accumulo-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ctubb...@apache.org
Subject [accumulo] branch master updated: Fix #633 use annotations for spotbugs (#687)
Date Wed, 10 Oct 2018 05:25:40 GMT
This is an automated email from the ASF dual-hosted git repository.

ctubbsii pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/accumulo.git


The following commit(s) were added to refs/heads/master by this push:
     new 11e26d4  Fix #633 use annotations for spotbugs (#687)
11e26d4 is described below

commit 11e26d481b7885e46ce439e1345f0bf9bdd5dfb2
Author: Christopher Tubbs <ctubbsii@apache.org>
AuthorDate: Wed Oct 10 01:25:35 2018 -0400

    Fix #633 use annotations for spotbugs (#687)
    
    Triage all spotbugs excludes from the exclude-filter.xml files and
    either implement a fix or document a justification with annotations.
    
    Also add travis-ci task to build with the sec-bugs profile to check for
    future security-related issues found by spotbugs.
---
 .travis.yml                                        |   1 +
 .../core/client/mapred/RangeInputSplit.java        |   4 +
 .../core/client/mapred/impl/BatchInputSplit.java   |   4 +
 .../mapreduce/lib/partition/RangePartitioner.java  |   4 +
 .../mapreduce/src/main/spotbugs/exclude-filter.xml |  35 ---
 .../accumulo/core/bloomfilter/BloomFilter.java     |   5 +
 .../org/apache/accumulo/core/cli/ClientOpts.java   |   4 +
 .../org/apache/accumulo/core/cli/ConfigOpts.java   |   4 +
 .../accumulo/core/client/ClientConfiguration.java  |   6 +
 .../accumulo/core/client/ZooKeeperInstance.java    |   2 +-
 .../core/client/impl/AccumuloClientImpl.java       |   4 +
 .../accumulo/core/client/impl/ClientContext.java   |   2 +-
 .../accumulo/core/client/impl/ServerClient.java    |   2 +-
 .../core/client/impl/TabletLocatorImpl.java        |   4 +
 .../core/client/sample/AbstractHashSampler.java    |   5 +-
 .../apache/accumulo/core/conf/ClientProperty.java  |   4 +
 .../org/apache/accumulo/core/conf/Property.java    |   4 +
 .../accumulo/core/conf/SiteConfiguration.java      |   4 +
 .../org/apache/accumulo/core/data/LoadPlan.java    |   4 +
 .../file/blockfile/cache/lru/LruBlockCache.java    |   6 +
 .../impl/SeekableByteArrayInputStream.java         |   4 +
 .../apache/accumulo/core/file/rfile/PrintInfo.java |   6 +-
 .../accumulo/core/iterators/GrepIterator.java      |  27 --
 .../core/iterators/IntersectingIterator.java       |  29 ---
 .../accumulo/core/iterators/LargeRowFilter.java    |  27 --
 .../core/iterators/RowDeletingIterator.java        |  29 ---
 .../core/iterators/VersioningIterator.java         |  37 ---
 .../accumulo/core/iterators/WholeRowIterator.java  |  28 --
 .../accumulo/core/rpc/SslConnectionParams.java     |   4 +
 .../org/apache/accumulo/core/rpc/ThriftUtil.java   |   4 +
 .../security/crypto/impl/AESCryptoService.java     |   4 +
 .../core/security/crypto/impl/AESKeyUtils.java     |   7 +
 .../accumulo/core/trace/ProbabilitySampler.java    |  31 ---
 .../{CountSampler.java => TraceSamplers.java}      |  18 +-
 .../org/apache/accumulo/core/util/AddressUtil.java |  51 +++-
 .../apache/accumulo/core/zookeeper/ZooUtil.java    |  85 -------
 .../java/org/apache/accumulo/fate/AdminUtil.java   |   5 +
 .../java/org/apache/accumulo/fate/ZooStore.java    |   5 +
 .../org/apache/accumulo/fate/util/AddressUtil.java |  69 -----
 .../fate/zookeeper/TransactionWatcher.java         |  76 ------
 .../apache/accumulo/fate/zookeeper/ZooCache.java   |   4 +
 .../apache/accumulo/fate/zookeeper/ZooLock.java    |   4 +
 .../accumulo/fate/zookeeper/ZooQueueLock.java      |   2 +-
 .../accumulo/fate/zookeeper/ZooReaderWriter.java   |  16 ++
 .../apache/accumulo/fate/zookeeper/ZooSession.java |   2 +-
 .../apache/accumulo/fate/zookeeper/ZooUtil.java    |  59 +++++
 core/src/main/spotbugs/exclude-filter.xml          | 181 +------------
 .../core/client/impl/ClientContextTest.java        |   4 +
 .../accumulo/core/client/rfile/RFileTest.java      |   3 +
 .../tokens/CredentialProviderTokenTest.java        |   4 +
 .../conf/CredentialProviderFactoryShimTest.java    |   3 +
 .../accumulo/core/conf/SiteConfigurationTest.java  |   4 +
 .../core/file/BloomFilterLayerLookupTest.java      |   4 +
 .../core/file/rfile/MultiThreadedRFileTest.java    |   4 +
 .../accumulo/core/security/crypto/CryptoTest.java  |  30 ++-
 .../{fate => core}/util/AddressUtilTest.java       |   2 +-
 .../accumulo/cluster/RemoteShellOptions.java       |   4 +
 .../standalone/StandaloneAccumuloCluster.java      |   6 +
 .../standalone/StandaloneClusterControl.java       |   8 +
 .../accumulo/minicluster/MiniAccumuloRunner.java   |   7 +
 .../impl/MiniAccumuloClusterControl.java           |   4 +
 .../minicluster/impl/MiniAccumuloClusterImpl.java  |  12 +-
 minicluster/src/main/spotbugs/exclude-filter.xml   |  62 -----
 .../MiniAccumuloClusterExistingZooKeepersTest.java |   3 +
 .../MiniAccumuloClusterStartStopTest.java          |   3 +
 pom.xml                                            |  17 +-
 .../main/java/org/apache/accumulo/proxy/Proxy.java |   6 +
 proxy/src/main/spotbugs/exclude-filter.xml         |  14 +-
 server/base/pom.xml                                |   4 -
 .../apache/accumulo/server/ServerConstants.java    |   2 +-
 .../org/apache/accumulo/server/ServerContext.java  |   2 +-
 .../org/apache/accumulo/server/ServerInfo.java     |   5 +-
 .../accumulo/server/cli/ClientOnDefaultTable.java  |  43 ----
 ...edTable.java => ServerUtilOnRequiredTable.java} |   3 +-
 .../cli/{ClientOpts.java => ServerUtilOpts.java}   |   3 +-
 .../accumulo/server/conf/ZooConfiguration.java     |   2 +-
 .../server/constraints/MetadataConstraints.java    |  10 +-
 .../accumulo/server/fs/RandomVolumeChooser.java    |   2 +-
 .../server/fs/SpaceAwareVolumeChooser.java         |  14 +-
 .../org/apache/accumulo/server/fs/VolumeUtil.java  |   2 +-
 .../apache/accumulo/server/init/Initialize.java    |   6 +-
 .../server/iterators/MetadataBulkLoadFilter.java   |   2 +-
 .../accumulo/server/log/WalStateManager.java       |   2 +-
 .../accumulo/server/master/LiveTServerSet.java     |   4 +-
 .../server/master/state/DeadServerList.java        |   2 +-
 .../accumulo/server/master/state/ZooStore.java     |   4 +-
 .../server/metrics/AbstractMetricsImpl.java        |   4 +
 .../apache/accumulo/server/monitor/LogService.java |  11 +-
 .../accumulo/server/problems/ProblemReport.java    |   2 +-
 .../server/replication/ReplicationUtil.java        |   4 +-
 .../replication/ZooKeeperInitialization.java       |   2 +-
 .../server/replication/proto/Replication.java      |   4 +-
 .../server/security/SecurityOperation.java         |   4 +-
 .../ZooAuthenticationKeyDistributor.java           |   2 +-
 .../security/handler/KerberosAuthenticator.java    |   4 +-
 .../server/security/handler/ZKAuthenticator.java   |   4 +-
 .../server/security/handler/ZKAuthorizor.java      |   6 +-
 .../server/security/handler/ZKPermHandler.java     |   6 +-
 .../accumulo/server/tables/TableManager.java       |   6 +-
 .../server/tablets/UniqueNameAllocator.java        |   4 +-
 .../org/apache/accumulo/server/util/Admin.java     |  15 +-
 .../apache/accumulo/server/util/ChangeSecret.java  |   6 +-
 .../server/util/CheckForMetadataProblems.java      |   8 +-
 .../apache/accumulo/server/util/ConvertConfig.java |   4 +
 .../accumulo/server/util/DeleteZooInstance.java    |   2 +-
 .../apache/accumulo/server/util/DumpZookeeper.java |   2 +-
 .../accumulo/server/util/FileSystemMonitor.java    |   4 +
 .../accumulo/server/util/FindOfflineTablets.java   |   4 +-
 .../apache/accumulo/server/util/ListInstances.java |   2 +-
 .../apache/accumulo/server/util/LocalityCheck.java |   4 +-
 .../accumulo/server/util/MasterMetadataUtil.java   |   2 +-
 .../accumulo/server/util/MetadataTableUtil.java    |   2 +-
 .../org/apache/accumulo/server/util/PortUtils.java |   4 +
 .../apache/accumulo/server/util/RandomWriter.java  |   3 +-
 .../accumulo/server/util/RandomizeVolumes.java     |   4 +-
 .../server/util/RemoveEntriesForMissingFiles.java  |   4 +-
 .../accumulo/server/util/RestoreZookeeper.java     |   6 +-
 .../accumulo/server/util/SendLogToChainsaw.java    | 281 ---------------------
 .../accumulo/server/util/TableDiskUsage.java       |   4 +-
 .../apache/accumulo/server/util/TablePropUtil.java |   2 +-
 .../accumulo/server/util/TabletServerLocks.java    |   4 +-
 .../server/util/VerifyTabletAssignments.java       |   4 +-
 .../org/apache/accumulo/server/util/ZooZap.java    |   6 +-
 .../server/zookeeper/DistributedWorkQueue.java     |   1 +
 .../server/zookeeper/TransactionWatcher.java       |  61 ++++-
