a combination of applications running within your environment combined with an analysis and data collection solution provided by Azul as Software as a Service (SaaS). This means there is an exchange of JVM Meta Data from your environment to the Azul system. This document describes what data are exchanged exactly and how the security of your JVM Meta Data is handled at every level involved.

Components Within the System

To be able to provide vulnerability information, three components are involved:

  • Within your environment

    • Java Runtimes

    • Forwarder(s)

  • Provided by Azul

    • Azul Intelligence Cloud Web UI and APIs

Java Runtime

The Java Runtime (being Azul Zulu, Azul Zing, or any other runtime with the Intelligence Cloud Agent) runs within your environment and never needs access to the public internet to exchange data with Azul Intelligence Cloud. The runtime collects information about the libraries inside the application using the Connected Runtime Service (CRS), a component inside the JVM. But only when the argument -XX:AzCRSMode=on or environment variable AZ_CRS_ARGUMENTS are added (for more info, see Connect to Azul Intelligence Cloud via the Forwarder), the runtime collects information about the libraries inside the application using the Connected Runtime Service (CRS), a component inside the Azul JVM or Intelligence Cloud Agent. CRS transmits these data via the Forwarder.

An isolated processing log is also collected, unrelated to standard application logging. This can be used by Azul support to assist you.

Note
 Our runtimes only send data regarding the Java runtime and libraries for this very specific functionality, and the isolated processing log. There is no other information exchanged with Azul, and all collected JVM Meta Data in the Saas environment is available to you via our Web UI and API. In contrast to distributions from other providers, Azul doesn’t, and can’t, use this information to check licenses.

Forwarder

The Forwarder is a separate application provided by Azul to be installed within your environment (at least once, for more info, see One-time Setup), that transmits the JVM Meta Data provided by the runtimes to Azul Intelligence Cloud. It requires access to the public internet. Rotating certificates secure the connection between the Forwarder and Azul Intelligence Cloud.

Azul Intelligence Cloud

Our SaaS solution to detect vulnerabilities in your applications, uses an internal knowledge base containing "fingerprints" (hashes) as described on How CVEs are Detected. At this point, Azul doesn’t have any other reference to your code or applications except the info related to the Instance ID.

Example of an Instance view in the Azul Intelligence Cloud UI

APIs Between Java Runtime and Forwarder

The Forwarder is the "gateway" between the runtimes within your environment and the Azul Intelligence Cloud SaaS solution. All data flowing through the Forwarder is transmitted via an API approach.

API Method Description

/crs/instance/{vmId}

POST

Report new VM instance events.

/crs/auth/rt/token

GET

Get new runtime token.

/crs/auth/rt/token

POST

Refresh runtime token.

Data Model Exchanged Between Java Runtime and Forwarder

Processing Log

A log about event processing. This log stream is isolated and independent of any application-level logs.

This is an example of a processing log that gets transmitted: 
 
0.657: [CRS.args][debug] Effective Azul IC Agent options:
0.665: [CRS.args][debug]    delayInitiation     =    0 [ ENVIRONMENT ]
0.665: [CRS.args][debug]    delayTermination    =    0 [ ENVIRONMENT ]
0.665: [CRS.args][debug]    maxJarFileCacheSize = 2048 [ DEFAULT     ]
0.665: [CRS.args][debug]    mode                =   on [ ERGONOMIC   ]
0.666: [CRS.args][debug]    notifyClassLoad     = true [ DEFAULT     ]
0.666: [CRS.args][debug]    notifyJarLoad       = true [ DEFAULT     ]
0.666: [CRS.args][debug]    sendPOMData         = true [ DEFAULT     ]
0.669: [CRS.id][info] Azul IC Agent <VERSION> started with args=''.
0.808: [CRS.connection][info] querying DNS record
1.179: [CRS.connection][info] Using CRS endpoint configuration
1.179: [CRS.connection][info]    API url = REDACTED
1.179: [CRS.connection][info]    mailbox = default
1.184: [CRS.id][debug] Azul IC Agent initialized. VM start timestamp 1712783363694, VM uptime 1184ms
1.203: [CRS.id][trace] Post VM start to CRS service
1.529: [CRS.connection][info] Get runtime token: clientVersion=<VERSION>, mailbox=default
5.555: [CRS.id][info] Agent authenticated: vmId=REDACTED
5.555: [CRS.id][debug]  VM uptime 5555ms
5.579: [CRS.service.classloadevent][debug] Service starts.
5.590: [CRS.default][trace] Creating dependencies to itself: :com.azul.crs.javaagent.client.service.JarLoadMonitor$TaskExecutor@6b59b5a7:1801041319:1
5.590: [CRS.default][trace] Creating dependencies to itself: :com.azul.crs.javaagent.client.service.JarLoadMonitor$TaskExecutor@6b59b5a7:1801041319:2
5.590: [CRS.service.jarload.reporter][info] Posted jar: file://path/to/something.jar
5.592: [CRS.service.classload.loaderwrapper][info] Going to use 9+ path of extracting URLs
5.593: [CRS.service.jarload.reporter][trace] ClassLoadWrapper.getURLs returned null
5.593: [CRS.default][trace] Creating dependencies to itself: :com.azul.crs.javaagent.client.service.JarLoadMonitor$TaskExecutor@6b59b5a7:1801041319:3
5.593: [CRS.mainMethod.detect][debug] 5.593: [CRS.default][trace] main method in class: com/example/pkg/ rstart/rendo nttoa iintesreBlofo:t s:tcroamp.a
zul.crs.javaagent.client.service.JarLoadMonitor$TaskExecutor@6b59b5a7:1801041319:4
5.594: [CRS.service.jarload.reporter][info] Posted jar: file://path/to/another.jar
5.594: [CRS.default][trace] Creating dependencies to itself: :com.azul.crs.javaagent.client.service.JarLoadMonitor$TaskExecutor@6b59b5a7:1801041319:5

