Updated FlexNet Inventory agent for Oracle Java compliance

[vijay_menon]

There has been much consternation about the changes that Oracle has introduced around Java recently. In a nutshell, commercial use of Oracle’s Java Standard Edition (SE) will now require a paid subscription.

These are some of the possible issues that you need to consider:

• Your developers have been using Oracle Java JDK for in-house projects without being aware of the commercial implications
• Your environments contain certain older versions of Java, and you are not sure whether they are now free or not
• You want to understand how much Java is being used so you can decide whether to purchase a Java SE subscription or plan to migrate to another Java distribution

We explained the change in more detail with its impacts and the recommended approach to address these issues in this webinar earlier this year.Recommended approach to Oracle Java compliance

An updated FlexNet inventory agent was released earlier this year for FlexNet Manager Suite Cloud customers. This has now been made available for On-Premises customers too. You can download the agent and the install instructions from the Product and License Center (PLC).

For details about the feature, please go through the topic in the following Features by Release page.

Feature highlights (and steps to Oracle Java compliance):

• Identify MSI, package and archive-based installations of Java Development Kit (JDK) and Java Runtime Environment (JRE) This helps find all forms of recognizable evidence of Java installed in your environment
• Detect these installations in Windows and Unix/Linux environments. This helps to determine how much Java exists across your environment regardless of operating system.
• Distinguish between different publishers of Java based on installation evidence. This helps to segregate Oracle Java from other distributions.
• Differentiate among major and minor versions of Java. This helps to understand which versions of Oracle Java now have a commercial impact.
• Assign appropriate server and desktop license models to understand consumption of Oracle Java. This helps you know how much your Java installations will cost you.

Addendum:

As part of the Application Recognition Library (ARL) #2439 released on July 12, the following commercial minor versions of Oracle Java are classified appropriately: 8.0.211 and 8.0.212.

[malderton]

Hi, what is the version number of the Inventory Agent currently available to on -premise owners ?

[ChrisG]

@malderton - at this point in time the latest agent version number is 13.4.1.25 (also known as release "2019 R1.2").

[Ronny_OO7]

Hi, 

I am wondering if there is also a requirement/change for the FNMS backend? The reason why I ask is because it mentioned cloud and I would like to use this on prem.

Also is nothing changed for windows also because the text say windows/linux but the link shows Linux only

https://helpnet.flexerasoftware.com/fnms/EN/features/index.html#FeatureList/2019R1-2/RN_chg_JavaInvOnUX.html

This capability brings Java inventory gathering on UNIX-like platforms in line with existing functionality on Windows platforms. As well, ARL recognition of file evidence for Java on Windows has been improved, so that both installer evidence and file evidence can be recognized on Windows.

Regards

Ronald

[ChrisG]

@Ronny_OO7 - there is no application server change here, but this capability does depend on having current application recognition library content installed.

You are right that there is no change in the Windows agent related to Java: the Windows agent already has the capability to gather relevant data. The agent change is on UNIX-like operating systems, to bring the agent capabilities on those systems in line with capabilities on Windows.

[Ronny_OO7]

Thanks Chris. Does this mean with the latest ARL FNMS agent is capable of detecting all commercial applications for a 100%? I remember from previous discussing that there where some flaws in the agent java detection. 

This part is also interesting:  However, if you wish to gather Java inventory from devices where the archive was copied into place and the installer was not run, the includedirectory preference must be correctly set to allow scanning of the folder where Java is installed.

Does that mean If I use the latest agent version and the latest ARL and do a full scan on every disk \ that my customers should be able to report trustworthy reports on commercial Java products? Including embedded java for example?

[ChrisG]

@Ronny_OO7 - take a look at the final "Note" in the article above: there are still some more updates being worked on to further improve the comprehensiveness of results.

Your thinking to scan all disks/file systems to get the most complete results makes sense to me. Of course, there is always a tradeoff between scanning more filesystems and the time it takes to import and process larger amounts of data - in large organizations, it may not be feasible to do a complete file scan on all computers due to the massive number of files that exist across an organization.