 .../apache/accumulo/server/zookeeper/ZooCache.java |  35 ---
 .../apache/accumulo/server/zookeeper/ZooLock.java  |  24 --
 .../accumulo/server/zookeeper/ZooQueueLock.java    |  59 -----
 .../accumulo/server/zookeeper/ZooReaderWriter.java |  37 ---
 server/base/src/main/spotbugs/exclude-filter.xml   |  68 -----
 .../server/conf/NamespaceConfigurationTest.java    |   2 +-
 .../server/conf/TableConfigurationTest.java        |   2 +-
 .../constraints/MetadataConstraintsTest.java       |   2 +-
 .../accumulo/server/init/InitializeTest.java       |   2 +-
 .../iterators/MetadataBulkLoadFilterTest.java      |   2 +-
 .../server/problems/ProblemReportTest.java         |   4 +-
 .../server/replication/ReplicationUtilTest.java    |   2 +-
 .../replication/ZooKeeperInitializationTest.java   |   2 +-
 .../server/security/SystemCredentialsTest.java     |   3 +
 .../ZooAuthenticationKeyDistributorTest.java       |   2 +-
 .../accumulo/server/util/TServerUtilsTest.java     |   6 +
 .../server}/zookeeper/TransactionWatcherTest.java  |   2 +-
 server/gc/pom.xml                                  |   4 +
 .../apache/accumulo/gc/SimpleGarbageCollector.java |  12 +-
 server/gc/src/main/spotbugs/exclude-filter.xml     |  23 --
 .../java/org/apache/accumulo/master/Master.java    |  13 +-
 .../org/apache/accumulo/master/MasterTime.java     |   2 +-
 .../accumulo/master/recovery/RecoveryManager.java  |   4 +-
 .../DistributedWorkQueueWorkAssigner.java          |   4 +-
 .../master/replication/ReplicationDriver.java      |   7 +-
 .../master/replication/SequentialWorkAssigner.java |   2 +-
 .../master/replication/UnorderedWorkAssigner.java  |   2 +-
 .../apache/accumulo/master/state/MergeStats.java   |   8 +-
 .../org/apache/accumulo/master/tableOps/Utils.java |   4 +-
 .../master/tableOps/create/PopulateMetadata.java   |   2 +-
 .../master/tableOps/tableImport/ImportTable.java   |   4 +
 .../master/tserverOps/ShutdownTServer.java         |   4 +-
 server/master/src/main/spotbugs/exclude-filter.xml |  43 ----
 .../replication/SequentialWorkAssignerTest.java    |   4 +-
 .../replication/UnorderedWorkAssignerTest.java     |   2 +-
 .../java/org/apache/accumulo/monitor/Monitor.java  |   4 +-
 .../apache/accumulo/tracer/SendSpansViaThrift.java |   4 +
 server/tracer/src/main/spotbugs/exclude-filter.xml |  17 +-
 .../org/apache/accumulo/tracer/TracerTest.java     |   4 +
 .../org/apache/accumulo/tserver/NativeMap.java     |   3 +
 .../org/apache/accumulo/tserver/TabletServer.java  |  10 +-
 .../tserver/TabletServerResourceManager.java       |   4 +
 .../tserver/replication/AccumuloReplicaSystem.java |   8 +-
 .../tserver/tablet/MinorCompactionTask.java        |   5 +-
 .../org/apache/accumulo/tserver/tablet/Tablet.java |   9 +-
 .../tserver/src/main/spotbugs/exclude-filter.xml   |  46 ----
 .../tserver/log/TestUpgradePathForWALogs.java      |   4 +
 .../main/java/org/apache/accumulo/shell/Shell.java |   4 +
 .../org/apache/accumulo/shell/ShellOptionsJC.java  |   6 +
 .../java/org/apache/accumulo/shell/ShellUtil.java  |   4 +
 .../accumulo/shell/commands/ExecfileCommand.java   |   4 +
 .../accumulo/shell/commands/ScriptCommand.java     |   4 +
 shell/src/main/spotbugs/exclude-filter.xml         |  49 ----
 .../start/classloader/AccumuloClassLoader.java     |   4 +
 .../classloader/vfs/AccumuloVFSClassLoader.java    |   4 +
 .../classloader/vfs/UniqueFileReplicator.java      |   4 +
 start/src/main/spotbugs/exclude-filter.xml         |  36 ---
 .../apache/accumulo/harness/AccumuloITBase.java    |   4 +
 .../accumulo/harness/MiniClusterHarness.java       |   3 +
 .../org/apache/accumulo/harness/TestingKdc.java    |   4 +
 .../conf/AccumuloClusterPropertyConfiguration.java |   4 +
 .../StandaloneAccumuloClusterConfiguration.java    |   4 +
 .../org/apache/accumulo/test/AuditMessageIT.java   |   3 +
 .../accumulo/test/BadDeleteMarkersCreatedIT.java   |   2 +-
 .../apache/accumulo/test/GetFileInfoBulkIT.java    |  13 +-
 .../java/org/apache/accumulo/test/ListTables.java  |   4 +-
 .../apache/accumulo/test/QueryMetadataTable.java   |   4 +-
 .../org/apache/accumulo/test/ShellServerIT.java    |   7 +
 .../org/apache/accumulo/test/TestBinaryRows.java   |   4 +-
 .../java/org/apache/accumulo/test/TestIngest.java  |   4 +
 .../ThriftServerBindsBeforeZooKeeperLockIT.java    |   6 +
 .../apache/accumulo/test/TransportCachingIT.java   |   2 +-
 .../java/org/apache/accumulo/test/UnusedWALIT.java |   2 +-
 .../accumulo/test/UserCompactionStrategyIT.java    |   3 +
 .../org/apache/accumulo/test/VerifyIngest.java     |   4 +
 .../java/org/apache/accumulo/test/VolumeIT.java    |   5 +-
 .../accumulo/test/functional/BulkLoadIT.java       |   4 +
 .../accumulo/test/functional/CacheTestClean.java   |   5 +-
 .../accumulo/test/functional/CacheTestReader.java  |   4 +
 .../accumulo/test/functional/CacheTestWriter.java  |   6 +-
 .../test/functional/ConfigurableCompactionIT.java  |   3 +
 .../test/functional/ConfigurableMacBase.java       |   4 +
 .../test/functional/CreateInitialSplitsIT.java     |   4 +
 .../test/functional/FunctionalTestUtils.java       |   3 +
 .../test/functional/GarbageCollectorIT.java        |   4 +-
 .../test/functional/HalfDeadTServerIT.java         |   4 +
 .../accumulo/test/functional/KerberosIT.java       |   6 +
 .../accumulo/test/functional/KerberosProxyIT.java  |   4 +
 .../accumulo/test/functional/LargeRowIT.java       |   8 +
 .../accumulo/test/functional/MapReduceIT.java      |   3 +
 .../apache/accumulo/test/functional/MaxOpenIT.java |   4 +
 .../accumulo/test/functional/MonitorSslIT.java     |   8 +-
 .../accumulo/test/functional/ReadWriteIT.java      |  11 +-
 .../apache/accumulo/test/functional/RestartIT.java |   2 +-
 .../accumulo/test/functional/SplitRecoveryIT.java  |  10 +-
 .../test/functional/TableChangeStateIT.java        |   2 +-
 .../functional/TabletStateChangeIteratorIT.java    |   4 +-
 .../test/functional/WatchTheWatchCountIT.java      |   4 +
 .../accumulo/test/functional/ZombieTServer.java    |  11 +-
 .../accumulo/test/functional/ZooCacheIT.java       |   3 +
 .../apache/accumulo/test/mapred/TokenFileIT.java   |   3 +
 .../accumulo/test/mapreduce/TokenFileIT.java       |   3 +
 .../test/performance/ContinuousIngest.java         |   4 +-
 .../test/performance/scan/CollectTabletStats.java  |   7 +-
 .../accumulo/test/proxy/ProxyDurabilityIT.java     |   3 +
 .../accumulo/test/proxy/TestProxyClient.java       |   3 +
 .../test/replication/CyclicReplicationIT.java      |   3 +
 .../replication/MultiTserverReplicationIT.java     |   2 +-
 .../accumulo/test/replication/ReplicationIT.java   |   2 +-
 .../test/replication/SequentialWorkAssignerIT.java |   2 +-
 .../test/replication/UnorderedWorkAssignerIT.java  |   2 +-
 .../org/apache/accumulo/test/util/CertUtils.java   |   6 +
 .../accumulo/test/util/SerializationUtil.java      |   3 +
 .../test/util/memory/MemoryUsageCheck.java         |   3 +
 .../accumulo/test/util/tablet/WrongTablet.java     |   4 +-
 test/src/main/spotbugs/exclude-filter.xml          |  43 +---
 .../security/KerberosTokenEmbeddedKDCTest.java     |   4 +
 .../apache/accumulo/test/util/CertUtilsTest.java   |   5 +
 243 files changed, 943 insertions(+), 1737 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 42c2ab0..f0a7c97 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -27,6 +27,7 @@ before_script:
   - unset _JAVA_OPTIONS
 env:
   - BUILD_ARGS="clean verify javadoc:jar -DskipITs"  # main build of unit tests and javadoc
+  - BUILD_ARGS="clean verify -PskipQA,sec-bugs -Dspotbugs.skip=false"  # check for spotbugs+security
   - BUILD_ARGS="clean compile -Dhadoop.version=3.0.3 -Dzookeeper.version=3.4.12"  # quick compile to verify older API
 script:
   - mvn $BUILD_ARGS
diff --git a/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapred/RangeInputSplit.java b/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapred/RangeInputSplit.java
index fef4b54..256ef07 100644
--- a/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapred/RangeInputSplit.java
+++ b/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapred/RangeInputSplit.java
@@ -21,9 +21,13 @@ import java.io.IOException;
 import org.apache.accumulo.core.data.Range;
 import org.apache.hadoop.mapred.InputSplit;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * The Class RangeInputSplit. Encapsulates an Accumulo range for use in Map Reduce jobs.
  */
+@SuppressFBWarnings(value = "NM_SAME_SIMPLE_NAME_AS_SUPERCLASS",
+    justification = "Intended to share code between mapred and mapreduce")
 public class RangeInputSplit extends org.apache.accumulo.core.client.mapreduce.RangeInputSplit
     implements InputSplit {
 
