Java Flight Recorder (JFR) is a powerful, low-overhead profiling and event-collection framework built directly into the Oracle HotSpot JVM. It acts like a ‘black box’ in an aircraft; it records events that are happening in the JVM, such as Garbage collection events, thread behavior, Method Invocations, and I/O activity. In the case if JVM has any performance problems, this JFR can be exported from the JVM and analyzed through tools like yCrash JFRPlayer to identify the root cause of the bottleneck. In this post, let’s discuss how yCrash JFRPlayer revolutionizes the JFR analysis in 9 different ways!
Watch the full webinar recording to explore how Deterministic AI transforms complex JFR event streams into structured, verified diagnostic insights.
1) Patterns-Based Error Detection
Fig: yCrash JFRPlayer pointing out Blocked Threads in the application
yCrash JFRPlayer just doesn’t present the JFR events ‘as is’; it applies various root cause analysis patterns and ML algorithms to detect the problems that are appearing in the JFR. On top of that, it will also report problems in an intuitive, easily understandable manner. The above image is an excerpt from the JFRPlayer, which reports the threads that are blocked in the application. This transitive Graph visually reports that ‘Flight Serv-2386’ thread blocks 101 threads. When you click on the ‘Flight Serv-2386’ hyperlink in the graph, you will be able to see the stack trace of the thread, precisely telling what lock it’s holding and why it’s not releasing it. This is just one sample for the visualization; there are several such visualizations in the yCrash JFRPlayer report. This makes troubleshooting a lot more fun & easier.
2) Deterministic AI Analysis
Fig: Deterministic AI Analysis using yCrash JFRPlayer
yCrash JFRPlayer uses its internal parsing engine to parse each and every event in the JFR file. Upon successful parsing, JFR Player identifies errors in the application, determines precise metrics, generates visual graphs, and builds a consolidated summary. This few KB of consolidated summary JSON is sent as input to the LLMs. This sets the context for your analysis in LLM, which will enable you to ask any target question on the JFR recording. Since the context is established by the JFRPlayer on the analyzed precise metrics, the LLM will respond to your queries in a deterministic, non-hallucinated manner. This strategy brings several key advantages, such as:
a) Determinism/Non-Hallucination: Since the LLM is working on precise metrics, errors, summary generated by the semantical parsers, the LLM will provide deterministic, non-hallucinated responses.
b) Drastically Reduced Token Usage: If the entire JFR file is sent to the LLM for analysis, the LLM will consume a significant amount of tokens, as it needs to process every event in the JFR file multiple times based on the query. However, in this strategy, yCrash JFRPlayer only transmits a few KB of JSON to the LLM for analysis. Thus, very few tokens will be consumed.
c) Data Security: The JFR file is a production artifact; it contains several confidential pieces of information, thus it’s security risk in transmitting the raw JFR file to the LLM. With yCrash JFRPlayer, this risk is completely eliminated because only the analyzed result is sent to the LLM.
(Note: You can configure any of your corporate approved LLM i.e., Google Gemini, OpenAI ChatGPT, Anthropic Claude… to your yCrash JFRPlayer instance. JFR Player can work with any standard LLMs.)
3) Desktop and Cloud Tool
yCrash JFRPlayer is a web application; thus, it can run on your local machine and from the cloud. You can install yCrash JFRPlayer in your private cloud and have your entire organization use this installation through various devices (Laptop, Mobile, Tablets).
Sometimes a JFR file can be quite large. In such circumstances, you might not have sufficient memory in your local machine to analyze the file. This is where yCrash JFRPlayer can be og huge help. You can install yCrash JFRPlayer on a large EC2 instance in the cloud & easily analyze the file. Similarly, collaborating and sharing the JFR reports with your colleagues becomes easy with JFRPlayer. Since it’s a cloud-based tool that can be accessed from the browser, you can embed the JFR report URLs into your JIRA tickets, emails, and Git commit messages easily.
4) REST API
Sometimes a JFR file can be quite large in size. In such circumstances, transporting the JFR file from the production servers where the JFR was collected to the developer’s desktop will be a tedious task. Because the SRE engineer first has to capture the JFR file from the target application and upload it to a shared drive. From the shared drive, the developer has to download it to his local machine, and then he has to upload it to his JFR analysis tool running on his local machine to do the analysis. This process will be repeated if the developer has to share this JFR file with a co-worker. This is where the yCrash JFRPlayer Upload REST API comes in handy. Using this API, an SRE engineer can directly transmit the JFR file from the production server to the JFRPlayer running on the private cloud. JFRPlayer will receive the JFR file, analyze it, generate a root cause analysis report & make it available in the dashboard.
