Skip to content

Dynamic Runtime Scanning (Java)

Important

  • To perform a runtime scan, you must have an environment in which you can start your application with additional JVM options.

Instrument Your Application

Download the Java dynamic instrumentation agent JAR from your CodeLogic server:

wget http://your_server/codelogic/server/packages/java-dynamic-agent.jar

Replace your_server with your CodeLogic server hostname. Save the jar file in a location your application can access.

Add the following to your application's JVM options:

  • -javaagent:"/path/to/java-dynamic-agent.jar" -Xbootclasspath/a:"/path/to/java-dynamic-agent.jar"
  • -Dcodelogic.url=http://serverhost.app.codelogic.com/codelogic/server
  • -Dcodelogic.username="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
  • -Dcodelogic.password="agentpassword"
  • -Dcodelogic.namespaces=com.example,com.secondexample
  • -Dcodelogic.scanSpaceName=Default

Run your application.

Note

  • The username and password fields are to be used for existing agent credentials.
  • If username and password is omitted and the agent will register itself.

Note

  • Data is sent to the CodeLogic server every 1 minute.
  • This interval can be changed with the -Dcodelogic.reportingInterval parameter.
  • Example: -Dcodelogic.reportingInterval=5 for 5 minute intervals.

Authorize the Agent

For security, agents must be authorized before they will send metadata to the CodeLogic Server.

Obtain AGENT_UUID and AGENT_PASSWORD from your CodeLogic administrator, or set these environment variables before starting the agent. If credentials are not pre-provisioned, the agent may register with the server and await administrator approval before scans are accepted.

Stop the Scan

Stop your application to stop the scan.