diff --git a/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapred/impl/BatchInputSplit.java b/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapred/impl/BatchInputSplit.java
index f583418..f29d9e5 100644
--- a/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapred/impl/BatchInputSplit.java
+++ b/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapred/impl/BatchInputSplit.java
@@ -23,10 +23,14 @@ import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.data.Range;
 import org.apache.hadoop.mapred.InputSplit;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * The Class BatchInputSplit. Encapsulates Accumulo ranges for use in Map Reduce jobs. Can contain
  * several Ranges per InputSplit.
  */
+@SuppressFBWarnings(value = "NM_SAME_SIMPLE_NAME_AS_SUPERCLASS",
+    justification = "Intended to share code between mapred and mapreduce")
 public class BatchInputSplit extends org.apache.accumulo.core.client.mapreduce.impl.BatchInputSplit
     implements InputSplit {
 
diff --git a/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapreduce/lib/partition/RangePartitioner.java b/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapreduce/lib/partition/RangePartitioner.java
index 1019e1f..f0cdc68 100644
--- a/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapreduce/lib/partition/RangePartitioner.java
+++ b/client/mapreduce/src/main/java/org/apache/accumulo/core/client/mapreduce/lib/partition/RangePartitioner.java
@@ -38,6 +38,8 @@ import org.apache.hadoop.io.Writable;
 import org.apache.hadoop.mapreduce.Job;
 import org.apache.hadoop.mapreduce.Partitioner;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Hadoop partitioner that uses ranges, and optionally sub-bins based on hashing.
  */
@@ -81,6 +83,8 @@ public class RangePartitioner extends Partitioner<Text,Writable> implements Conf
 
   private Text cutPointArray[] = null;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "path provided by distributed cache framework, not user input")
   private synchronized Text[] getCutPoints() throws IOException {
     if (cutPointArray == null) {
       String cutFileName = conf.get(CUTFILE_KEY);
diff --git a/client/mapreduce/src/main/spotbugs/exclude-filter.xml b/client/mapreduce/src/main/spotbugs/exclude-filter.xml
deleted file mode 100644
index 24ce679..0000000
--- a/client/mapreduce/src/main/spotbugs/exclude-filter.xml
+++ /dev/null
@@ -1,35 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<FindBugsFilter>
-  <Match>
-    <!-- ignore intentional name shadowing -->
-    <Or>
-      <Class name="org.apache.accumulo.core.client.mapred.RangeInputSplit" />
-      <Class name="org.apache.accumulo.core.client.mapred.impl.BatchInputSplit" />
-    </Or>
-    <Or>
-      <Bug code="NM" pattern="NM_SAME_SIMPLE_NAME_AS_SUPERCLASS" />
-      <Bug code="NM" pattern="NM_SAME_SIMPLE_NAME_AS_INTERFACE" />
-    </Or>
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.client.mapreduce.lib.partition.RangePartitioner" />
-    <Method name="getCutPoints" />
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-</FindBugsFilter>
diff --git a/core/src/main/java/org/apache/accumulo/core/bloomfilter/BloomFilter.java b/core/src/main/java/org/apache/accumulo/core/bloomfilter/BloomFilter.java
index 50f035e..3377c3e 100644
--- a/core/src/main/java/org/apache/accumulo/core/bloomfilter/BloomFilter.java
+++ b/core/src/main/java/org/apache/accumulo/core/bloomfilter/BloomFilter.java
@@ -63,6 +63,8 @@ import org.apache.hadoop.util.bloom.Key;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Implements a <i>Bloom filter</i>, as defined by Bloom in 1970.
  * <p>
@@ -209,6 +211,9 @@ public class BloomFilter extends Filter {
     out.write(boas.toByteArray());
   }
 