VM Event

Each JVM instance reports VM events to the Forwarder.

Field Description

vmId

VM instance associated with event, must be set only for user initiated requests

eventId

Synthetic primary key of event

eventType

See VM Event Types

eventPayload

Optional payload, based on eventType, see the VM Event Types

eventTime

VM event time (epoch millis)

receivedTime

The time VM event first observed by the server (epoch millis)

VM Event Types

VM event types supported by CRS.

Event Type Event Payload

VM_CREATE

VM Instance

VM_PATCH

VM Instance

VM_ARTIFACT_CREATE

VM Artifact

VM_ARTIFACT_PATCH

VM Artifact

VM_ARTIFACT_DATA

VM Artifact Data

VM_JAR_LOADED

VM Jar Loaded

VM_CLASS_LOADED

VM Class Loaded

VM_METHOD_FIRST_CALLED

VM Method First Called

VM_PERFORMANCE_METRICS

VM Performance Metrics

VM_HEARTBEAT

-

VM_SHUTDOWN

-

VM Event Payloads

The eventPayload in VM Event is defined by the VM Event Type and uses one of the following structures.

VM Instance

Payload of VM_CREATE and VM_PATCH events.

The model of a VM instance managed by CRS.

Field Description

vmId

VM instance ID generated by CRS

clientVersion

Version of CRS client used by VM instance

clientRevision

Source code revision of CRS client used by VM instance

inventory

See the Inventory model.

jvmInfo

JVM information derived from VM instance metadata:

  • Xmx: Max Java heap size

  • Xms: Initial Java heap size

startTime

Start time of the VM instance (epoch millis)

lastHeardTime

Last time VM instance was heard by CRS service (epoch millis)

owner

User name associated with VM instance

mailbox

Mailbox ID used by CRS to report VM instance metadata and telemetry

state

State of VM instance last known to CRS:

  • STARTED - [Deprecated, but can be found in old VMs] VM instance is started but not running yet

  • RUNNING - VM instance is running

  • TERMINATED - VM instance is terminated

  • OFFLINE - VM instance does not respond for a long time (disconnected, crashed or any other reason)

tags

Tags of VM instance consisted of named string values
Inventory

VM instance inventory reported by connected runtime.

Field Description

hostName

Host name of machine running VM instance

networks

Network interfaces of machine running VM instance, containing an array with hostname and address

systemProperties
The following subset of JVM system properties: 
 
com.azul.crs.instance.offline.timeout
com.azul.crs.instance.store.discarded.vmevents
com.azul.crs.instance.tags
file.encoding
file.separator
java.class.path
java.compiler
java.home
java.io.tmpdir
java.library.path
java.runtime.version
java.specification.version
java.vendor
java.vendor.version
java.version
java.vm.name
java.vm.version
java.vm.vendor
jdk.vendor.version
line.separator
os.arch
os.name
os.version
path.separator
sun.arch.data.model
sun.boot.class.path
sun.boot.library.path
sun.cpu.endian
sun.desktop
sun.io.unicode.encoding
sun.java.launcher
sun.jnu.encoding
sun.management.compiler
sun.os.patch.level
user.country
user.dir
user.home
user.language
user.name

systemInfo

System info of machine running VM instance

For example:

 
sysctl.hw.activecpu: "16"
sysctl.hw.cpufrequency_min: "2300000000"
sysctl.hw.memsize: "17179869184"
sysctl.hw.l1dcachesize: "32768"

cpuInfo

CPU info of machine running VM instance

For example:

 
CPU Microcode: 240
Affected by MCU Erratum SKX102: false
Number of Processors: 16
CPU Stepping: 13

memInfo

Memory info of machine running VM instance

For example:

 
System RAM max, GB: 16

osInfo

OS info of machine running VM instance

For example:

 
OS Name: Mac OS X
OS Version: 10.16
OS Arch: x86_64

osEnvironment

Only the following list of OS environment variables, needed by Azul Intelligence Cloud, are transmitted:

 
AZ_CRS_ARGUMENTS
CRS_DATACENTER
CRS_IMAGE
CRS_OWNER
CRS_SERVICE
CRS_TAGS

mainMethod

Main method executed by JVM on VM instance invocation

For example:

 
HelloWorld.main

VM Artifact

Payload of VM_ARTIFACT_CREATE and VM_ARTIFACT_PATCH events.

