高级使用情况追踪
通过高级使用情况跟踪，您可以了解在托管实例上运行的 Java 服务器以及 Java 应用使用的库，并通过显示检测到的库是否包含一些已知漏洞来提高安全性。
高级使用情况跟踪包括：
- 扫描 Java 服务器
- 扫描 Java 库
扫描 Java 服务器
使用此功能可以搜索组中运行的 Java 服务器。JMS 当前能够检测 WebLogic、JBoss 和 Tomcat 服务器。成功搜索后，可以在 JMS 组 Java Server 部分中找到检测到的所有 Java 服务器。
OCI 云控制台
- 以管理员身份登录 OCI 控制台。
- 打开导航菜单，单击可观察性和管理，然后单击 Java 管理下的组。
- 选择您的组。
- 单击操作，然后从菜单中选择扫描 Java 服务器。
- 单击扫描。
- 完成工作请求后，单击组的“Java 服务器”部分。应列出检测到的所有 Java 服务器
OCI CLI
- 执行以下命令：
oci jms java-server-usage scan --fleet-id $FLEET_OCID注意：
您可以通过附加参数--managed-instance-ids指定应运行扫描的托管实例的 JSON 列表，否则将选择组中的所有托管实例。
JMS 插件在 Java 服务器扫描期间发送到 OCI 清单日志对象的 JSON 有效负载示例：
{
"datetime": 1749559306604,
"logContent": {
"id": "ac26cc41-de6d-4f8a-994b-909a3705d0db",
"time": "2025-06-10T12:41:46.604Z",
"oracle": {
"compartmentid": "ocid1.compartment.oc1..compartment-id",
"ingestedtime": "2025-06-10T12:42:08.158306651Z",
"instanceid": "ocid1.instance.oc1.eu-frankfurt-1.instance-id",
"loggroupid": "ocid1.loggroup.oc1.eu-frankfurt-1.log-group-id",
"logid": "ocid1.log.oc1.eu-frankfurt-1.log-id",
"tenantid": "ocid1.tenancy.oc1..tenant-id"
},
"source": "ocid1.instance.oc1.eu-frankfurt-1.instance-id",
"specversion": "1.0",
"subject": "Oracle JMS Plugin",
"type": "jms.javaserver.metadata.log",
"data": {
"data": {
"clusterName": "",
"committedHeap": 16252928,
"deployments": [],
"fleetId": "ocid1.jmsfleet.oc1.eu-frankfurt-1.fleet-id",
"initHeap": 16777216,
"javaDistribution": "Java(TM) SE Runtime Environment",
"javaHome": "/usr/lib/jvm/jdk-17.0.15-oracle-x64",
"javaMajorVersion": "17",
"javaVendor": "Oracle Corporation",
"javaVersion": "17.0.15",
"managedInstanceId": "ocid1.instance.oc1.eu-frankfurt-1.instance-id",
"maxHeap": 241303552,
"osArch": "amd64",
"osName": "Linux",
"osVersion": "5.15.0-306.177.4.el9uek.x86_64",
"productName": "Apache Tomcat",
"productVersion": "11.0.8.0",
"serverHome": "/home/opc/apache-tomcat-11.0.8",
"serverName": "N/A",
"serverPort": "8088",
"usedHeap": 13224344
},
"datacontenttype": "application/json",
"dataschema": "1.0",
"id": "5d1178ee-f8e9-4cd4-a463-5bb309c02b99",
"source": "ocid1.instance.oc1.eu-frankfurt-1.instance-id",
"specversion": "1.0",
"time": "2025-06-10T12:41:46.601Z",
"type": "jms.javaserver.metadata.log"
}
},
"regionId": "eu-frankfurt-1"
}扫描 Java 库
通过此功能，您可以在组中名为 Java 库的单个部分中生成 Java 应用程序使用的所有库的报告。
您可以使用它来扫描 Java 第三方库中的已知漏洞，并确保 Java 应用程序不使用不需要的库。要更好地了解 JMS 能够检测或无法检测的内容，请参阅此处的官方文档：扫描 Java 库。
OCI 云控制台
- 以管理员身份登录 OCI 控制台。
- 打开导航菜单，单击可观察性和管理，然后单击 Java 管理下的组。
- 选择您的组。
- 单击操作，然后从菜单中选择扫描 Java 库。
- 单击扫描。
- 工作请求完成后，单击组的“Java 库”部分。应列出检测到的所有 Java 库
OCI CLI
- 执行以下命令：
oci jms library-usage scan --fleet-id $FLEET_OCID注意：
您可以通过附加参数--managed-instance-ids指定应运行扫描的托管实例的 JSON 列表，否则将选择组中的所有托管实例。
JMS 插件在 Java 库扫描期间发送到 OCI 清单日志对象的 JSON 有效负载示例：
{
"datetime": 1749633185521,
"logContent": {
"id": "e7915f73-ac67-4ec7-9d4d-7798cb9e0ce0",
"time": "2025-06-11T09:13:05.521Z",
