What to Do If Oracle Starts a Java Audit After Expiration
Hearing from Oracle about a Java audit can be stressful, especially if your license has expired. But knowing how the process works will help you respond effectively. Here are key steps and tips for handling an audit:
Read Is Your Java License Agreement Expiring? 10 Things You Must Know.
Understand the Audit Process
Oracle’s audit usually begins in two stages:
- Soft Audit (Informal): Oracle or their partner contacts you with a general inquiry. This could be an email or call claiming evidence of Oracle Java downloads or usage. They might ask to schedule a “health check” or provide non-binding data.
- Formal Audit (Official): If the issue remains unresolved, Oracle may invoke contract terms to launch a formal audit. They will request detailed information and access to your systems under the Oracle License Agreement, which can lead to a binding audit report.
The formal process can involve on-site visits or remote collection tools. For example, Oracle might use its LMS (License Management Services) scripts to scan your environment. Understand which agreements allow audits (e.g., a maintained license often has an audit clause).
Oracle’s Common Tactics
Oracle auditors use several tactics:
- Download logs: Oracle logs those who have downloaded Java from their site. They might reference a claim like “Your employees downloaded the JDK N times.”
- Pointed questions: They may email asking for an inventory or the number of CPUs/cores with Java. Every answer feeds their analysis.
- Data requests: They might ask for details about your servers, VM hosts, user counts, etc. This is typical in a formal audit.
- Pressure timeline: Oracle often sets quick deadlines for response to push you into a corner. For example, they may say, “Please reply by [date] to avoid penalties.”
Be prepared, as Oracle may already have some data. Even if you think they do not, assume they have some telemetry.
How to Respond
When you receive notice:
- Stay calm and gather the team: Don’t panic. Assemble a cross-functional audit response team (SAM, legal, IT, and maybe outside counsel or consultants).
- Review your license documents: Understand what contracts and entitlements you have. This will guide what you can legitimately claim.
- Inventory and data: Have your inventory ready. Use the records of Java installations from your preparation steps. If you didn’t do that, start collecting data now: number of servers, employee count, usage patterns.
- Ask for details: Request clarity from Oracle on what scope they plan to audit. Are they looking at all Java uses or only certain divisions?
- Set deadlines: Oracle may impose tight deadlines. Negotiate for more time if needed (one or two weeks at minimum) to gather accurate information.
- Use Oracle’s scripts: If they insist on scans, ask to run their LMS scripts yourself or have a third party do it. This gives you visibility into what they find.
- Negotiate specifics: If they charge for the audit, verify if that is contractually allowed. Sometimes, customers have negotiated limitations on audit charges.
Throughout, keep all communications factual and professional. Avoid admitting any non-compliance inadvertently.
What Not to Say
The way you speak to auditors can influence outcomes:
- Don’t guess or estimate: Avoid vague responses like “we run Java on maybe 100 machines” if unsure. Get accurate counts first.
- Don’t admit guilt: Phrases like “we knew our license lapsed but…” can be used against you. Instead, say you are reviewing records and will provide information.
- Don’t say, “Everyone has it anyway.” This dismissive attitude can annoy auditors. Focus on facts, not opinions.
- Avoid “it’s open source, so no license”: They will push back on this, as Oracle licensing is about their builds and support.
- Don’t ignore them: Failure to respond can lead to default assumptions of non-compliance.
In essence, provide your facts and buy time to find missing facts. If something is unknown, say “we will verify and follow up.”
Audit Survival Tips
- Document everything: Log all audit-related emails, call notes, and submitted data. This can protect you if disagreements arise.
- Prioritize requests: If they ask for a huge amount of data, focus on what’s contractually required (e.g., Java deployments, employee counts).
- Be consistent: Ensure all team members give the same answers. Discrepancies between teams can be problematic.
- Keep engagement: Showing cooperation can help negotiations. Share interim findings with Oracle to demonstrate effort.
- Leverage OpenJDK usage: If many of your Java instances have already been switched to free OpenJDK builds, highlight this fact. Oracle primarily audits the usage of its proprietary Java software.
- Professional help: If the audit is big, hire an Oracle licensing consultant. They understand counting rules and audit negotiation strategies.
Remember, an Oracle audit is not a lawsuit (usually), but a business discussion. The end result may be a renegotiation or a settlement purchase.
Example Scenario
A tech company received an email from Oracle stating that 300 servers had Oracle Java downloads. The CEO assumed it was a mistake and ignored it. Months later, a formal audit letter arrived with a demand for compliance.
The company scrambled to prove numbers by then, but the Oracle team had firm download logs. Ultimately, the company had to purchase a new subscription covering those 300 servers and pay the audit fees. Had they addressed the issue earlier with Oracle, they might have negotiated a smaller scope or alternative solutions.
Recommendations
- Respond promptly: Acknowledge Oracle’s communication and request any clarification on the scope.
- Form an audit team: Assign roles (SAM manager, technical point, legal advisor) to handle the audit.
- Gather evidence: Collect your Java inventory, purchase orders, and support contracts to show your current position.
- Negotiate timeline: Ask for reasonable deadlines. Use extra time to prepare precise information.
- Consult experts: If possible, bring in an Oracle licensing advisor experienced with Java audits.
- Leverage OpenJDK usage: If you have already moved many instances to OpenJDK, highlight that. Oracle is focused on its licensed Java usage.
- Review migration/renewal: Consider whether to renew or migrate. See our cost-benefit analysis for guidance.
See Also
- How to Prepare for an Oracle Java License Expiration
- 5 Challenges You’ll Face When Your Oracle Java Subscription Ends
- How to Migrate from Oracle Java to OpenJDK: A Practical Guide
- Should You Renew Your Oracle Java Agreement? A Cost-Benefit Analysis
