Oracle has made Java one of the most actively audited areas. The reason is the employee metric: Even a single instance of Oracle Java can make the entire workforce subject to licensing requirements, regardless of how many people actually use Java. If you don’t want to be caught off guard, check your Java compliance before Oracle gets in touch. ProLicense, the independent licensing consultancy, explains what this preliminary review entails.
Why Java audits are so dangerous
Oracle tracks downloads of its Java builds and uses this information to reach out to companies. Because of the “employee metric,” even a small discovery can lead to a large claim—since it’s not the number of Java users that counts, but the entire workforce. To make matters worse, Java often runs hidden—bundled with third-party software or as a forgotten legacy installation on servers long since written off. It is precisely these findings that surface in the audit and drive up the bill.
What a preliminary audit must achieve
A robust self-assessment follows a clear sequence. It provides clarity on the actual risk before Oracle calls and is the most effective protection in practice.
Step 1: Take inventory of Java. Determine where Java is actually running: on servers, clients, in the cloud, and embedded in third-party software. Without a complete inventory, no conclusions can be drawn.
Step 2: Determine the source and version. For each instance found, clarify whether it is Oracle JDK or a free OpenJDK distribution and identify the specific version. Oracle’s scripts often incorrectly flag OpenJDK as Oracle JDK.
Step 3: Clarify the license status for each instance. Verify whether an instance actually requires a license. Not every installation does. Older JDK versions, test and development systems, and expired free-use periods must be properly categorized.
Step 4: Extrapolate the risk to the employee metric. Convert the remaining risk—the portion that actually requires a license—into the employee metric. Experience shows that Oracle’s assumed number of employees is significantly overestimated.
Step 5: Determine course of action. Based on the results, define a strategy that ensures Java can be used cost-effectively in the future without the risk of an Oracle audit.
“In practice, conducting your own thorough inventory eliminates the majority of the claimed liability. Those who know their risk in advance do not have to negotiate from a defensive position,” says Christian Grave, managing director of ProLicense.
Oracle Java find: What to check
| Find | Question | Possible classification |
|---|---|---|
| Oracle JDK 8 | Will it be used with patches after 2019? | Typically requires a license for production use |
| Oracle JDK 11 | Production or development only? | Free for dev and test only on OTN |
| Oracle JDK 17 / 21 | Is the free-use window still open? | Requires a license after the NFTC window expires |
| OpenJDK distribution | Is it really OpenJDK, or is this an error message? | Generally not subject to licensing |
| Java in third-party software | Covered by the manufacturer’s license agreement? | Depends on the terms of distribution |
| Legacy installation, test system | In production or decommissioned? | Can often be excluded from the claim |
The way out of the risk
Once the actual risk has been identified, a decision on how to proceed must be made. ProLicense specializes in Java licensing and finds the right alternative to Oracle Java for every company. The goal is to ensure that Java can be used cost-effectively in the future without the risk of an Oracle audit, while maintaining the same level of quality. Which alternative is the right one depends on the specific environment and is determined by the preliminary assessment. If Oracle has already approached a company, ProLicense also stands by the client’s side during the Oracle audit and verifies whether the audit clause even applies.
“We specialize in Java and seek out the alternative that best fits each client’s environment. Ultimately, the company runs Java cost-effectively and is permanently free of the Oracle audit risk. No one has to compromise on quality,” says Markus Oberg, a partner at ProLicense.
The goal remains the same in every case: minimal costs with full compliance. Anyone who wants a Java audit check for their own environment can reach ProLicense via the contact page or at +49 (0) 40-228 6828-0.