"oracle": {
"compartmentid": "ocid1.compartment.oc1..compartment-id",
"ingestedtime": "2025-06-11T09:14:53.129341509Z",
"instanceid": "ocid1.instance.oc1.eu-frankfurt-1.instance-id",
"loggroupid": "ocid1.loggroup.oc1.eu-frankfurt-1.log-group-id",
"logid": "ocid1.log.oc1.eu-frankfurt-1.log-id",
"tenantid": "ocid1.tenancy.oc1..tenant-id"
},
"source": "ocid1.instance.oc1.eu-frankfurt-1.instance-id",
"specversion": "1.0",
"subject": "Oracle JMS Plugin",
"type": "jms.javaserver.libraries.log",
"data": {
"data": {
"applicationSourcePath": "/var/lib/tomcat/webapps/java-webapp-demo-0.0.1-SNAPSHOT.war",
"clusterName": "",
"committedHeap": 25296896,
"deploymentName": "java-webapp-demo-0.0.1-SNAPSHOT",
"deploymentType": "war",
"fleetId": "ocid1.jmsfleet.oc1.eu-frankfurt-1.fleet-id",
"initHeap": 16777216,
"javaDistribution": "Java(TM) SE Runtime Environment",
"javaHome": "/opt/java/jdk-24.0.1",
"javaMajorVersion": "24",
"javaVendor": "Oracle Corporation",
"javaVersion": "24.0.1",
"libraries": [
"google llc:error_prone_annotations:2.30.0:com.google.errorprone",
"fasterxml:jackson-datatype-jsr310:2.19.0:com.fasterxml.jackson.datatype",
"fasterxml:jackson-core:2.19.0:com.fasterxml.jackson.core",
"the apache software foundation:log4j-to-slf4j:2.24.3:org.apache.logging.log4j",
"google gson project:gson:2.13.1:com.google.code.gson",
"slf4j.org:slf4j-api:2.0.17:org.slf4j",
"google llc:proto-google-common-protos:2.54.1:com.google.api.grpc",
"the apache software foundation:log4j-api:2.24.3:org.apache.logging.log4j",
"h2 group:h2:2.3.232:n/a",
"slf4j.org:jul-to-slf4j:2.0.17:org.slf4j",
"qos.ch:logback-classic:1.5.18:ch.qos.logback",
"fasterxml:jackson-annotations:2.19.0:com.fasterxml.jackson.core",
"fasterxml:jackson-module-parameter-names:2.19.0:com.fasterxml.jackson.module",
"fasterxml:jackson-databind:2.19.0:com.fasterxml.jackson.core",
"eclipse foundation:jakarta.annotation-api:2.1.1:jakarta.annotation",
"qos.ch:logback-core:1.5.18:ch.qos.logback"
],
"managedInstanceId": "ocid1.instance.oc1.eu-frankfurt-1.instance-id",
"maxHeap": 241303552,
"osArch": "amd64",
"osName": "Linux",
"osVersion": "5.15.0-306.177.4.el9uek.x86_64",
"productName": "Apache Tomcat",
"productVersion": "9.0.87.0",
"serverHome": "/usr/share/tomcat",
"serverName": "N/A",
"serverPort": "8080",
"usedHeap": 23623336
},
"datacontenttype": "application/json",
"dataschema": "1.0",
"id": "f725e769-aea1-4c46-9125-9bec280b75c6",
"source": "ocid1.instance.oc1.eu-frankfurt-1.instance-id",
"specversion": "1.0",
"time": "2025-06-11T09:13:05.518Z",
"type": "jms.javaserver.libraries.log"
}
},
"regionId": "eu-frankfurt-1"
}范例
想象一下，您有一个由您喜爱的软件提供商开发的 Java 应用程序，该应用程序部署在位于基础结构内的服务器上。为了避免任何可能的安全问题，您需要知道应用程序是否不包含任何已知的安全漏洞。在下面的示例中，我们在 Apache Tomcat 服务器上部署了一个 Java Web 应用程序，现在我们将使用以下脚本执行 Java 库扫描：
#!/usr/bin/env bash