+  @SuppressFBWarnings(value = {"OS_OPEN_STREAM", "OBJECT_DESERIALIZATION"},
+      justification = "Caller is responsible for closing input stream supplied as a parameter; "
+          + "BitSet deserialization is unsafe, but can't update it until RFile version change")
   @Override
   public void readFields(final DataInput in) throws IOException {
 
diff --git a/core/src/main/java/org/apache/accumulo/core/cli/ClientOpts.java b/core/src/main/java/org/apache/accumulo/core/cli/ClientOpts.java
index 2b18a0a..433ead9 100644
--- a/core/src/main/java/org/apache/accumulo/core/cli/ClientOpts.java
+++ b/core/src/main/java/org/apache/accumulo/core/cli/ClientOpts.java
@@ -42,6 +42,8 @@ import org.apache.log4j.Logger;
 import com.beust.jcommander.IStringConverter;
 import com.beust.jcommander.Parameter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ClientOpts extends Help {
 
   public static class TimeConverter implements IStringConverter<Long> {
@@ -199,6 +201,8 @@ public class ClientOpts extends Help {
     return clientConfigFile;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who specified config path")
   public Properties getClientProperties() {
     if (cachedProps == null) {
       cachedProps = new Properties();
diff --git a/core/src/main/java/org/apache/accumulo/core/cli/ConfigOpts.java b/core/src/main/java/org/apache/accumulo/core/cli/ConfigOpts.java
index 70797d7..3ae2fce 100644
--- a/core/src/main/java/org/apache/accumulo/core/cli/ConfigOpts.java
+++ b/core/src/main/java/org/apache/accumulo/core/cli/ConfigOpts.java
@@ -31,6 +31,8 @@ import org.slf4j.LoggerFactory;
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.converters.IParameterSplitter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ConfigOpts extends Help {
 
   private static final Logger log = LoggerFactory.getLogger(ConfigOpts.class);
@@ -60,6 +62,8 @@ public class ConfigOpts extends Help {
 
   private SiteConfiguration siteConfig = null;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "process runs in same security context as admin who provided path")
   public synchronized SiteConfiguration getSiteConfiguration() {
     if (siteConfig == null) {
       siteConfig = new SiteConfiguration(new File(getPropertiesPath()), getOverrides());
diff --git a/core/src/main/java/org/apache/accumulo/core/client/ClientConfiguration.java b/core/src/main/java/org/apache/accumulo/core/client/ClientConfiguration.java
index 85a37ab..a9d400d 100644
--- a/core/src/main/java/org/apache/accumulo/core/client/ClientConfiguration.java
+++ b/core/src/main/java/org/apache/accumulo/core/client/ClientConfiguration.java
@@ -40,6 +40,8 @@ import org.apache.commons.configuration.PropertiesConfiguration;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Contains a list of property keys recognized by the Accumulo client and convenience methods for
  * setting them.
@@ -215,6 +217,8 @@ public class ClientConfiguration {
     return new ClientConfiguration(Collections.singletonList(mapConf));
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "process runs in same security context as user who provided path")
   private static ClientConfiguration loadFromSearchPath(List<String> paths) {
     List<Configuration> configs = new LinkedList<>();
     for (String path : paths) {
@@ -259,6 +263,8 @@ public class ClientConfiguration {
    * @param clientConfPath
    *          The value of ACCUMULO_CLIENT_CONF_PATH.
    */
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "process runs in same security context as user who provided path")
   static String getClientConfPath(String clientConfPath) {
     if (null == clientConfPath) {
       return null;
diff --git a/core/src/main/java/org/apache/accumulo/core/client/ZooKeeperInstance.java b/core/src/main/java/org/apache/accumulo/core/client/ZooKeeperInstance.java
index 27000a9..bad3a78 100644
--- a/core/src/main/java/org/apache/accumulo/core/client/ZooKeeperInstance.java
+++ b/core/src/main/java/org/apache/accumulo/core/client/ZooKeeperInstance.java
@@ -36,9 +36,9 @@ import org.apache.accumulo.core.conf.ClientProperty;
 import org.apache.accumulo.core.conf.ConfigurationTypeHelper;
 import org.apache.accumulo.core.metadata.RootTable;
 import org.apache.accumulo.core.util.OpTimer;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooCacheFactory;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/core/src/main/java/org/apache/accumulo/core/client/impl/AccumuloClientImpl.java b/core/src/main/java/org/apache/accumulo/core/client/impl/AccumuloClientImpl.java
index 31d2ed6..fb819cf 100644
--- a/core/src/main/java/org/apache/accumulo/core/client/impl/AccumuloClientImpl.java
+++ b/core/src/main/java/org/apache/accumulo/core/client/impl/AccumuloClientImpl.java
@@ -52,6 +52,8 @@ import org.apache.accumulo.core.master.state.tables.TableState;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.trace.Tracer;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class AccumuloClientImpl extends Connector implements AccumuloClient {
   private static final String SYSTEM_TOKEN_NAME = "org.apache.accumulo.server.security."
       + "SystemCredentials$SystemToken";
@@ -391,6 +393,8 @@ public class AccumuloClientImpl extends Connector implements AccumuloClient {
       return this;
     }
 
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+        justification = "code runs in same security context as user who provided configFile")
     @Override
     public AccumuloClientFactory usingProperties(String configFile) {
       Properties properties = new Properties();
diff --git a/core/src/main/java/org/apache/accumulo/core/client/impl/ClientContext.java b/core/src/main/java/org/apache/accumulo/core/client/impl/ClientContext.java
index b1cdf05..5b68093 100644
--- a/core/src/main/java/org/apache/accumulo/core/client/impl/ClientContext.java
+++ b/core/src/main/java/org/apache/accumulo/core/client/impl/ClientContext.java
@@ -40,9 +40,9 @@ import org.apache.accumulo.core.rpc.SaslConnectionParams;
 import org.apache.accumulo.core.rpc.SslConnectionParams;
 import org.apache.accumulo.core.security.thrift.TCredentials;
 import org.apache.accumulo.core.util.OpTimer;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooCacheFactory;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/core/src/main/java/org/apache/accumulo/core/client/impl/ServerClient.java b/core/src/main/java/org/apache/accumulo/core/client/impl/ServerClient.java
index 5e13c3f..b7cc2a8 100644
--- a/core/src/main/java/org/apache/accumulo/core/client/impl/ServerClient.java
+++ b/core/src/main/java/org/apache/accumulo/core/client/impl/ServerClient.java
@@ -33,8 +33,8 @@ import org.apache.accumulo.core.rpc.ThriftUtil;
 import org.apache.accumulo.core.util.Pair;
 import org.apache.accumulo.core.util.ServerServices;
 import org.apache.accumulo.core.util.ServerServices.Service;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.thrift.TApplicationException;
 import org.apache.thrift.TServiceClient;
 import org.apache.thrift.TServiceClientFactory;
diff --git a/core/src/main/java/org/apache/accumulo/core/client/impl/TabletLocatorImpl.java b/core/src/main/java/org/apache/accumulo/core/client/impl/TabletLocatorImpl.java
index 62b025b..d73b5f7 100644
--- a/core/src/main/java/org/apache/accumulo/core/client/impl/TabletLocatorImpl.java
+++ b/core/src/main/java/org/apache/accumulo/core/client/impl/TabletLocatorImpl.java
@@ -51,6 +51,8 @@ import org.apache.hadoop.io.WritableComparator;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class TabletLocatorImpl extends TabletLocator {
 
   private static final Logger log = LoggerFactory.getLogger(TabletLocatorImpl.class);
@@ -673,6 +675,8 @@ public class TabletLocatorImpl extends TabletLocator {
     return lcSession.checkLock(locateTabletInCache(row));
   }
 
