需要在纯Java（ee，servlet和POJO）中创建方法拦截器以在weblogic中使用，该怎么做？

Question

I'm implementing an audit api to log any method invocation which has an @Auditable annotation in its declaration. The basic requirements are that it must be used by current applications and should be non-intrusive. I already have the auditing API by means of a Log4J2 wrapper, and also I successfully used it in some EJB Interceptors. However, I need to create an all-terrain interceptor I can use wherever the annotation is used, ie, I'd like to annotate servlets, EJBs and POJOs methods with it and let the interceptor work its magic.

I've tried Java EE Interceptors and they only work in EJB, I've tried GUICE but it doesn't work with servlet nor EJB methods, only guice injected POJOs.

I'd like to know, if somebody knows how, what should I use and I'll be gratefull if an example can be pointed at to.

Thank you very much.

Answer 1

One possible solution is using AspectJ. AspectJ can let you define what you want to intercept (the so called joinpoint) and execute the code you want (the so called advice) when it happens.

Joinpoints can be everything, but in your case you need to trap the execution of methods with a given annotation, so we will be using only the "execution" joinpoint.

AspectJ then needs to instrument your classes. This can be done :

1. Compiling your code with the AspectJ compiler, which extends the java compiler with what needed
2. "Weaving" existing jar files, so you can do it after the normal build process, or you can do it even on jar files you don't have the sources (which is not in this case, since you need to place the annotation anyway).

We will use the first method only to compile the aspect, and the second one to instrument the jar files or class folders you want.

To do it, you need to write an annotation, Auditable, that must have runtime retention.

Then you write an aspect :

public aspect Audit {  // An aspect then compiles as if it was a class (at runtime, it is a normal class)

  Object around() :  // This is an around advice
    execution(@Auditable * *(..)) // Here you're catching execution of any method of any class with any parameter and any return type, which is annotated with @Auditable
  {
    // Do what you want to do before the method
    long start = System.nanoTime();
    Logger.log("I'm entering into " + thisJoinPoint); // with thisJoinPoint you can extract a lot of informations, like what class, what method, what parameters, on which instance etc..
    try {
      Object ret = proceed(); // "proceed" goes on executing the method
      // You could log, or do whatever you want with the return value, which could be "Void".
      return ret;
    } finally {
      Logger.log("It took ns: " + (System.nanoTime() - start));
    }
  }

}

Once you wrote this aspect (usually in a package and with a ".aj" extension, but is not mandatory), you compile it with the AspectJ compiler.

ajc -outxml -classpath thisLib.jar:thatLib.jar -1.5 -outjar auditableAspect.jar package/of/your/AuditableAspect.aj 

This is similar to compiling java code with javac. On the classpath you need what is needed to compile the aspect, in this example i used a misterious Logger, which must be inside thisLis.jar or thatLib.jar.

At the end, you'll have an auditableAspect.jar file, that will contain the compiled class of you aspect.

Now, to use it, you need to "weave" the classes (or jar files) you want it to "intercept". To do this, still with the ajc command :

ajc -inpath myStuff.jar -outjar myStuffAudited.jar -aspectPath auditableAspect.jar

You'll then find in myStuffAudited.jar the same classes in myStuff.jar, and a few other synthetic inner anonymous classes.

Now basically you can remove from your application classpath (or WEB-INF/lib if it's a web application) the myStuff.jar, replace it with myStuffAudited.jar, and also add auditableAspect.jar which is your aspect and aspectjrt.jar which is AspectJ runtime.

Reload you application, and it will start logging.

You can do this on all the jars you want, or on all jars in a for loop; those unaffected will remain unaffected.

This can be integrated in a number of ways in your build cycle.

• Obviously, a .bat or .sh script can automate it
• Ant has tasks for aspectJ
• Maven has a plugin for aspectJ
• Eclipse has a plugin for compiling and weaving inside the ide

Don't know how you build your project, so YMMV.

Wether this is intrusive or not, it's an opinion; but to my knowledge there aren't a lot of packages out there that offer runtime auditing without somehow manipulating the class bytecode, if not using runtime proxies that are limited (as you have seen) to interfaces.

There is also an option to use a weaving classloader, that would remove totally the need to weave existing jars and classes, cause they would be weaved at load time by the classloader itself. It works great and i like it, but it depends on your runtime environment.