# configuration variables
FLEET_OCID=ocid1.jmsfleet.oc1.eu-frankfurt-1.amaaaaaaptiaquqa2qxxkco6hrguz7nyug2hcpgikhe5gz4d7uy6j6ilbtta
MANAGED_INSTANCE_OCID=ocid1.instance.oc1.eu-frankfurt-1.antheljtptiaquqcrjmnu7mxbjthm2jm5qzryu7xy4w27rfo56nxf4uwv6pq
# execute library scan on specific managed instance within your fleet where example application is running
WORK_REQUEST_OCID=$(oci jms library-usage scan \
--fleet-id "$FLEET_OCID" \
--managed-instance-ids "[\"$MANAGED_INSTANCE_OCID\"]" | jq -r '."opc-work-request-id"')
echo $WORK_REQUEST_OCID
# additionally you can add your own logic to check if work request is finished
# sleep 600
# oci jms work-request get --work-request-id "$WORK_REQUEST_OCID" | jq .data.status一旦工作请求完成并且 JMS 中存在数据，我们可以通过以下命令检查我们的应用程序是否包含一些漏洞：
#!/usr/bin/env bash
# configuration variables
FLEET_OCID=ocid1.jmsfleet.oc1.eu-frankfurt-1.amaaaaaaptiaquqa2qxxkco6hrguz7nyug2hcpgikhe5gz4d7uy6j6ilbtta
MANAGED_INSTANCE_OCID=ocid1.instance.oc1.eu-frankfurt-1.antheljtptiaquqcrjmnu7mxbjthm2jm5qzryu7xy4w27rfo56nxf4uwv6pq
# show first 1000 libraries and print those where JMS is aware of some CVE
oci jms library-usage summarize \
--fleet-id $FLEET_OCID \
--managed-instance-id $MANAGED_INSTANCE_OCID \
--limit 1000 \
--sort-by timeFirstSeen \
--sort-order desc | jq '.data.items|map(select(."cve-id" != null))'
[
{
"approximate-application-count": 0,
"approximate-deployed-application-count": 1,
"approximate-java-server-instance-count": 1,
"approximate-managed-instance-count": 1,
"cve-id": "CVE-2021-20190",
"cvss-score": 8.3,
"fleet-id": "ocid1.jmsfleet.oc1.eu-frankfurt-1.amaaaaaaptiaquqa2qxxkco6hrguz7nyug2hcpgikhe5gz4d7uy6j6ilbtta",
"library-key": "425505b8076ceac87cc479168829bd75d6a9b2a9e9a1546989b87622da59af39",
"library-name": "jackson-databind",
"library-version": "2.8.11.6",
"time-end": "2025-06-16T16:14:44.233000+00:00",
"time-first-seen": "2025-06-16T13:09:00+00:00",
"time-last-cve-refreshed": "2025-06-15T00:00:00+00:00",
"time-last-seen": "2025-06-16T13:09:00+00:00",
"time-start": "2025-06-09T00:00:00+00:00"
},
{
"approximate-application-count": 0,
"approximate-deployed-application-count": 1,
"approximate-java-server-instance-count": 1,
"approximate-managed-instance-count": 1,
"cve-id": "CVE-2021-36090",
"cvss-score": 5.0,
"fleet-id": "ocid1.jmsfleet.oc1.eu-frankfurt-1.amaaaaaaptiaquqa2qxxkco6hrguz7nyug2hcpgikhe5gz4d7uy6j6ilbtta",
"library-key": "6cdd56d2278eec9e4c31a9c50567821a06695341957496956d5a9defcfd3dd10",
"library-name": "commons-compress",
"library-version": "1.20",
"time-end": "2025-06-16T16:14:44.233000+00:00",
"time-first-seen": "2025-06-16T13:09:00+00:00",
"time-last-cve-refreshed": "2025-06-15T00:00:00+00:00",
"time-last-seen": "2025-06-16T13:09:00+00:00",
"time-start": "2025-06-09T00:00:00+00:00"
}
]在上面的示例中，我们可以看到应用程序依赖于版本 2.8.11.6 的 jackson-databind 库，该库应该由于 CVE-2021-20190 而更新。类似的查找结果也适用于版本 1.20 的依赖项 commons-compress，该依赖项报告了漏洞 CVE-2021-36090。