+  @SuppressFBWarnings(value = {"UL_UNRELEASED_LOCK", "UL_UNRELEASED_LOCK_EXCEPTION_PATH"},
+      justification = "locking is confusing, but probably correct")
   private void processInvalidated(ClientContext context, LockCheckerSession lcSession)
       throws AccumuloSecurityException, AccumuloException, TableNotFoundException {
 
diff --git a/core/src/main/java/org/apache/accumulo/core/client/sample/AbstractHashSampler.java b/core/src/main/java/org/apache/accumulo/core/client/sample/AbstractHashSampler.java
index e6f9fcd..702544e 100644
--- a/core/src/main/java/org/apache/accumulo/core/client/sample/AbstractHashSampler.java
+++ b/core/src/main/java/org/apache/accumulo/core/client/sample/AbstractHashSampler.java
@@ -32,6 +32,8 @@ import com.google.common.hash.HashFunction;
 import com.google.common.hash.Hasher;
 import com.google.common.hash.Hashing;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * A base class that can be used to create Samplers based on hashing. This class offers consistent
  * options for configuring the hash function. The subclass decides which parts of the key to hash.
@@ -68,7 +70,8 @@ public abstract class AbstractHashSampler implements Sampler {
   /**
    * Subclasses with options should override this method and call {@code super.init(config)}.
    */
-
+  @SuppressFBWarnings(value = "UNSAFE_HASH_EQUALS",
+      justification = "these hashes don't protect any secrets, just used for binning")
   @Override
   public void init(SamplerConfiguration config) {
     String hasherOpt = config.getOptions().get("hasher");
diff --git a/core/src/main/java/org/apache/accumulo/core/conf/ClientProperty.java b/core/src/main/java/org/apache/accumulo/core/conf/ClientProperty.java
index f2fd9d8..911079b 100644
--- a/core/src/main/java/org/apache/accumulo/core/conf/ClientProperty.java
+++ b/core/src/main/java/org/apache/accumulo/core/conf/ClientProperty.java
@@ -32,6 +32,8 @@ import org.apache.accumulo.core.client.security.tokens.DelegationToken;
 import org.apache.accumulo.core.client.security.tokens.KerberosToken;
 import org.apache.accumulo.core.client.security.tokens.PasswordToken;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public enum ClientProperty {
 
   // Instance
@@ -230,6 +232,8 @@ public enum ClientProperty {
     properties.setProperty(ClientProperty.AUTH_TOKEN.getKey(), keytabPath);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who providing the token file")
   public static AuthenticationToken getAuthenticationToken(Properties properties) {
     String authType = ClientProperty.AUTH_TYPE.getValue(properties);
     String token = ClientProperty.AUTH_TOKEN.getValue(properties);
diff --git a/core/src/main/java/org/apache/accumulo/core/conf/Property.java b/core/src/main/java/org/apache/accumulo/core/conf/Property.java
index bf53d7c..6626643 100644
--- a/core/src/main/java/org/apache/accumulo/core/conf/Property.java
+++ b/core/src/main/java/org/apache/accumulo/core/conf/Property.java
@@ -46,6 +46,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Preconditions;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public enum Property {
   // SSL properties local to each node (see also instance.ssl.enabled which must be consistent
   // across all nodes in an instance)
@@ -957,6 +959,8 @@ public enum Property {
     return computedDefaultValue;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who providing the file")
   private void precomputeDefaultValue() {
     String v;
     if (isInterpolated()) {
diff --git a/core/src/main/java/org/apache/accumulo/core/conf/SiteConfiguration.java b/core/src/main/java/org/apache/accumulo/core/conf/SiteConfiguration.java
index b4dd103..ccadbee 100644
--- a/core/src/main/java/org/apache/accumulo/core/conf/SiteConfiguration.java
+++ b/core/src/main/java/org/apache/accumulo/core/conf/SiteConfiguration.java
@@ -39,6 +39,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Preconditions;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * An {@link AccumuloConfiguration} which first loads any properties set on the command-line (using
  * the -o option) and then from accumulo.properties. This implementation supports defaulting
@@ -79,6 +81,8 @@ public class SiteConfiguration extends AccumuloConfiguration {
     this(accumuloPropsLocation, Collections.emptyMap());
   }
 
+  @SuppressFBWarnings(value = "URLCONNECTION_SSRF_FD",
+      justification = "location of props is specified by an admin")
   public SiteConfiguration(URL accumuloPropsLocation, Map<String,String> overrides) {
     this.overrides = overrides;
 
diff --git a/core/src/main/java/org/apache/accumulo/core/data/LoadPlan.java b/core/src/main/java/org/apache/accumulo/core/data/LoadPlan.java
index be5910a..3cbf63b 100644
--- a/core/src/main/java/org/apache/accumulo/core/data/LoadPlan.java
+++ b/core/src/main/java/org/apache/accumulo/core/data/LoadPlan.java
@@ -28,6 +28,8 @@ import com.google.common.base.Preconditions;
 import com.google.common.collect.ImmutableList;
 import com.google.common.primitives.UnsignedBytes;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Information about where to load files into an Accumulo table.
  *
@@ -49,6 +51,8 @@ public class LoadPlan {
     return data == null ? null : data.toString().getBytes(StandardCharsets.UTF_8);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "this code is validating the input")
   private static String checkFileName(String fileName) {
     Preconditions.checkArgument(Paths.get(fileName).getNameCount() == 1,
         "Expected only filename, but got %s", fileName);
diff --git a/core/src/main/java/org/apache/accumulo/core/file/blockfile/cache/lru/LruBlockCache.java b/core/src/main/java/org/apache/accumulo/core/file/blockfile/cache/lru/LruBlockCache.java
index dc6eb75..2da6356 100644
--- a/core/src/main/java/org/apache/accumulo/core/file/blockfile/cache/lru/LruBlockCache.java
+++ b/core/src/main/java/org/apache/accumulo/core/file/blockfile/cache/lru/LruBlockCache.java
@@ -36,6 +36,8 @@ import org.apache.accumulo.core.util.NamingThreadFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * A block cache implementation that is memory-aware using {@link HeapSize}, memory-bound using an
  * LRU eviction algorithm, and concurrent: backed by a {@link ConcurrentHashMap} and with a
@@ -124,6 +126,8 @@ public class LruBlockCache extends SynchronousLoadingBlockCache implements Block
    * @param conf
    *          block cache configuration
    */
+  @SuppressFBWarnings(value = "SC_START_IN_CTOR",
+      justification = "bad practice to start threads in constructor; probably needs rewrite")
   public LruBlockCache(final LruBlockCacheConfiguration conf) {
     super();
     this.conf = conf;
@@ -521,6 +525,7 @@ public class LruBlockCache extends SynchronousLoadingBlockCache implements Block
       return running;
     }
 
+    @SuppressFBWarnings(value = "UW_UNCOND_WAIT", justification = "eviction is resumed by caller")
     @Override
     public void run() {
       while (true) {
@@ -537,6 +542,7 @@ public class LruBlockCache extends SynchronousLoadingBlockCache implements Block
       }
     }
 
