Welcome!

Java Authors: Jayaram Krishnaswamy, Elizabeth White, AppDynamics Blog, Michael Jannery, Liz McMillan

Related Topics: Java

Java: Article

Java Serialization

Lesson 7, Java Basics

In lessons 5 and 6 of this series, you've learned how to use some of the Java streams to read or write bytes, characters or numeric data. This lesson is about reading or writing entire Java objects into streams.

Let's say your application uses a class that looks like this:

class Employee {
 String lName;
 String fName;
 double salary;
 java.util.Date hireDate;
 String address;
}

Now consider the following scenario: a program HeadQuarterEmpProcessor creates an instance of the object Employee. The values of its attributes (object's state) have to be saved in a file or some other stream. Later on, another program called BranchEmpProcessor needs to recreate the instance of this object Employee in memory.

We could have done it by using one of the streams like DataOutputStream, FileWriter or others. In this case both programs would need to know a format of the saved file (data types, order of the attributes and delimiters). Luckily, Java offers a more elegant way called object serialization, which greatly simplifies the process of objects exchange.

To send the entire object to a stream a program can use the class java.io.ObjectOutputStream, while the class java.io.ObjectInputStream knows how to get an object from a stream. To serialize an object means to convert it into a set of bytes and send it to a stream. To deserialize and object means to read these bytes from a stream and recreate the instance of the received object.

How to Make a Class Serializable

To make a class serializable, just declare that this class implements the interface Serializable:

class Employee implements java.io.Serializable {
 String lName;
 String fName;
 double salary;
 java.util.Date hireDate;
 String address;
}

The good news is that Serializable interface does not force you to implement any methods, that's why modification of the class Employee was minimal.

All attributes of the class Employee must have either primitive data types, or represent objects that are also serializable.

How to Serialize an Object

To serialize an object into a stream perform the following actions:

  • Open one of the output streams, for example FileOutputStream
  • Chain it with the ObjectOutputStream
  • Call the method writeObject() providing the instance of a Serializable object as an argument.
  • Close the streams

    The following example performs all these steps and creates a snapshot of the object Employee in the file called NewEmployee.ser

    import java.io.*;
    import java.util.Date;
    
    public class HeadQuarterEmpProcessor {
    
     public static void main(String[] args) {
    	Employee emp = new Employee();
    	emp.lName = "John";
    	emp.fName = "Smith"; 
    	emp.salary = 50000;
          emp.address = "12 main street";
          emp.hireDate = new Date(); 
        
          FileOutputStream fOut=null;
          ObjectOutputStream oOut=null;
    	   
          try{
           fOut= new FileOutputStream("c:\\NewEmployee.ser");
    	 oOut = new ObjectOutputStream(fOut);
    	 oOut.writeObject(emp);  //serializing employee
    	 System.out.println(
            "An employee is serialized into c:\\NewEmployee.ser");
          }catch(IOException e){
    	  e.printStackTrace(); 
          }finally{
      	  try {
    	    oOut.flush();
    	    oOut.close();
    	    fOut.close();
    	  } catch (IOException e1) {
    	   e1.printStackTrace();
    	  }
    	}
        }
    }
    

    If you do not want to serialize sensitive information such as salary, declare this variable using the keyword transient:

    transient double salary;

    The values of static and transient member variables are not serialized.

    How to Deserialize an Object

    To deserialize an object, perform the following steps:

  • Open an input stream
  • Chain it with the ObjectInputStream
  • Call the method readObject() and cast the returned object to the class that is being deserialized.
  • Close the streams

    The next example reads our file NewEmployee.ser and recreates the instance of the object Employee:

    import java.io.*;
    
    public class BranchEmpProcessor {
    
      public static void main(String[] args) {
       FileInputStream fIn=null;
       ObjectInputStream oIn=null;
    	   
       try{
        fIn= new FileInputStream("c:\\NewEmployee.ser");
        oIn = new ObjectInputStream(fIn);
       
        //de-serializing employee
        Employee emp = (Employee) oIn.readObject();
    				 
        System.out.println("Deserialized " + emp.fName + " " 
                     + emp.lName + " from NewEmployee.ser ");
       }catch(IOException e){
    	  e.printStackTrace(); 
       }catch(ClassNotFoundException e){
            e.printStackTrace(); 
       }finally{
    	try {
            oIn.close();
    	  fIn.close();
    	} catch (IOException e1) {
    	  e1.printStackTrace();
    	}
       }
     }
    }
    

    The class BranchEmpProcessor will produce the following output:

    Deserialized Smith John from NewEmployee.ser

    Please note that we did not explicitly created an instance of the object Employee - JVM did it for us. Make sure that definition of the class Employee is available to JVM that reads the stream. In distributed applications it usually runs on a remote machine.

