Asymm Forensics

Asymm Forensics is a JVM diagnostic forensics platform built on JFR + JMC + Eclipse MAT foundations. It ingests JFR recordings, heap dumps, thread dumps, GC logs, and crash logs into a unified incident timeline, producing cross-correlation analysis and audit-ready compliance reports without sending data to a SaaS service.

Status: In active development. Phase 3 deliverable (target 2027).

What Asymm Forensics does

Existing JVM diagnostic tooling does single-artifact analysis well: JFR + JMC for event recordings, Eclipse MAT for heap dumps, fastthread.io for thread dumps. What's unbuilt is cross-correlation across all artifact types in the workflow regulated industries actually need.

Asymm Forensics ingests

• JFR recordings (continuous profiling data)
• Heap dumps (HPROF format)
• Thread dumps (jstack output)
• GC logs (unified logging format)
• Crash logs (hs_err_pid*.log)
• OS metrics (sar, vmstat, iostat output)

And produces

• Unified incident timeline correlating all artifact types
• ML-based pattern detection across thread dumps and heap dumps
• Compliance-ready audit reports (PCI DSS Section 10, HIPAA Technical Safeguards, SOX IT general controls)
• Dial-aware semantic analysis for Dial workflow incidents

Why local execution matters

Asymm Forensics runs entirely on your hardware. JFR recordings, heap dumps, thread dumps. None of it leaves your perimeter. That's by design.

Compliance-conscious teams in regulated industries cannot use SaaS-based diagnostic tools because:

• PCI DSS / HIPAA / SOX requirements often prohibit sending production data to third parties
• Data residency requirements (especially in EU, Middle East, Asia) require local processing
• Air-gapped or restricted-network environments cannot reach SaaS endpoints
• Customer data exposure risk is unacceptable even for diagnostic purposes

Asymm Forensics is designed for this audience. The optional SaaS hosted version (Phase 3E) exists for teams who can use it, but local execution is the default deployment model.

What Asymm Forensics is NOT

• It is not an APM tool (use Datadog, New Relic, Dynatrace for application performance monitoring)
• It is not a real-time observability platform (use Prometheus + Grafana, or your existing stack)
• It is not a log aggregator (use Elastic, Loki, or your existing stack)
• It is not a competitor to fastthread.io / gceasy.io / heaphero.io / yCrash on individual artifact analysis. Those tools work fine; Asymm Forensics adds cross-correlation across all of them

Asymm Forensics is post-incident forensics. When something failed and you need to understand why, across multiple diagnostic artifacts, with audit-ready reporting: that's what Asymm Forensics is for.

Built by OpenJDK contributors

Asymm Systems contributes to upstream OpenJDK, specifically to the JFR project (custom event types, scrub enhancements) and the OpenJDK CRaC Project. Asymm Forensics is not built parallel to OpenJDK tooling; it is built on top of it.

JMC Core libraries (UPL 1.0) are the analysis backbone. Eclipse MAT (EPL 2.0, bundled in Eliya Phase 2) is the heap analysis backbone. Asymm Forensics adds the cross-correlation engine, ML-based pattern detection, compliance reporting, and Dial-aware analysis layers on top of these foundations.

Roadmap

Full Phase 3 strategy, sub-phases, architectural options, and OpenJDK contribution thesis: Asymm Forensics strategy (public).

Get notified when Asymm Forensics is available

Asymm Forensics, the JVM diagnostic forensics platform built on JFR + JMC + Eclipse MAT, is in active development. Join the early access list to be notified at launch. We'll send quarterly progress updates covering JFR custom event contributions to OpenJDK, cross-correlation engine development, compliance reporting work, and Dial-aware analysis features.