+    @SuppressFBWarnings(value = "NN_NAKED_NOTIFY", justification = "eviction is resumed by caller")
     public void evict() {
       synchronized (this) {
         this.notify();
diff --git a/core/src/main/java/org/apache/accumulo/core/file/blockfile/impl/SeekableByteArrayInputStream.java b/core/src/main/java/org/apache/accumulo/core/file/blockfile/impl/SeekableByteArrayInputStream.java
index 982556f..928c550 100644
--- a/core/src/main/java/org/apache/accumulo/core/file/blockfile/impl/SeekableByteArrayInputStream.java
+++ b/core/src/main/java/org/apache/accumulo/core/file/blockfile/impl/SeekableByteArrayInputStream.java
@@ -22,6 +22,8 @@ import static java.util.Objects.requireNonNull;
 import java.io.IOException;
 import java.io.InputStream;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * This class is like byte array input stream with two differences. It supports seeking and avoids
  * synchronization.
@@ -36,6 +38,8 @@ public class SeekableByteArrayInputStream extends InputStream {
   // however the expectation is that the byte array is static. In the case of it being static,
   // volatile ensures that
   // thread 2 sees all of thread 1 changes before setting the volatile.
+  @SuppressFBWarnings(value = "VO_VOLATILE_REFERENCE_TO_ARRAY",
+      justification = "see explanation above")
   private volatile byte buffer[];
   private int cur;
   private int max;
diff --git a/core/src/main/java/org/apache/accumulo/core/file/rfile/PrintInfo.java b/core/src/main/java/org/apache/accumulo/core/file/rfile/PrintInfo.java
index 969572c..99a3215 100644
--- a/core/src/main/java/org/apache/accumulo/core/file/rfile/PrintInfo.java
+++ b/core/src/main/java/org/apache/accumulo/core/file/rfile/PrintInfo.java
@@ -49,6 +49,8 @@ import org.slf4j.LoggerFactory;
 import com.beust.jcommander.Parameter;
 import com.google.auto.service.AutoService;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 @AutoService(KeywordExecutable.class)
 public class PrintInfo implements KeywordExecutable {
 
@@ -134,13 +136,15 @@ public class PrintInfo implements KeywordExecutable {
     return "Prints rfile info";
   }
 
+  @SuppressFBWarnings(value = "DM_EXIT",
+      justification = "System.exit is fine here because it's a utility class executed by a main()")
   @Override
   public void execute(final String[] args) throws Exception {
     Opts opts = new Opts();
     opts.parseArgs("accumulo rfile-info", args);
     if (opts.files.isEmpty()) {
       System.err.println("No files were given");
-      System.exit(-1);
+      System.exit(1);
     }
     SiteConfiguration siteConfig = opts.getSiteConfiguration();
 
diff --git a/core/src/main/java/org/apache/accumulo/core/iterators/GrepIterator.java b/core/src/main/java/org/apache/accumulo/core/iterators/GrepIterator.java
deleted file mode 100644
index 5c44c31..0000000
--- a/core/src/main/java/org/apache/accumulo/core/iterators/GrepIterator.java
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.core.iterators;
-
-/**
- * This class remains here for backwards compatibility.
- *
- * @deprecated since 1.4, replaced by {@link org.apache.accumulo.core.iterators.user.GrepIterator}
- */
-@Deprecated
-public class GrepIterator extends org.apache.accumulo.core.iterators.user.GrepIterator {
-
-}
diff --git a/core/src/main/java/org/apache/accumulo/core/iterators/IntersectingIterator.java b/core/src/main/java/org/apache/accumulo/core/iterators/IntersectingIterator.java
deleted file mode 100644
index 643901b..0000000
--- a/core/src/main/java/org/apache/accumulo/core/iterators/IntersectingIterator.java
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.core.iterators;
-
-/**
- * This class remains here for backwards compatibility.
- *
- * @deprecated since 1.4, replaced by
- *             {@link org.apache.accumulo.core.iterators.user.IntersectingIterator}
- */
-@Deprecated
-public class IntersectingIterator
-    extends org.apache.accumulo.core.iterators.user.IntersectingIterator {
-
-}
diff --git a/core/src/main/java/org/apache/accumulo/core/iterators/LargeRowFilter.java b/core/src/main/java/org/apache/accumulo/core/iterators/LargeRowFilter.java
deleted file mode 100644
index 75155f9..0000000
--- a/core/src/main/java/org/apache/accumulo/core/iterators/LargeRowFilter.java
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.core.iterators;
-
-/**
- * This class remains here for backwards compatibility.
- *
- * @deprecated since 1.4, replaced by {@link org.apache.accumulo.core.iterators.user.LargeRowFilter}
- */
-@Deprecated
-public class LargeRowFilter extends org.apache.accumulo.core.iterators.user.LargeRowFilter {
-
-}
diff --git a/core/src/main/java/org/apache/accumulo/core/iterators/RowDeletingIterator.java b/core/src/main/java/org/apache/accumulo/core/iterators/RowDeletingIterator.java
deleted file mode 100644
index 4bdcb70..0000000
--- a/core/src/main/java/org/apache/accumulo/core/iterators/RowDeletingIterator.java
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.core.iterators;
-
-/**
- * This class remains here for backwards compatibility.
- *
- * @deprecated since 1.4, replaced by
- *             {@link org.apache.accumulo.core.iterators.user.RowDeletingIterator}
- */
-@Deprecated
-public class RowDeletingIterator
-    extends org.apache.accumulo.core.iterators.user.RowDeletingIterator {
-
-}
diff --git a/core/src/main/java/org/apache/accumulo/core/iterators/VersioningIterator.java b/core/src/main/java/org/apache/accumulo/core/iterators/VersioningIterator.java
deleted file mode 100644
index 1b838eb..0000000
--- a/core/src/main/java/org/apache/accumulo/core/iterators/VersioningIterator.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.core.iterators;
-
-import org.apache.accumulo.core.data.Key;
-import org.apache.accumulo.core.data.Value;
-
-/**
- * This class remains here for backwards compatibility.
- *
- * @deprecated since 1.4, replaced by
- *             {@link org.apache.accumulo.core.iterators.user.VersioningIterator}
- */
-@Deprecated
-public class VersioningIterator extends org.apache.accumulo.core.iterators.user.VersioningIterator {
-  public VersioningIterator() {}
-
-  public VersioningIterator(SortedKeyValueIterator<Key,Value> iterator, int maxVersions) {
-    super();
-    this.setSource(iterator);
-    this.maxVersions = maxVersions;
-  }
-}
diff --git a/core/src/main/java/org/apache/accumulo/core/iterators/WholeRowIterator.java b/core/src/main/java/org/apache/accumulo/core/iterators/WholeRowIterator.java
deleted file mode 100644
index 899ca6d..0000000
--- a/core/src/main/java/org/apache/accumulo/core/iterators/WholeRowIterator.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.core.iterators;
-
-/**
- * This class remains here for backwards compatibility.
- *
- * @deprecated since 1.4, replaced by
- *             {@link org.apache.accumulo.core.iterators.user.WholeRowIterator}
- */
-@Deprecated
-public class WholeRowIterator extends org.apache.accumulo.core.iterators.user.WholeRowIterator {
-
-}
diff --git a/core/src/main/java/org/apache/accumulo/core/rpc/SslConnectionParams.java b/core/src/main/java/org/apache/accumulo/core/rpc/SslConnectionParams.java
index f7a951f..b83f1e2 100644
--- a/core/src/main/java/org/apache/accumulo/core/rpc/SslConnectionParams.java
+++ b/core/src/main/java/org/apache/accumulo/core/rpc/SslConnectionParams.java
@@ -28,6 +28,8 @@ import org.apache.thrift.transport.TSSLTransportFactory.TSSLTransportParameters;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class SslConnectionParams {
   private static final Logger log = LoggerFactory.getLogger(SslConnectionParams.class);
 