Represents information about a file associated with a specific VMInstance (e.g. GC log or JFR recording). The content of the file is not a part of the model. It is hosted by a suitable storage and is simply referenced by the VMArtifact.

Field Description

artifactId

VM artifact ID generated by CRS on artifact creation

artifactType

Types of VM artifacts supported by CRS

  • GC_LOG: GC log generated by JVM according to arguments passed to JVM

  • VM_LOG: log generated by JVM according to arguments passed to JVM

  • CRS_LOG: log generated by CRS agent for debug purpose

  • JFR: JFR recording generated by JVM according to arguments passed to JVM

  • JAR: JAR file content, can be uploaded or sent by runtime if allowed by a policy

  • JAR_ENTRY: JAR entry content, can be sent by runtime if allowed by a policy

  • LARGE_VM_EVENT: payload of VM event that exceeds threshold and can not be sent inlined

  • OTHER: other type of VM artifact

metadata

VM artifact metadata with free form schema dependent on artifact type

filename

Name of the artifact

vmId

VM instance associated with the artifact

createTime

Time of VM artifact creation (epoch millis).

uploadURL

Presigned URL to upload artifact file. Only used as a return value.

snapshot

Presigned URL to download artifact snapshot. Only used as a return value.

size

Size of artifact data in bytes, -1 if no data available. Only used as a return value.

VM Artifact Data

Payload of VM_ARTIFACT_DATA events.

The data is appended to VM artifact content accumulated by CRS so far. That means no concurrent events for the same VM artifact are allowed, and the ordering of sent data should be preserved by CRS.

Field Description

artifactId

ID of VM artifact the data belongs to

data

Plain text representation of VM artifact data to be appended to the artifact.

VM Jar Loaded

Payload of VM_JAR_LOADED events.

Field Description

jarName

JAR file name

url

URL used by JVM to access JAR content

centralDirectoryHash

Hash value computed by central directory of JAR archive

centralDirectoryLength

Length of the central directory of JAR archive

centralDirectoryExtractionMethod

Method used to obtain central directory of JAR archive

recursionDepth

Depth of JAR when nested JAR is reported recursively

manifestHash

Hash value computed by META-INF/MANIFEST.MF of JAR

initiatedBy

The party that initiated the reporting of JAR:

  • CLASS_LOADING

  • JDK_NATIVE_LOADING

  • RECURSIVE_LOADING

  • OTHER

mavenComponents

Maven components detected by metadata files of JAR (pom.properties, etc.), containing:

  • groupId: Group ID of maven component

  • artifactId: Artifact ID of maven component

  • version: Version of maven component

stats

Time counters computed on JAR processing, containing:

  • visitJarEntries: Elapsed time to visit JAR entries, ns

  • jarEntriesHashes: Elapsed time to compute hashes of JAR class entries, ns

  • jarEntriesShaded: Elapsed time to compute shaded hashes of JAR class entries, ns

  • pomProperties: Elapsed time to process POM properties of JAR, ns

entries

Packed data with JAR entry details

VM Class Loaded

Payload of VM_CLASS_LOADED events.

Field Description

classId

VM specific ID of the class

loaderId

VM specific ID of the class loader that loaded the class

className

Fully qualified class name

source

Source of the loaded class

hash

Hash calculated by original class content

transformedHash

Hash of the class that was transformed on loading (e.g. instrumented)

VM Method First Called

Payload of VM_METHOD_FIRST_CALLED events.

Field Description

classId

VM specific ID of the class

methodName

Name and signature of the method

VM Performance Metrics

Payload of VM_PERFORMANCE_METRICS events.

Field Description

numEventBatches

Number of buckets sent to the cloud (events are sent in buckets)

numBytesOut

Number of bytes of data sent to the cloud

numConnections

Total number of HTTP connections established to the cloud (including all reconnects)

numRequests

Total number of HTTP requests to the cloud (greater than the number of connections since connections may be cached)

numClassLoads

Total number of registered class load events

maxQueueLength

Max reached event queue length

handshakeMillis

Elapsed time on handshake with the cloud

numBytesInArtifacts

Number of bytes sent as artifact data

communicationMillis

Elapsed time on network activity (handshake + read + write)

numBytesIn

Number of bytes received from the cloud

numEvents

Number of events sent to the cloud (class load, jar load, and everything else)

numEventHistogram

Histogram of the number of events sent to the cloud in one batch (base 2 logarithm of the number of events in the batch)

preShutdownMillis

Time elapsed since the start of VM shutdown hooks (effectively the end of user application), till the end of processing of rest events in the queue

numMethodEntries

Number of executed unique Java methods