jvmguard captures deep JVM profiles only when something warrants it, and only with authorization and an audit trail. Here is how that differs from the tools you may already run.
§ 01Adjacent approaches
APM suites
Datadog, Dynatrace, New Relic, and similar platforms
APMs instrument your frameworks and measure spans continuously. jvmguard records only the transactions you define.
APMs gather application and end-user data and send it to a cloud backend. jvmguard stays inside your network.
jvmguard is a complement, not a replacement. APMs give you breadth and alerting, jvmguard gives you deep, targeted captures.
Continuous profilers
Grafana Pyroscope, Parca and Polar Signals, Elastic Universal Profiling
Continuous profilers sample broadly and never stop. jvmguard captures a deep artifact, a heap dump or a JFR recording, from the one JVM that needs it, only when warranted.
A continuous profiler pays a small constant overhead on every JVM, always. jvmguard pays that cost only during a capture.
Plain JFR and jcmd
Built into the JDK. JFR recordings, jcmd operations, and JDK Mission Control for analysis.
Without jvmguard, getting a heap dump means SSH access to the production host, running jcmd by hand, and transferring the file. In most organizations, developers do not have that access.
jvmguard replaces the SSH workflow with authorized access. A profiler-role user starts a capture from the UI or through a coding agent, and the audit log records who ran it, when, and against which JVM.
jcmd captures whatever you run at that moment. jvmguard can also fire the capture automatically the instant a threshold is crossed, with no one watching.
One trigger fires across all matching JVMs in the fleet, not one-by-one over individual JVMs.
§ 02What jvmguard is not
jvmguard is not an APM. There is no continuous tracing, no distributed trace export, and no metrics pipeline, and it does not auto-instrument your frameworks. It records only the lightweight telemetries and the transactions you define, so the always-on overhead stays minimal. Deep captures are intentional and scoped, and they stay on your infrastructure. No user data is exported to a remote backend.
§ 03Where jvmguard fits
A developer gets a deep capture from a production JVM through authorized, audited access, without an SSH session on the host.
An AI agent operates on production JVMs within scope and rate limits, and every operation is written to a SIEM-compatible audit log.
Lightweight always-on monitoring triggers a capture automatically when a threshold is crossed.