    During the process of deserialization all transient variables will be initialized with default values according to their type, for example, integer variables will have the value of zero.

    Interface Externalizable

    The method writeObject() sends all attributes of an object into a stream. This could lead to unnecessary large object footprint, especially if you need to serialize the values only of some of the instance variables. Java provides Externalizable interface that gives you more control over what is being serialized and it can produce smaller object footprint.

    Externalizable interface is a subclass of Serializable.

    This interface defines 2 methods: readExternal() and writeExternal() and you have to implement these methods in the class that will be serialized (Employee). In these methods you'll have to write code that reads/writes only the values of the attributes you are interested in. Programs that perform serialization and deserialization have to write and read these attributes in the same sequence.

    The following class Employee2 serializes only the values of the last name and salary.

    import java.io.ObjectOutput;
    import java.io.ObjectInput;
    class Employee2 implements Externalizable {
     String lName;
     String fName;
     double salary; 
     java.util.Date hireDate;
     String address;
     
      public void writeExternal(ObjectOutput stream)
      				 throws java.io.IOException {
      // Serializing only salary and last name  
       stream.writeDouble(salary); 
       stream.writeUTF(lName);  // String encoded in UTF-8 format
      }
    
     public void readExternal(ObjectInput stream)
     				 throws java.io.IOException {
          salary = stream.readDouble();  
    	  lName  = stream.readUTF();
     }
    
    }
    

    The class HeadQuaterEmpProcessor2 shows how to externalize the object Employee2:

    import java.io.*;
    import java.util.Date;
    
    public class HeadQuarterEmpProcessor2 {
    
    	public static void main(String[] args) {
    		Employee2 emp = new Employee2();
    		emp.fName = "John";
    		emp.lName = "Smith"; 
    		emp.salary = 50000;
    	    emp.address = "12 main street";
    	    emp.hireDate = new Date(); 
        
    	   FileOutputStream fOut=null;
    	   ObjectOutputStream oOut=null;
    	   
    	   try{
    	     fOut= new FileOutputStream("c:\\NewEmployee2.ser");
    	     oOut = new ObjectOutputStream(fOut);
    	     emp.writeExternal(oOut);  //serializing employee
    	     System.out.println(
                "An employee is serialized into c:\\NewEmployee2.ser");
    
    	   }catch(IOException e){
    	   	  e.printStackTrace(); 
    	   }finally{
    		try {
    			oOut.flush();
    			oOut.close();
    			fOut.close();
    		} catch (IOException e1) {
    			e1.printStackTrace();
    		}
    	   }
    	}
    }
    

    Unlike with Serializable interface, we had to write a little more code to implement Externalizable interface, but the size of the file NewEmployee2.ser is only 21 bytes, whereas the file NewEmployee.ser has 207 bytes. First of all, we serialized the values of only two attributes, and the other reason is that files created using Externalizable interface contain data only, while files created by default Java serialization contain class metadata that include attribute names.

    The next code snippet shows you how to recreate an externalized object:

    fIn= new FileInputStream("c:\\NewEmployee2.ser");
    oIn = new ObjectInputStream(fIn);
    
    Employee2 emp = new Employee2();
    emp.readExternal(oIn);
    

    Serialization in the Real World

    In some types of applications you have to write the code to serialize objects, but in many cases serialization is performed behind the scenes by various server-side containers. These are some of the typical uses of serialization:

  • To persist data for future use.
  • To send data to a remote computer using such client/server Java technologies as RMI or socket programming.
  • To "flatten" an object into array of bytes in memory.
  • To exchange data between applets and servlets.
  • To store user session in Web applications.
  • To activate/passivate enterprise java beans.
  • To send objects between the servers in a cluster.

    When you use serialization in time-critical applications, for example real-time stock trading systems, the size of the serialized objects should be minimal. Keep in mind that variables with longer names produce larger footprints during serialization, and this may substantially slow down your application. Think of a high volume of trade orders that is being serialized. I remember working on the application where a class TradeOrder had about a hundred member variables. After renaming the variables into meaningless v1, v2, and so on, the size of one TradeOrder instance was reduced by a thousand bytes. And we are talking about serializing of thousands orders over the network!

