Masking a JVM thread dump without breaking the analysis

Описание и применение

CLI‑утилита tm-anon маскирует JVM‑dump, заменяя пользовательские идентификаторы токенами, сохраняя структуру, необходимую для анализа, и позволяет безопасно загружать дампы в сторонние сервисы, при этом результаты анализа остаются неизменными.

Задача

Uploading production JVM thread dumps to third‑party analyzers violates policy, but the dumps contain sensitive identifiers that must be preserved for accurate analysis.

Результат

Masked dumps produce identical analysis results (same problems, severities, health score) as original dumps, while preventing accidental leakage of sensitive identifiers.

Рабочий процесс

• Create a vault with tm-anon init – generates a key and reverse map file.
• Run tm-anon mask <dump> – rewrites the dump, tokenizing user identifiers, stripping or redacting non‑essential lines, and verifies no sensitive data remains.
• Upload the resulting .anon.txt to the analyzer (e.g., ThreadMine).
• Download the analysis report and run tm-anon unmask <report> to restore original names locally for interpretation.

Доказательства

The rule "the contents of angle brackets are an address, keep them verbatim" was correct for every dump I'd looked at and was quietly handing over a class name on the newest JDK.

Источник

Same set of detected problems, same severities, same health score on every one.

Источник