Skip to content

Commit 3feb52e

Browse files
cbehera-newreliccbehera-newrelic
authored
Merge pull request #21473 from jtduffy/patch-36
Update java-agent-configuration-config-file.mdx
2 parents 08b86a5 + 80620db commit 3feb52e

File tree

1 file changed

+249
-0
lines changed

1 file changed

+249
-0
lines changed

‎src/content/docs/apm/agents/java-agent/configuration/java-agent-configuration-config-file.mdx

Lines changed: 249 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5058,6 +5058,255 @@ You can set the New Relic Security agent configuration in the `security` section
50585058
New Relic Security agent interactive applications security testing (IAST) mode requires [Java agent version 8.4.0 or higher](/docs/agents/java-agent/installation/upgrade-java-agent).
50595059
</Callout>
50605060

5061+
## Skip Applications [#skip-applications]
5062+
5063+
The agent can be selectively disabled based on the startup main class or executable jar file that is extracted from the command line. This is handy in situations where the "JAVA_TOOL_OPTIONS" environment
5064+
variable is present and contains the -javaagent flag but we don't want to apply the instrumentation to all java apps in the environment - for example in a Kubernetes container.
5065+
5066+
<Callout variant="important">
5067+
The skip configuration is only supported via an environment variable because of how early in the agent lifecycle the skip configuration needs to be checked.
5068+
</Callout>
5069+
5070+
For diagnostic purposes, if the `NEW_RELIC_STARTUP_JAVA_ARTIFACT_SKIPS` variables is defined, the agent will print the extracted command line and parsed skip tokens to stdout:
5071+
```
5072+
New Relic Agent: Configured startup Java artifacts skip string: keytool,Main
5073+
New Relic Agent: Retrieved current startup command line / main artifact name: /Users/bob/.sdkman/candidates/java/11.0.17-amzn/bin/keytool
5074+
```
5075+
5076+
If the agent is disabled based on the defined skip variable, the following will be dumped to stdout:
5077+
```
5078+
----------
5079+
New Relic Agent is disabled by startup skip configuration.
5080+
----------
5081+
```
5082+
5083+
<CollapserGroup>
5084+
<Collapser
5085+
id="cfg-skip-configuration"
5086+
title="NEW_RELIC_STARTUP_JAVA_ARTIFACT_SKIPS"
5087+
>
5088+
<table>
5089+
<tbody>
5090+
<tr>
5091+
<th>
5092+
Type
5093+
</th>
5094+
5095+
<td>
5096+
List of strings
5097+
</td>
5098+
</tr>
5099+
5100+
<tr>
5101+
<th>
5102+
Default
5103+
</th>
5104+
5105+
<td>
5106+
(none)
5107+
</td>
5108+
</tr>
5109+
</tbody>
5110+
</table>
5111+
5112+
A comma separated list of main classes, executable jar files or Java based tools/apps that the agent should NOT instrument. For example:
5113+
`NEW_RELIC_STARTUP_JAVA_ARTIFACT_SKIPS=keytool,myapp.jar,IgnoreThisClass`.
5114+
</Collapser>
5115+
5116+
<Collapser
5117+
id="cfg-security-enabled"
5118+
title="enabled"
5119+
>
5120+
<table>
5121+
<tbody>
5122+
<tr>
5123+
<th>
5124+
Type
5125+
</th>
5126+
5127+
<td>
5128+
Boolean
5129+
</td>
5130+
</tr>
5131+
5132+
<tr>
5133+
<th>
5134+
Default
5135+
</th>
5136+
5137+
<td>
5138+
`false`
5139+
</td>
5140+
</tr>
5141+
</tbody>
5142+
</table>
5143+
5144+
Determines whether the security data is sent to New Relic or not. When this is disabled and agent.enabled is true, the security module will run but data will not be sent. Default is false.