[Ronny_OO7]

Hi Chris,

Thanks, actually i did already read that part. And yes I fully agree with you on the part to do a full drive scan. these days it often more seems a requirement to scan the full disk for vendors like IBM, Oracle. At the other hand there are disadvantages related in doing so.

Perhaps this is someting you can discuss internally? What can be done to improve scanning on full disks and handle the amount of data?

[liz_burley]

For the purpose of clarity is it only FlexNet inventory agent from version 2019 R1.2 that (13.4.1) collects additional inventory evidence for Java? As a consequence any prior version - 2019 R1.1 or older - will not collect this information

[vijay_menon]

Hi @liz_burley the FlexNet inventory agent version 13.4.1 adds Java detection capabilities for Unix/Linux environments. And it is backward compatible with previous versions of FNMS. We’ve had questions for as far back as 2017 R1 and it is still compatible.

[INgrid]

Is any recording of the webinar mentioned in the article available?

We explained the change in more detail with its impacts and the recommended approach to address these issues in this webinar earlier this year.

---

The link says "Registration for this Webinar is closed. Please check back soon for the recorded version."

---

[vijay_menon]

Hi @INgrid  I checked the link with my email ID and was able to register. I was taken to the webinar link page with the recording.

Could you please try again and let me know if you're still having issues registering and I can send you the direct link to the recording.

[Ronny_OO7]

Good day,

I am wondering what the current status is? Is ARL fully updated now? 

Also what is the minimum version of the agent to detect Java required on Windows?

Regards 

[INgrid]

---

@vijay_menon Thank you, now it works. 

---

[vijay_menon]

Hi @Ronny_OO7, there are updates to the ARL going in this weekend which will support the most current classifications of Java 8 minor versions.

And you can use versions of the Flexera Agent from 2016 and later to detect Java on Windows.

Regards,

Vijay

[Ronny_OO7]

Hi Vijay,

Thanks for this useful information. 

Will look after the ARL update then.

Regards

Ronald

[mag00_75]

Hi

Are their any plans of changing the evidences for the older commercial releases of java 5,6,7?

In the similair way you have implemented that never java 8 is classified as Commercial.

[vijay_menon]

Hi @mag00_75 , 

We do not have plans at the moment to change evidences for older releases (like Java 5, 6, 7) to commercial since Oracle has not indicated anything to that effect. Older java versions till 7 are essentially still free although most customers would have updated to later versions for functionality and security patches. Only the Java 8u211 and 8u212 Patch Set Updates have been made paid for commercial use.

Regards,

Vijay

[mag00_75]

Hi @vijay_menon 

The following updates are only available through the Java SE Support program.
Then with these you should probably be able to setup in the same way you configured the latest Java 8 releases.

Java SE 5 Update 23 to 85
Java SE 6 Update 51 to 211
Java SE 7 Update 85 to 221 

Oracle have also published an article about it, but the wikipedia is bit easier to read.
https://en.wikipedia.org/wiki/Java_version_history

[mag00_75]

Hi @vijay_menon 

Java 7 will have support and updates until year 2022 for subscription customers. Would be really great if Flexera could update the ARL similair as the Java 8.

We have several other oracle products and support, so for them we where allowed to run latest payed patches. But for all other oracle we now get hold of the security patches thru the subscription

[vijay_menon]

@mag00_75  Thanks for the suggestion. Will take it up with our content team.

[walterle818]

Thank you for the post it was very helpful. However I'm still seeking to confirm if we are required to purchase Oracle Java SE licenses for our Non Production servers. The majority of our Non Prod servers have a mix of Commercial and Non Commercial Oracle Java SE products installed. Do you have any insight?

[vijay_menon]

@walterle818 The following section in the their licensing FAQs clarifies that aspect.

