Forensic tools, part 2

Have you ever been in the situation that an application behaves in strange ways and by the time you find out, you do not have access to your development environment. In this article we are discussing ways to pin- point the problem with tools available in the Sun SDK bin directory.

In the first part of this article, which can be found in the previous JayView, the monitoring tools of the Sun JDK 1.5 was presented. These monitoring tools can be a good start for looking at the current status, and behavior over time, for an application. While these tools can tell you some parts of the doings of an application, finding a problem is sometimes more effective using the troubleshooting tools. This second part of the article will present some of these tools.

Tools overview

The list below contains all tools presented in this article, where the first four can
be found in part one.


Note: A known issue for OSX require that some of the tools is run as root, which can be accomplished by putting ‘sudo ‘ before each command.

Troubleshooting tools

The troubleshooting tools provided by Sun Microsystems in the JDK bin directory are to be considered experimental. They come with no support and they might harm your system. Although being in an experimental state, the tools can be quite useful when looking for problems.

Some of the tools can connect to a locally or remotely running Java process, others operate on a core dump. This dump can be created by the JVM, by specifying Sun Hotspot specific flags such as -XX:+HeapDumpOnCtrlBreak or
-XX:+HeapDumpOnOutOfMemoryError. These flags should be appended to the java command just like system properties:

The core dump can also be created with jmap and the syntax is described below. Be aware that the jmap of JDK 1.5 have some problems creating this core dump, sometimes it creates a corrupted file. This specific issue with jmap is fixed in Java 6.


The jinfo tool connects to a running local process, a JVM core dump or a remote
process. The purpose of the tool is to display the VM flags used and the values of
the system properties for the process in question. The process id, or VMID, can be found using the jps command. Here is an example connecting to a running process with process id 1649:

In the example above, you can see that the Java application was started using the flag ‘’. To see the system properties, use the -sysprops flag:

The jinfo command can give a quick hint about what a java process can see from its environment.


The jstack command prints out the execution stack trace for threads for a process in the local JVM, a remote JVM or in a core dump. It also prints out thread deadlocks detected by the Hotspot VM, something that can come in handy for
solving threading issues. The command for connecting to a local process looks like:

In the example above, we can see that the Application.main( ) method is spending time in FileInputStream.readBytes( ).


This versatile command prints out information using the following flags:

  • – heap prints out heap information, including the different memory pools
  • – heap:format=b dumps the heap in a binary format
  • – histo prints class histogram information of the object heap
  • – permstat prints information class loader-wise about data in the permanent generation memory pool. The permanent generation memory pool contains class meta data and the String literals.

In the example above only the first part of the heap information is printed, there’s a lot more to see.

Above, the first part of the class histogram is printed for the process with VMID 1649.

The heap is dumped for the process with VMID 1649 in the example above, and the result is a file called heap.bin.

The jmap -heap and jstat with a suitable garbage collection flag can help with finding memory issues for object instances. Jmap -histo and jmap -permstat can be used for finding memory leaks in permanent generation memory space, e.g. when there are too many classes loaded by class loaders that never get garbage collected.

The jmap -heap:format=b flag has issues with the heap dump sometimes being corrupted, an issue which is fixed for Java 6. When the command is working the heap dump can be analyzed using tools described above and with a tool called jhat, which is bundled with Java 6 SDK. It is also possible to debug the heap dump using the java debugger, called jdb, which also can be found in the bin directory.

I recommend taking a look at jhat, which is a heap analysis tool that processes heap dumps. When invoking jhat it starts with analyzing all objects found in the heap core dump. After the analysis is finished a web server is launched. Use an ordinary web browser to connect to the web server to get access to the object browsing functions available.

One example of a function is the one that makes it possible to filter out weak
references between objects, so that objects that are not eligible for garbage collection can be found. It is also possible to use OQL (Object Query Language) where you can use an SQL-like syntax to get object set results, such as the number of instances for a specific object type, the value for all String objects etc.

The jhat tool is available in Java 6 but can be downloaded from Sun for Java 1.5.

To conclude this article, the monitoring and troubleshooting tools found in the bin directory for the JDK provided by Sun can be a good start when finding bugs in your java code. Use them, you might already have them on your computer.

Originally published in JayView.

Leave a Reply

Close Menu