5145+
</Collapser>
5146+
5147+
<Collapser
5148+
id="cfg-security-mode"
5149+
title="mode"
5150+
>
5151+
<table>
5152+
<tbody>
5153+
<tr>
5154+
<th>
5155+
Type
5156+
</th>
5157+
5158+
<td>
5159+
String
5160+
</td>
5161+
</tr>
5162+
5163+
<tr>
5164+
<th>
5165+
Default
5166+
</th>
5167+
5168+
<td>
5169+
`IAST`
5170+
</td>
5171+
</tr>
5172+
</tbody>
5173+
</table>
5174+
5175+
New Relic Security provide mode: IAST. Default is IAST. Due to the invasive nature of IAST scanning, DO NOT enable this mode in either a production environment or an environment where production data is processed.
5176+
</Collapser>
5177+
5178+
<Collapser
5179+
id="cfg-security-validator-service-url"
5180+
title="validator_service_url"
5181+
>
5182+
<table>
5183+
<tbody>
5184+
<tr>
5185+
<th>
5186+
Type
5187+
</th>
5188+
5189+
<td>
5190+
String
5191+
</td>
5192+
</tr>
5193+
5194+
<tr>
5195+
<th>
5196+
Default
5197+
</th>
5198+
5199+
<td>
5200+
`wss://csec.nr-data.net`
5201+
</td>
5202+
</tr>
5203+
</tbody>
5204+
</table>
5205+
5206+
New Relic Security’s SaaS connection URL. This is the endpoint that the security agent sends data to, it should match that environment that you have set for the APM Java agent.
5207+
5208+
US Production: wss://csec.nr-data.net
5209+
</Collapser>
5210+
5211+
<Collapser
5212+
id="cfg-security-detection-rci-enabled"
5213+
title="detection.rci.enabled"
5214+
>
5215+
<table>
5216+
<tbody>
5217+
<tr>
5218+
<th>
5219+
Type
5220+
</th>
5221+
5222+
<td>
5223+
Boolean
5224+
</td>
5225+
</tr>
5226+
5227+
<tr>
5228+
<th>
5229+
Default
5230+
</th>
5231+
5232+
<td>
5233+
`true`
5234+
</td>
5235+
</tr>
5236+
</tbody>
5237+
</table>
5238+
5239+
Enable RCI security event detection. Default is true.
5240+
</Collapser>
5241+
5242+
<Collapser
5243+
id="cfg-security-detection-rxss-enabled"
5244+
title="detection.rxss.enabled"
5245+
>
5246+
<table>
5247+
<tbody>
5248+
<tr>
5249+
<th>
5250+
Type
5251+
</th>
5252+
5253+
<td>
5254+
Boolean
5255+
</td>
5256+
</tr>
5257+
5258+
<tr>
5259+
<th>
5260+
Default
5261+
</th>
5262+
5263+
<td>
5264+
`true`
5265+
</td>
5266+
</tr>
5267+
</tbody>
5268+
</table>
5269+
5270+
Enable RXSS security event detection. Default is true.
5271+
</Collapser>
5272+
5273+
<Collapser
5274+
id="cfg-security-detection-deserialization-enabled"
5275+
title="detection.deserialization.enabled"
5276+
>
5277+
<table>
5278+
<tbody>
5279+
<tr>
5280+
<th>
5281+
Type
5282+
</th>
5283+
5284+
<td>
5285+
Boolean
5286+
</td>
5287+
</tr>
5288+
5289+
<tr>
5290+
<th>
5291+
Default
5292+
</th>
5293+
5294+
<td>
5295+
`true`
5296+
</td>
5297+
</tr>
5298+
</tbody>
5299+
</table>
5300+
5301+
Enable deserialization security event detection. Default is true.
5302+
</Collapser>
5303+
</CollapserGroup>
5304+
5305+
<Callout variant="important">
5306+
New Relic Security agent interactive applications security testing (IAST) mode requires [Java agent version 8.4.0 or higher](/docs/agents/java-agent/installation/upgrade-java-agent).
5307+
</Callout>
5308+
5309+
50615310
## Slow transaction Detection
50625311

50635312
The agent can now detect slow transactions via `SlowTransaction` events since Java Agent version `8.7.0`.

0 commit comments

Comments
 (0)