Spectrum OneClick Webswing Process Handler errors

Products

• Network Observability
• Spectrum

Issue/Introduction

Seeing the following errors in OneClick tomcat log ($SPECROOT/tomcat/logs/catalina.out or stdout.log on Windows): 

1. 2026-03-09 08:01:58,191 ERROR [Webswing Process Handler] (SwingProcessImpl.java:196) [oneclickwebapp_anonym_977171fc2b06_1773057718085] NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED --add-opens=java.base/javax.crypto=ALL-UNNAMED


2. 2026-03-09 22:41:13,739 ERROR [Webswing Process Handler] (SwingProcessImpl.java:196) [oneclickwebapp_anonym_1773110458996] Attempting to remove cryptography restrictions
   
   
3. 2026-03-09 22:41:13,739 ERROR [Webswing Process Handler] (SwingProcessImpl.java:196) [oneclickwebapp_anonym_1773110458996] Successfully removed cryptography restrictions

Environment

DX NetOps Spectrum all currently supported releases

Resolution

1. For the first "ERROR":
   
   2026-03-09 08:01:58,191 ERROR [Webswing Process Handler] (SwingProcessImpl.java:196) [oneclickwebapp_anonym_977171fc2b06_1773057718085] NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED --add-opens=java.base/javax.crypto=ALL-UNNAMED

The breakdown is:
   
   

   The "False" Error
   

   Despite being labeled as an ERROR by the Webswing Process Handler, the message itself is a standard JVM initialization note.
   

   • The Cause: The JDK_JAVA_OPTIONS environment variable is being set to allow the OneClick web application to access specific internal Java modules (using the --add-opens flags).

   • The "ERROR" Label: Webswing often redirects the "Standard Error" (stderr) stream from the Java process into its own log files. Since the JVM outputs the "Picked up JDK_JAVA_OPTIONS" message to the stderr stream by default, Webswing incorrectly flags it as an ERROR level event.

   What the Options Mean

   
   The flags you see (like --add-opens=java.base/java.lang=ALL-UNNAMED) are required for Java 9 and higher.  Modern Java has a strict module system. Applications like CA Spectrum OneClick, which rely on legacy Swing components and deep integration, need these "opens" to function correctly. Without them, the web-based OneClick console would likely fail to render or experience "InaccessibleObjectException" crashes.
   
   So WebTomcat is running fine with this not being an issue.
   
   
   
2. The second "ERROR":
   
   2026-03-09 22:41:13,739 ERROR [Webswing Process Handler] (SwingProcessImpl.java:196) [oneclickwebapp_anonym_1773110458996] Attempting to remove cryptography restrictions

describes a failed attempt to modify Java's security policy rather than a functional failure of your monitoring.  This log entry typically triggers when the Webswing component (which handles the browser-based delivery of the OneClick Java console) tries to programmatically lift the Java Cryptography Extension (JCE) Jurisdiction Policyrestrictions.
   
   Historically, Java limited the strength of cryptographic keys (e.g., AES-256) unless "Unlimited Strength" policy files were manually installed. Webswing tries to do this automatically to ensure it can handle secure connections.
   
   If your OneClick WebApp is loading correctly and you can see your device topology, you can safely ignore this log entry. It is a known artifact where the Webswing framework attempts a legacy configuration step that modern environments either don't allow or don't require.
   
   
   
3. For the last one:

2026-03-09 22:41:13,739 ERROR [Webswing Process Handler] (SwingProcessImpl.java:196) [oneclickwebapp_anonym_1773110458996] Successfully removed cryptography restrictions

Despite the log level being labeled as ERROR, the message itself says Successfully removed cryptography restrictions. This is essentially a "False Error" and is actually due to a coding oversight in the version of Webswing bundled with Spectrum. The developers directed this specific status confirmation to the System.errstream or labeled it at the ERROR log level instead of INFO.