    If performance is your primary goal, use Externalizable interface instead of Serializable. Yes, you'll have to write code to serialize each attribute, but this may speed up serialization process substantially.

    While applets can connect to a remote computer using socket or RMI programming (these technologies will be explained in the future lessons of this series), HTTP protocol and such Java classes as URL and URLConnection simplify network programming. With an HTTP protocol, applets can receive or send not only a text, but also binary objects using Java Serialization.

    When an EJB container decides to passivate (unload from memory) so-called stateful session bean, JVM persists its state in a safe place (usually on a disk). Later on, when this bean will be activated again, all its variables will be automatically deserialized by the EJB container.

    While it may not be too difficult for JVM to convert a primitive integer variable into four bytes for serialization, it's not as simple in case of classes containing variables with references to other objects. The process of converting such complex object into a sequence of bytes is called marshalling and the process of reconstructing of the objects from these bytes is called unmarshalling and Java does this job for you.

    Even though we have not learned yet how to create Web applications, I still want to mention that objects used for tracking of the user sessions should be serializable, otherwise you may not be able to deploy these application in a cluster of servers.

    Java serialization is a simple but powerful feature of the language, and you definitely will have a chance to use it in your applications.

  • More Stories By Yakov Fain

    Yakov Fain is a co-founder of two software companies: Farata Systems and SuranceBay. He authored several technical books and lots of articles on software development. Yakov is Java Champion (https://java-champions.java.net). He leads leads Princeton Java Users Group. Two of Yakov's books will go in print this year: "Enterprise Web Development" (O'Reilly) and "Java For Kids" (No Starch Press).

    Comments (9) View Comments

    Share your thoughts on this story.

    Add your comment
    You must be signed in to add a comment. Sign-in | Register

    In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


    Most Recent Comments
    ndhai 06/17/08 09:17:58 AM EDT

    I have some pb with a test following:

    package com.lecam;

    import java.io.*;

    public class testFile implements java.io.Externalizable{

    byte one_byte = 1;
    int one_int = 1024;

    public testFile() {
    }

    public void writeExternal(ObjectOutput stream) throws java.io.IOException {
    stream.writeByte(one_byte);
    stream.writeInt(one_int);
    }

    public void readExternal(ObjectInput stream) throws java.io.IOException {
    one_byte = stream.readByte();
    one_int = stream.readInt();
    }

    public static void main(String args1[]) {
    System.out.print("Writing...");
    try {
    testFile SubFile = new testFile();
    FileOutputStream fos = new FileOutputStream("c:\\test.bin");
    ObjectOutputStream oos = new ObjectOutputStream(fos);
    SubFile.writeExternal(oos);
    oos.flush();
    oos.close();
    fos.close();
    } catch (java.io.IOException e) {
    e.printStackTrace();
    } catch(Exception e) {
    e.printStackTrace();
    }

    System.out.print("Reading...");
    try {
    FileInputStream fis = new FileInputStream("c:\\test.bin");
    ObjectInputStream ois = new ObjectInputStream(fis);
    testFile tFile = new testFile();
    tFile.readExternal(ois);
    System.out.println("SubFile : ");
    System.out.println("byte : "+(tFile.one_byte));
    System.out.println("int : "+ (tFile.one_int));
    ois.close();
    fis.close();
    } catch (java.io.IOException e) {
    e.printStackTrace();
    } catch(Exception e) {
    e.printStackTrace();
    }
    System.out.print("END...");
    }
    }

    question: the test.bin file should be 5 bytes (one byte + one int = 1 + 4 = 5 bytes)
    but it is 11 bytes! I don't know why!
    thanks

    Sreerag 08/07/07 01:47:30 PM EDT

    You have explained it in a simple, nice manner. Thanks a lot !

    Sreerag K M 08/07/07 01:45:49 PM EDT

    The presentation is so nice, simple. Thanks a lot

    Josh 04/14/04 05:25:12 PM EDT

    Ravi,

    If you serialize an externalizeable object, it''s readExternal or writeExternal methods will automatically get called. So, the scenario you mention should never happen. When you implement Externalizable, you take control of the serialization completely, so the transient modifier will not have an effect on fields in the Externalizable object.

