Forensic tools, part 1

There are times when you really would like to know what the Java processes on the computer are doing at this very moment. Maybe the computer seems a bit sluggish, maybe the disk LED is not so much flashing but instead glowing constantly. Other times an application might seem just dead.

A possible scenario

You have started up an application, let’s say it is a web application which is running in an application server. After a while you notice that the application is behaving oddly. You cannot really put your finger on the problem, but sometimes it looks like the web pages are not served as they should. The application also feels slower than you expect.
First thing could be to check out the log files, but as you all know, the debug level
is set to INFO or WARNING because the application is in production:

10:10:40.542 INFOStarting  application...
10:12:21.650 INFOAll  service started.
10:14:22.145 INFOApplication  booted successfully. 

What conclusion do you draw from this output? The application has started and it
looks like nothing serious has detected in the code that is worth mentioning in the
log. Is it time to start guessing or just ignore the gut feeling you have? Not quite yet,
there are some help to be found not far away, and it will not cost you a dime.

Bring out the tools

In your Java SDK 1.5 (or higher) “bin” directory, there are tools that can be quite us-
able for poking around in the Java processes. There are different number of tools for
different platforms and the number of available functions per tool is also depending
on the distribution. Sun Solaris and Linux Java distributions have been blessed with
the most number of tools and functions, Mac OSX and Windows have the least.
Also, the tools are getting constantly improved for newer releases of Java.

Here is a comprehensive list of the tools mentioned in this article and on which
platforms they exist:

Figure 1

This article consists of two parts, and this first part goes through the available moni-
toring tools in the Sun Java 1.5 SDK bin directory.

Monitoring tools


To see which java processes that are currently running on a machine use the jps

> jps
1649 Application
2533 Jps 

The resulting output lists the VMID (Virtual Machine ID) and the Java process
name. To get extended information, append the -v flag to the jps command:

> jps v
1649  Application
2534 Jps


This command gives performance statistic information from the JVM for a Java
process. There are a number of statistic options available, which is displayed using
the -options switch:

> jstat -options

To print the statistics for one of the options above for a process, the VMID has to
be specified after the option. The VMID is the same id as listed with the jps com-

> jstat -gcutil  1649
0,00  0,00  78,32  0,00  0,24  0  0,000  0  0,000  0,000

Using the jstat command, it is possible to create scripts that periodically checks the
status for e.g. the number of loaded classes or the garbage collection utilization. In
the example above, the garbage collection has taken place mostly in Eden memory
space. Eden space is Sun Hotspot specific memory space for shortlived objects.
Information about memory pools can be found at


This command starts up a jstat daemon on a machine and enables remote monitor-
ing. To startup the daemon on the computer which should be monitored, the port
number where the remote clients can connect to has to be specified:

> jstatd -p  12345

After that, it is possible to use both jps and jstat remotely by specifying the host-
name and port:

> jps
2617 Jps
2611 Jstatd
1649 Application

The above example lists the processes on the ‘’ host using the
port 12345. Presented in the output, you can see the jstatd is also a java process.

> jstat  -gcutil
0,00  0,00  78,32 0,00  0,24  0  0,000  0  0,000  0,000

Above we can see the same example for process 1649 as in the previous command,
but this time listed for host ‘’ using port 12345.


On client computers, or servers with a graphical interface, it is possible to monitor
the JVM status by using a tool called jconsole. The jconsole tool visualizes services
that exposes a JMX (Java Management Extension) interface, and Java 1.5 and later
contains JMX beans for exposing the data defined in the

To be able to monitor java applications using jconsole in Java 1.5, the application
has to be started with the system property

> java -Dcom. jar  testapp.jar 

When the application has started, the jconsole can be initiated:

> jconsole 

The connection console displays all java processes that has JMX enabled. After con-
necting to the Java process, jconsole provides the following tabs:

  • Summary Tab
  • Memory Tab – The different memory pools can be inspected
  • Thread Tab – The total, peak and currently live threads are displayed
  • Classes Tab – The number of classes are displayed
  • Mbeans Tab – Gives access to the JMX beans in the management package
  • VM Tab – Displays information for the VM where the application is running in

Below are example screenshots for the memory and thread tab:

Figure 2

The jconsole application can be a tool to start with when looking at application
behavior over time, such as memory leaks or unusual thread behavior.

Using the Java monitoring and management tools you can get a better understanding
of the runtime behavior of your application. Sometimes this information is enough
for finding and fixing a problem.

This concludes the first part of the article. In the next issue of JayView we will look
into the troubleshooting tools.

Originally published in JayView.

Leave a Reply