Can we Uninstall Java on Production Server?

Question

A vulnerability scan on a web server told me that my version of Java needs to be updated. We run .NET web applications on this server, and to my knowledge there is nothing that uses Java. How can I determine if I can safely uninstall Java? I don't want to just uninstall it and then have something break. Is there an easy way to check if anything is dependent on it?

Answer 1

One solution, would be to update Java to remove the vulnerability. Next, write a small application that wraps the java executable (ie: rename java.exe to java-real.exe and make an app called java.exe that just passes all the arguments to java.exe and logs the calls to a file. After a month (or however long until you feel comfortable), if the log's empty, uninstall Java.

Answer 2

You could use Systernal's Process Monitor.

It will by default list all registry, file, process, etc activity on the system.

You could set a filter for Java, leave it running for however long you wish and see what kind of activity you get.

Such as add a filter for "When Path contains Java then Include".

You may also want "When Result is SUCCESS then Include" so that you don't get a bunch of attempts at things that aren't there. For example, if java is being called from within the PATH variable, before it finds java where it actually is, there will be attempts for it at C:\Windows, C:\Windows\System32, etc.

Answer 3

On such occasions I often try these:

find /some/path/ -type f -atime -50    # has any file been accessed (read) in last 50 days?
find /some/path/ -type f -ctime -50    # has any file had attributes changed in last 50 days?
find /some/path/ -type f -mtime -50    # has any file had been modified in last 50 days?

EDIT: missed the Windows 2003 tag... You can still use these commands on cygwin. Or run File Explorer -> F3 -> search all -> sort them by access time -> check manually -> sort them by modify time -> check manually). If the file was not accessed/modified, it probably means it is not required by anything.

Of course you can test uninstall to see if the removal of package requires removing something else, but it's a trivial case. (EDIT W2k3... not-so-trivial)

Answer 4

What kind of Java is installed?

Is it just the plain Java Runtime Environment or some server-side thing like Tomcat/JBoss/AnotherApplicationServer?

Chances are it simply go tinstalled when someone was browsing a website; but it could also be actually used by something else; but there's no easy way to tell.

Answer 5

Java has some internal tracing/logging options you could turn on and monitor the log to see what kind of activity occurs.

See Tracing and Logging on Sun's site.