    Ravi 04/14/04 03:19:03 PM EDT

    Excellent article. I had a concern with transient data serialization when we do a serialization with externalizable interface. I mean when I implement a class with externalizable and do a normal serialization without being used its readExternal or writeExternal calls, then the Transient data is still get serialized.
    Can anyone update me on this point?

    Josh 04/14/04 07:19:06 AM EDT

    Good article. As the previous comment indicates, using Java serialization can introduce some problems when the objects are read in by a different version of the software. I don''t recommend using Java serialization for ''durable'' persistence for this reason. Using Externalizable can help, but for complex applications this encourages the programmer to blend the persistence and other, unrelated aspects into the same object, which is not the best design. I would recommend delegating the Externalizable implementation into another object in this case.

    Mathieu 03/31/04 03:04:31 AM EST

    Very Good introductory material. However I would like to add a paragraph on class version management.
    Upon a change of the code of your class if you try to read an old serialized data, you may experience error. Externalize interface is for now the safe way to prevent yourself from that.

    java-user 03/29/04 11:15:31 AM EST

    Excellent article. Liked real-world experiences shared by author.

    andre 03/26/04 05:01:30 PM EST

    Awesome! Did not know about the alternative to Serializable which exposes your application.

    @ThingsExpo Stories
    The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
    Enthusiasm for the Internet of Things has reached an all-time high. In 2013 alone, venture capitalists spent more than $1 billion dollars investing in the IoT space. With "smart" appliances and devices, IoT covers wearable smart devices, cloud services to hardware companies. Nest, a Google company, detects temperatures inside homes and automatically adjusts it by tracking its user's habit. These technologies are quickly developing and with it come challenges such as bridging infrastructure gaps, abiding by privacy concerns and making the concept a reality. These challenges can't be addressed w...
    The Domain Name Service (DNS) is one of the most important components in networking infrastructure, enabling users and services to access applications by translating URLs (names) into IP addresses (numbers). Because every icon and URL and all embedded content on a website requires a DNS lookup loading complex sites necessitates hundreds of DNS queries. In addition, as more internet-enabled ‘Things' get connected, people will rely on DNS to name and find their fridges, toasters and toilets. According to a recent IDG Research Services Survey this rate of traffic will only grow. What's driving t...
    The Internet of Things is a misnomer. That implies that everything is on the Internet, and that simply should not be - especially for things that are blurring the line between medical devices that stimulate like a pacemaker and quantified self-sensors like a pedometer or pulse tracker. The mesh of things that we manage must be segmented into zones of trust for sensing data, transmitting data, receiving command and control administrative changes, and peer-to-peer mesh messaging. In his session at @ThingsExpo, Ryan Bagnulo, Solution Architect / Software Engineer at SOA Software, focused on desi...
    Today’s enterprise is being driven by disruptive competitive and human capital requirements to provide enterprise application access through not only desktops, but also mobile devices. To retrofit existing programs across all these devices using traditional programming methods is very costly and time consuming – often prohibitively so. In his session at @ThingsExpo, Jesse Shiah, CEO, President, and Co-Founder of AgilePoint Inc., discussed how you can create applications that run on all mobile devices as well as laptops and desktops using a visual drag-and-drop application – and eForms-buildi...
    The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
    "For over 25 years we have been working with a lot of enterprise customers and we have seen how companies create applications. And now that we have moved to cloud computing, mobile, social and the Internet of Things, we see that the market needs a new way of creating applications," stated Jesse Shiah, CEO, President and Co-Founder of AgilePoint Inc., in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
    Things are being built upon cloud foundations to transform organizations. This CEO Power Panel at 15th Cloud Expo, moderated by Roger Strukhoff, Cloud Expo and @ThingsExpo conference chair, addressed the big issues involving these technologies and, more important, the results they will achieve. Rodney Rogers, chairman and CEO of Virtustream; Brendan O'Brien, co-founder of Aria Systems, Bart Copeland, president and CEO of ActiveState Software; Jim Cowie, chief scientist at Dyn; Dave Wagstaff, VP and chief architect at BSQUARE Corporation; Seth Proctor, CTO of NuoDB, Inc.; and Andris Gailitis, C...
    The Industrial Internet revolution is now underway, enabled by connected machines and billions of devices that communicate and collaborate. The massive amounts of Big Data requiring real-time analysis is flooding legacy IT systems and giving way to cloud environments that can handle the unpredictable workloads. Yet many barriers remain until we can fully realize the opportunities and benefits from the convergence of machines and devices with Big Data and the cloud, including interoperability, data security and privacy.