@@ -130,6 +132,8 @@ public class SslConnectionParams {
     return forConfig(configuration, false);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who providing the keystore file")
   private static String findKeystore(String keystorePath) throws FileNotFoundException {
     try {
       // first just try the file
diff --git a/core/src/main/java/org/apache/accumulo/core/rpc/ThriftUtil.java b/core/src/main/java/org/apache/accumulo/core/rpc/ThriftUtil.java
index e404a70..adda370 100644
--- a/core/src/main/java/org/apache/accumulo/core/rpc/ThriftUtil.java
+++ b/core/src/main/java/org/apache/accumulo/core/rpc/ThriftUtil.java
@@ -52,6 +52,8 @@ import org.apache.thrift.transport.TTransportFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Factory methods for creating Thrift client objects
  */
@@ -450,6 +452,8 @@ public class ThriftUtil {
    * @param params
    *          Parameters to use to create the SSLContext
    */
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who providing the keystore files")
   private static SSLContext createSSLContext(SslConnectionParams params)
       throws TTransportException {
     SSLContext ctx;
diff --git a/core/src/main/java/org/apache/accumulo/core/security/crypto/impl/AESCryptoService.java b/core/src/main/java/org/apache/accumulo/core/security/crypto/impl/AESCryptoService.java
index 09c5648..8a734b4 100644
--- a/core/src/main/java/org/apache/accumulo/core/security/crypto/impl/AESCryptoService.java
+++ b/core/src/main/java/org/apache/accumulo/core/security/crypto/impl/AESCryptoService.java
@@ -52,6 +52,8 @@ import org.apache.accumulo.core.spi.crypto.FileDecrypter;
 import org.apache.accumulo.core.spi.crypto.FileEncrypter;
 import org.apache.commons.io.IOUtils;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Example implementation of AES encryption for Accumulo
  */
@@ -424,6 +426,7 @@ public class AESCryptoService implements CryptoService {
       return new AESCBCFileDecrypter(fek);
     }
 
+    @SuppressFBWarnings(value = "CIPHER_INTEGRITY", justification = "CBC is provided for WALs")
     public class AESCBCFileEncrypter implements FileEncrypter {
 
       private Key fek = AESKeyUtils.generateKey(sr, KEY_LENGTH_IN_BYTES);
@@ -458,6 +461,7 @@ public class AESCryptoService implements CryptoService {
       }
     }
 
+    @SuppressFBWarnings(value = "CIPHER_INTEGRITY", justification = "CBC is provided for WALs")
     public class AESCBCFileDecrypter implements FileDecrypter {
       private Key fek;
 
diff --git a/core/src/main/java/org/apache/accumulo/core/security/crypto/impl/AESKeyUtils.java b/core/src/main/java/org/apache/accumulo/core/security/crypto/impl/AESKeyUtils.java
index 50b9eea..09ccccc 100644
--- a/core/src/main/java/org/apache/accumulo/core/security/crypto/impl/AESKeyUtils.java
+++ b/core/src/main/java/org/apache/accumulo/core/security/crypto/impl/AESKeyUtils.java
@@ -34,6 +34,8 @@ import javax.crypto.spec.SecretKeySpec;
 
 import org.apache.accumulo.core.spi.crypto.CryptoService.CryptoException;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class AESKeyUtils {
 
   public static final String URI = "uri";
@@ -46,6 +48,8 @@ public class AESKeyUtils {
     return new SecretKeySpec(bytes, "AES");
   }
 
+  @SuppressFBWarnings(value = "CIPHER_INTEGRITY",
+      justification = "integrity not needed for key wrap")
   public static Key unwrapKey(byte[] fek, Key kek) {
     Key result = null;
     try {
@@ -59,6 +63,8 @@ public class AESKeyUtils {
     return result;
   }
 
+  @SuppressFBWarnings(value = "CIPHER_INTEGRITY",
+      justification = "integrity not needed for key wrap")
   public static byte[] wrapKey(Key fek, Key kek) {
     byte[] result = null;
     try {
@@ -73,6 +79,7 @@ public class AESKeyUtils {
     return result;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "keyId specified by admin")
   public static SecretKeySpec loadKekFromUri(String keyId) {
     URI uri;
     SecretKeySpec key = null;
diff --git a/core/src/main/java/org/apache/accumulo/core/trace/ProbabilitySampler.java b/core/src/main/java/org/apache/accumulo/core/trace/ProbabilitySampler.java
deleted file mode 100644
index a65a70e..0000000
--- a/core/src/main/java/org/apache/accumulo/core/trace/ProbabilitySampler.java
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.core.trace;
-
-import java.util.Collections;
-
-import org.apache.htrace.HTraceConfiguration;
-
-/**
- * This wrapper intended for internal Accumulo tracing makes creating a ProbabilitySampler easier.
- */
-public class ProbabilitySampler extends org.apache.htrace.impl.ProbabilitySampler {
-  public ProbabilitySampler(double d) {
-    super(HTraceConfiguration.fromMap(Collections
-        .singletonMap(ProbabilitySampler.SAMPLER_FRACTION_CONF_KEY, Double.toString(d))));
-  }
-}
diff --git a/core/src/main/java/org/apache/accumulo/core/trace/CountSampler.java b/core/src/main/java/org/apache/accumulo/core/trace/TraceSamplers.java
similarity index 66%
rename from core/src/main/java/org/apache/accumulo/core/trace/CountSampler.java
rename to core/src/main/java/org/apache/accumulo/core/trace/TraceSamplers.java
index cdf22cb..54a8841 100644
--- a/core/src/main/java/org/apache/accumulo/core/trace/CountSampler.java
+++ b/core/src/main/java/org/apache/accumulo/core/trace/TraceSamplers.java
@@ -19,13 +19,19 @@ package org.apache.accumulo.core.trace;
 import java.util.Collections;
 
 import org.apache.htrace.HTraceConfiguration;
+import org.apache.htrace.impl.CountSampler;
+import org.apache.htrace.impl.ProbabilitySampler;
 
-/**
- * This wrapper intended for internal Accumulo tracing makes creating a CountSampler easier.
- */
-public class CountSampler extends org.apache.htrace.impl.CountSampler {
-  public CountSampler(long frequency) {
-    super(HTraceConfiguration.fromMap(Collections
+public class TraceSamplers {
+
+  public static CountSampler countSampler(long frequency) {
+    return new CountSampler(HTraceConfiguration.fromMap(Collections
         .singletonMap(CountSampler.SAMPLER_FREQUENCY_CONF_KEY, Long.toString(frequency))));
   }
+
+  public static ProbabilitySampler probabilitySampler(double fraction) {
+    return new ProbabilitySampler(HTraceConfiguration.fromMap(Collections
+        .singletonMap(ProbabilitySampler.SAMPLER_FRACTION_CONF_KEY, Double.toString(fraction))));
+  }
+
 }
diff --git a/core/src/main/java/org/apache/accumulo/core/util/AddressUtil.java b/core/src/main/java/org/apache/accumulo/core/util/AddressUtil.java
index cdbae3f..6bbdc06 100644
--- a/core/src/main/java/org/apache/accumulo/core/util/AddressUtil.java
+++ b/core/src/main/java/org/apache/accumulo/core/util/AddressUtil.java
@@ -16,7 +16,16 @@
  */
 package org.apache.accumulo.core.util;
 
-public class AddressUtil extends org.apache.accumulo.fate.util.AddressUtil {
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import java.security.Security;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class AddressUtil {
+
+  private static final Logger log = LoggerFactory.getLogger(AddressUtil.class);
 