5) Dashboard, Archiving & Compare Features
Fig: JFRPlayer Dashboard
Since JFRPlayer is a web application, it provides advanced dashboarding capabilities. Whenever you upload any JFR file for analysis, JFRPlayer will archive this JFR file and its analysis report. Thus, you can go back in time and view any historical report. Besides that, it also provides a comparison feature. Using this feature, you can compare two JFR files metrics and errors side by side in a single view. It makes it easier to understand the degradation or improvement in performance. Besides it, JFRPlayer also provides tagging, searching, filtering, and several more capabilities that make the JFR analysis more fun & organized.
6) Authentication, Authorization, Audit Logs
JFR file contains sensitive information from your production application, such as your IP address, libraries that it uses, configuration settings, … thus, the JFR file is classified as confidential information in several organizations. yCrash JFRPlayer reports are guarded by a proper authentication and authorization mechanism.
Authentication: yCrash JFRPlayer supports Single Sign-On (SSO) through SAML integration, enabling secure and seamless authentication for users across various platforms like Okta, OneLogin, Active Directory, and ForgeRock. By configuring the SSO settings, enterprises can centralize authentication, reduce the need for multiple login credentials, and enhance security through a streamlined access process. Without exposing critical information.
Authorization: yCrash JFRPlayer includes robust authorization controls, ensuring that only authorized personnel can access specific data and features within the platform. These controls help safeguard sensitive information and maintain compliance with organizational security policies, allowing fine-grained access management tailored to the needs of your team.
Audit Trail: yCrash JFRPlayer also maintains a complete audit trail of the users who access the incident reports, what pages in the incident report they navigate… So, in the case that you need any forensic or post-mortem analysis of any security breach, it can be easily achieved through yCrash.
7) Masking Sensitive Information
Fig: JFRPlayer sanitizes sensitive information
yCrash JFRPlayer provides the capability to sanitize the sensitive data in the JFR file. Whenever sensitive artifacts like heap dumps are uploaded to yCrash JFRPlayer for analysis, the tool sanitizes the heap dump for sensitive data (e.g., char arrays, byte arrays). It replaces the actual values with asterisks (*).
The sanitized heap dump will be written to disk, ensuring that no sensitive data is stored in its original form. The yCrash JFRPlayer analyzes the sanitized heap dump and will generate a heap report. In the heap report, sensitive values are displayed as asterisks (*), ensuring that no confidential information is exposed. Thus, even if Heap Dump lands in the wrong hands, they wouldn’t be able to do anything with it.
8) Holistic 360° Analysis
JFR is a wonderful artifact; however, it captures only JVM-level artifacts. If a problem happens outside the JVM, say at the kernel, JFR would be inadequate to identify the root cause of the problem. To do effective troubleshooting, you would require application-level, network-level, storage-level, kernel-level, I/O level artifacts as well. This is where the yc-360 open-source script can be of immense help. This yc-360 script captures holistic 16 different artifacts from the application stack. It also provides an extension mechanism to capture any additional artifact as well. You can capture JFR using this extension mechanism. This entire bundle can be uploaded to yCrash JFRPlayer for analysis. yCrash JFRPlayer will analyze the JFR file and all other artifacts to generate one comprehensive report spanning the entire stack and not just the JVM.
9) Auto-Detection & Self-Triggering Capability
One of the biggest challenges in troubleshooting is to capture the diagnostic information right when the problem happens. If the problem is going to happen at 2 am, it’s going to be hard to manually capture JFR at that mid-nighttime. This is where yCrash’s auto-detection, self-triggering mechanism comes in handy. You can configure the yc-360 open-source script in m3 mode. When you do so, this script passively monitors the micro-metrics of the application to detect whether any performance problems surface in the application. In case any performance problems surface, this script triggers a 360-degree capture of the artifacts. Once artifacts are captured, they will be automatically transmitted & made available in the yCrash JFRPlayer dashboard. Thus, you don’t have to undergo the hassle of manual JFR capturing.
Conclusion
I hope this post highlights how yCrash JFRPlayer takes JFR analysis to a whole new level. It simplifies troubleshooting while bringing advanced sophistication. We hope you can take advantage of its capabilities when troubleshooting complex production problems.