The Oracle JDK License FAQ states the following:

For what uses is Oracle Java SE, including Java 8 updates, free?
For full information and terms, refer to the OTN License Agreement for Java SE. The OTN License Agreement for Java SE for current Oracle Java SE releases allows them to be used, without cost:

(i)    For personal use on a desktop or laptop computer, such as to play games or run other personal applications.
(ii)    For development, testing, prototyping, and demonstrating applications, including to use by/with profilers, debuggers, and Integrated Development Environment tools.
(iii)    For use with some approved products, such as Oracle SQL Developer, or as an end user of a software application created by an approved product. (referred to as “Schedule A” and “Schedule B” Products in the OTN License Agreement for Java SE)
(iv)    With identified Oracle Cloud Infrastructure products.

[steffen]

quick question:

• in order to discover commercial Oracle Java is there the FNMS prerequisite to "turn ON" Filesystem scanning?

I can reproduce the following:

with FS-scanning=ON FNMS recognises "Oracle Java Platform 8.0.211 Standard" correctly, turning FS-scanning=OFF the product is unlinked again

My env:

• FNMS 2019R2 on site
• Agent 14.0
• Operating system: Oracle Linux Server

Thanks and greetings - Steffen

[steffen]

we currently have ARL 2490 installed and PURL/SKUS 444

[kclausen]

@steffen  - Yes, in order to correctly identify the version and edition of Java, File Scanning must be enabled as this information is not available in the installer evidence/package repository information (such as Linux RPM).

[Nico_Erasmus]

Hi Community and Flexera team.

Has anyone in the community, reseller or customer, actually been engaged by Oracle for Java licensing as yet.  I understand that they have only recently finalized the commercial model and are now starting to contact customers to acquire licensing.

Would appreciate any sharing of information regards the interaction and the Flexera configuration.

Regards,

[sissonr]

Hi. We are currently in the discussions phase to add Java SE to our Oracle contract. So not much yet. However, I have a related question: has anyone begun review of  the Java Usage Tracker Utility Oracle has published? See documenations here at https://docs.oracle.com/javacomponents/usage-tracker/overview/toc.htm#JSUTO-GUID-ABB06CE8-070D-44F8-A456-FA5803B5C776. If I understand this correctly, this would be used to identify devices that qualify for a Java SE licensing exemption under the OAPUL A or B, or under an OTN license.

Also, does Flexera have any plan to incorporate or integrate with this Java Usage Tracker?

[vijay_menon]

@sissonr  Thanks for the question. The Java Usage Tracker is an independent means of verifying usage which customers can use if they already have the Advanced Java Suite or plan to sign up for a Java SE subscription. Our tracking capability is independent of the usage tracker since we wanted to build something that was broadly applicable, even for customers that do not have Advanced Java or plan to get a Java SE subscription. We currently do not have plans to integrate with the Java Usage Tracker utility but might do so in the future if a suitable integration use case arises.

[sissonr]

@vijay_menon  Thank you for the response! Would you send me the link to the documentation showing FlexNet's capabilities for identifying devices that can be exempted from Java SE under OAPUL A or B?

[craig_moore]

The webinar mentions future enhancements to agent to detect edition and also for FNMS to handle bundles.

Is that yet in place?

Thanks

Craig

[vijay_menon]

@craig_moore Thanks for the question. The general scenarios for editions and bundles have proven to be less relevant since editions apply to cases where Java was already being paid for (e.g. Advanced Java) and would just be migrated to an SE subscription and for bundles the licensing is already covered by the application Java is bundled with. 

[vijay_menon]

@sissonr Here's a link to the feature (written up for Unix but refers to the Windows scenario as well): https://docs.flexera.com/fnms/EN/features/index.html#FeatureList/2019R1-2/RN_chg_JavaInvOnUX.html

Our inventory gathering guide is another excellent reference to get a general understanding: https://docs.flexera.com/fnms/EN/GatherFNInv/index.html

[sissonr]

Hello. Does anyone have experience with creating a license for JavaSE using the Named User Plus metric? How does consumption behave for instances of commercial JRE installed on workstations? Is consumption based on the quantities of installations, or does consumption factor in separate user accounts on the workstation?