    Since 2008 and for the first time in history, more than half of humans live in urban areas, urging cities to become “smart.” Today, cities can leverage the wide availability of smartphones combined with new technologies such as Beacons or NFC to connect their urban furniture and environment to create citizen-first services that improve transportation, way-finding and information delivery. In her session at @ThingsExpo, Laetitia Gazel-Anthoine, CEO of Connecthings, will focus on successful use cases.
    The industrial software market has treated data with the mentality of “collect everything now, worry about how to use it later.” We now find ourselves buried in data, with the pervasive connectivity of the (Industrial) Internet of Things only piling on more numbers. There’s too much data and not enough information. In his session at @ThingsExpo, Bob Gates, Global Marketing Director, GE’s Intelligent Platforms business, to discuss how realizing the power of IoT, software developers are now focused on understanding how industrial data can create intelligence for industrial operations. Imagine ...
    The Internet of Things is tied together with a thin strand that is known as time. Coincidentally, at the core of nearly all data analytics is a timestamp. When working with time series data there are a few core principles that everyone should consider, especially across datasets where time is the common boundary. In his session at Internet of @ThingsExpo, Jim Scott, Director of Enterprise Strategy & Architecture at MapR Technologies, discussed single-value, geo-spatial, and log time series data. By focusing on enterprise applications and the data center, he will use OpenTSDB as an example t...
    Cultural, regulatory, environmental, political and economic (CREPE) conditions over the past decade are creating cross-industry solution spaces that require processes and technologies from both the Internet of Things (IoT), and Data Management and Analytics (DMA). These solution spaces are evolving into Sensor Analytics Ecosystems (SAE) that represent significant new opportunities for organizations of all types. Public Utilities throughout the world, providing electricity, natural gas and water, are pursuing SmartGrid initiatives that represent one of the more mature examples of SAE. We have s...
    SYS-CON Media announced that Splunk, a provider of the leading software platform for real-time Operational Intelligence, has launched an ad campaign on Big Data Journal. Splunk software and cloud services enable organizations to search, monitor, analyze and visualize machine-generated big data coming from websites, applications, servers, networks, sensors and mobile devices. The ads focus on delivering ROI - how improved uptime delivered $6M in annual ROI, improving customer operations by mining large volumes of unstructured data, and how data tracking delivers uptime when it matters most.
    The true value of the Internet of Things (IoT) lies not just in the data, but through the services that protect the data, perform the analysis and present findings in a usable way. With many IoT elements rooted in traditional IT components, Big Data and IoT isn’t just a play for enterprise. In fact, the IoT presents SMBs with the prospect of launching entirely new activities and exploring innovative areas. CompTIA research identifies several areas where IoT is expected to have the greatest impact.
    There is no doubt that Big Data is here and getting bigger every day. Building a Big Data infrastructure today is no easy task. There are an enormous number of choices for database engines and technologies. To make things even more challenging, requirements are getting more sophisticated, and the standard paradigm of supporting historical analytics queries is often just one facet of what is needed. As Big Data growth continues, organizations are demanding real-time access to data, allowing immediate and actionable interpretation of events as they happen. Another aspect concerns how to deliver ...
    The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
    Scott Jenson leads a project called The Physical Web within the Chrome team at Google. Project members are working to take the scalability and openness of the web and use it to talk to the exponentially exploding range of smart devices. Nearly every company today working on the IoT comes up with the same basic solution: use my server and you'll be fine. But if we really believe there will be trillions of these devices, that just can't scale. We need a system that is open a scalable and by using the URL as a basic building block, we open this up and get the same resilience that the web enjoys.
    In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect at GE, and Ibrahim Gokcen, who leads GE's advanced IoT analytics, focused on the Internet of Things / Industrial Internet and how to make it operational for business end-users. Learn about the challenges posed by machine and sensor data and how to marry it with enterprise data. They also discussed the tips and tricks to provide the Industrial Internet as an end-user consumable service using Big Data Analytics and Industrial Cloud.
    How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happens, where data lives and where the interface lies. For instance, it's a mix of architectural styles ...