The Rise in Oracle Java Audits: How to gain clarity

Over the past couple of weeks Certero has noticed an alarming increase in Oracles interest in organizations Java estates particularly when organizations are looking to purchase additional subscriptions. In 2019 Oracle announced it would begin charging commercial users of Java under a subscription-based licensing model for versions post April 16th 2019. After this change all was quiet and we saw a lull in Java audit activity throughout the pandemic. Fast forward to today and we are seeing more and more customers being asked by Oracle to provide a list of their Java deployments *before* they can go ahead and purchase additional subscriptions. So, if your organization is looking to purchase additional Java licenses there are some thing you should consider.

The Challenge

Imagine this scenario: one of your team has just contacted you to say “we need to buy some Oracle Java subscriptions”.  Your first questions are likely to be, “how many, how much and for what?”.   Your colleague responds with “well, I think we have 3000 employees and somewhere around 155 servers so let’s buy 3155 subscriptions and that should do it”.  That sounds sensible right?  You check the price list, see its relatively low cost and so off you go to Oracle to buy the subscriptions.

But wait.

Oracle want to know what your Java estate looks like before you can proceed.

So now you have to go back to your colleague and ask the question “where are all of our Oracle Java deployments?  I need a list of the hosts and the users please”.  Your colleague is puzzled “How am I going to find all that?”

It’s a valid question.

Java has been around for such a long time it could be (and probably is) everywhere in your estate. Because it’s used by developers, it could be part of in-house or 3rd party applications or with other licensable products like those from IBM or SAP or even bundled with other Oracle licensing. Most companies will have Java in their build images so its rolled out with machine upgrades or for new starters. Its an endless merry-go-round of deployment with an array of mechanisms to do so.

How Certero Can Help?

The first step will be getting full visibility of your Java estate. Certero can help you to document your Java estate through our dedicated Java Service, this provides:

1. A comprehensive list of each unique host, be that a server or a laptop, and the iterations of Java each one has
2. We can confirm if your colleagues request for 3155 subscriptions is accurate and we can tell you which host or user is consuming them
3. We can also tell you:
   1. If you have security risks with older, unsupported versions of Java
   2. If you have 3rd party deployments such as IBM or SAP
   3. If you have open-source Java and how many variants there are

How is this done? Via our own unique Certero ITAM/SAM solution which allows us to dig into the installed software on the operating system, be it Windows or Linux or Mac.

This service is evidence based – it’s not about assumptions or running scripts – the data is there for you to investigate and see for yourself.

We analyze this information and provide you with a comprehensive report including supporting data which allows you to drill into specific hosts (sample data)

Or to look at your estate as a whole – what would it cost to license it now and in the future by providing the figures for legacy as well as licensable Java (sample data)

Then it’s all wrapped up in a useable, customizable dashboard which ticks over automatically keeping you informed about your Java deployments.

Certero have provided this service for many customers since Java became licensable and its proving invaluable in helping them.  They can quantify what they actually need to buy and also target legacy problems and remove potential security risks as they do so.  

It is more than just a way to pacify Oracle’s request, it’s a way to grab control of one of the trickiest areas of your subscription licensing, understand what “subscription” Java means, ring-fence the legacy or the non-Oracle and to plan your future Java strategy.