   public static HostAndPort parseAddress(String address, boolean ignoreMissingPort)
       throws NumberFormatException {
@@ -32,4 +41,44 @@ public class AddressUtil extends org.apache.accumulo.fate.util.AddressUtil {
   public static HostAndPort parseAddress(String address, int defaultPort) {
     return parseAddress(address, true).withDefaultPort(defaultPort);
   }
+
+  /**
+   * Fetch the security value that determines how long DNS failures are cached. Looks up the
+   * security property 'networkaddress.cache.negative.ttl'. Should that fail returns the default
+   * value used in the Oracle JVM 1.4+, which is 10 seconds.
+   *
+   * @param originalException
+   *          the host lookup that is the source of needing this lookup. maybe be null.
+   * @return positive integer number of seconds
+   * @see InetAddress
+   * @throws IllegalArgumentException
+   *           if dns failures are cached forever
+   */
+  public static int getAddressCacheNegativeTtl(UnknownHostException originalException) {
+    int negativeTtl = 10;
+    try {
+      negativeTtl = Integer.parseInt(Security.getProperty("networkaddress.cache.negative.ttl"));
+    } catch (NumberFormatException exception) {
+      log.warn("Failed to get JVM negative DNS respones cache TTL due to format problem "
+          + "(e.g. this JVM might not have the property). "
+          + "Falling back to default based on Oracle JVM 1.4+ (10s)", exception);
+    } catch (SecurityException exception) {
+      log.warn("Failed to get JVM negative DNS response cache TTL due to security manager. "
+          + "Falling back to default based on Oracle JVM 1.4+ (10s)", exception);
+    }
+    if (-1 == negativeTtl) {
+      log.error(
+          "JVM negative DNS repsonse cache TTL is set to 'forever' and host lookup failed. "
+              + "TTL can be changed with security property "
+              + "'networkaddress.cache.negative.ttl', see java.net.InetAddress.",
+          originalException);
+      throw new IllegalArgumentException(originalException);
+    } else if (0 > negativeTtl) {
+      log.warn("JVM specified negative DNS response cache TTL was negative (and not 'forever'). "
+          + "Falling back to default based on Oracle JVM 1.4+ (10s)");
+      negativeTtl = 10;
+    }
+    return negativeTtl;
+  }
+
 }
diff --git a/core/src/main/java/org/apache/accumulo/core/zookeeper/ZooUtil.java b/core/src/main/java/org/apache/accumulo/core/zookeeper/ZooUtil.java
deleted file mode 100644
index 61f6716..0000000
--- a/core/src/main/java/org/apache/accumulo/core/zookeeper/ZooUtil.java
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.core.zookeeper;
-
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.net.UnknownHostException;
-
-import org.apache.accumulo.core.Constants;
-import org.apache.accumulo.core.conf.AccumuloConfiguration;
-import org.apache.accumulo.core.util.CachedConfiguration;
-import org.apache.accumulo.core.volume.VolumeConfiguration;
-import org.apache.hadoop.conf.Configuration;
-import org.apache.hadoop.fs.FileStatus;
-import org.apache.hadoop.fs.FileSystem;
-import org.apache.hadoop.fs.Path;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class ZooUtil extends org.apache.accumulo.fate.zookeeper.ZooUtil {
-
-  private static final Logger log = LoggerFactory.getLogger(ZooUtil.class);
-
-  public static String getRoot(final String instanceId) {
-    return Constants.ZROOT + "/" + instanceId;
-  }
-
-  /**
-   * Utility to support certain client side utilities to minimize command-line options.
-   */
-  public static String getInstanceIDFromHdfs(Path instanceDirectory, AccumuloConfiguration conf) {
-    return getInstanceIDFromHdfs(instanceDirectory, conf, CachedConfiguration.getInstance());
-  }
-
-  public static String getInstanceIDFromHdfs(Path instanceDirectory, AccumuloConfiguration conf,
-      Configuration hadoopConf) {
-    try {
-      FileSystem fs = VolumeConfiguration.getVolume(instanceDirectory.toString(), hadoopConf, conf)
-          .getFileSystem();
-      FileStatus[] files = null;
-      try {
-        files = fs.listStatus(instanceDirectory);
-      } catch (FileNotFoundException ex) {
-        // ignored
-      }
-      log.debug("Trying to read instance id from {}", instanceDirectory);
-      if (files == null || files.length == 0) {
-        log.error("unable obtain instance id at {}", instanceDirectory);
-        throw new RuntimeException(
-            "Accumulo not initialized, there is no instance id at " + instanceDirectory);
-      } else if (files.length != 1) {
-        log.error("multiple potential instances in {}", instanceDirectory);
-        throw new RuntimeException(
-            "Accumulo found multiple possible instance ids in " + instanceDirectory);
-      } else {
-        return files[0].getPath().getName();
-      }
-    } catch (IOException e) {
-      log.error("Problem reading instance id out of hdfs at " + instanceDirectory, e);
-      throw new RuntimeException(
-          "Can't tell if Accumulo is initialized; can't read instance id at " + instanceDirectory,
-          e);
-    } catch (IllegalArgumentException exception) {
-      /* HDFS throws this when there's a UnknownHostException due to DNS troubles. */
-      if (exception.getCause() instanceof UnknownHostException) {
-        log.error("Problem reading instance id out of hdfs at " + instanceDirectory, exception);
-      }
-      throw exception;
-    }
-  }
-}
diff --git a/core/src/main/java/org/apache/accumulo/fate/AdminUtil.java b/core/src/main/java/org/apache/accumulo/fate/AdminUtil.java
index 8bafac4..90e9c07 100644
--- a/core/src/main/java/org/apache/accumulo/fate/AdminUtil.java
+++ b/core/src/main/java/org/apache/accumulo/fate/AdminUtil.java
@@ -37,6 +37,8 @@ import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * A utility to administer FATE operations
  */
@@ -400,6 +402,9 @@ public class AdminUtil<T> {
     }
   }
 
+  @SuppressFBWarnings(value = "DM_EXIT",
+      justification = "TODO - should probably avoid System.exit here; "
+          + "this code is used by the fate admin shell command")
   public boolean checkGlobalLock(IZooReaderWriter zk, String path) {
     try {
       if (ZooLock.getLockData(zk.getZooKeeper(), path) != null) {
diff --git a/core/src/main/java/org/apache/accumulo/fate/ZooStore.java b/core/src/main/java/org/apache/accumulo/fate/ZooStore.java
index f662d3d..1aeb96f 100644
--- a/core/src/main/java/org/apache/accumulo/fate/ZooStore.java
+++ b/core/src/main/java/org/apache/accumulo/fate/ZooStore.java
@@ -45,6 +45,8 @@ import org.apache.zookeeper.KeeperException.NodeExistsException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 //TODO use zoocache? - ACCUMULO-1297
 //TODO handle zookeeper being down gracefully - ACCUMULO-1297
 //TODO document zookeeper layout - ACCUMULO-1298
@@ -75,6 +77,9 @@ public class ZooStore<T> implements TStore<T> {
     }
   }
 
+  @SuppressFBWarnings(value = "OBJECT_DESERIALIZATION",
+      justification = "unsafe to store arbitrary serialized objects like this, but needed for now"
+          + " for backwards compatibility")
   private Object deserialize(byte ser[]) {
     try {
       ByteArrayInputStream bais = new ByteArrayInputStream(ser);
diff --git a/core/src/main/java/org/apache/accumulo/fate/util/AddressUtil.java b/core/src/main/java/org/apache/accumulo/fate/util/AddressUtil.java
deleted file mode 100644
index 0edf1ff..0000000
--- a/core/src/main/java/org/apache/accumulo/fate/util/AddressUtil.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.fate.util;
-
-import java.net.InetAddress;
-import java.net.UnknownHostException;
-import java.security.Security;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class AddressUtil {
-
-  private static final Logger log = LoggerFactory.getLogger(AddressUtil.class);
-
-  /**
-   * Fetch the security value that determines how long DNS failures are cached. Looks up the
-   * security property 'networkaddress.cache.negative.ttl'. Should that fail returns the default
-   * value used in the Oracle JVM 1.4+, which is 10 seconds.
-   *
-   * @param originalException
-   *          the host lookup that is the source of needing this lookup. maybe be null.
-   * @return positive integer number of seconds
-   * @see InetAddress
-   * @throws IllegalArgumentException
-   *           if dns failures are cached forever
-   */
-  public static int getAddressCacheNegativeTtl(UnknownHostException originalException) {
-    int negativeTtl = 10;
-    try {
-      negativeTtl = Integer.parseInt(Security.getProperty("networkaddress.cache.negative.ttl"));
-    } catch (NumberFormatException exception) {
-      log.warn("Failed to get JVM negative DNS respones cache TTL due to format problem "
-          + "(e.g. this JVM might not have the property). "
-          + "Falling back to default based on Oracle JVM 1.4+ (10s)", exception);
-    } catch (SecurityException exception) {
-      log.warn("Failed to get JVM negative DNS response cache TTL due to security manager. "
-          + "Falling back to default based on Oracle JVM 1.4+ (10s)", exception);
-    }
-    if (-1 == negativeTtl) {
-      log.error(
-          "JVM negative DNS repsonse cache TTL is set to 'forever' and host lookup failed. "
-              + "TTL can be changed with security property "
-              + "'networkaddress.cache.negative.ttl', see java.net.InetAddress.",
-          originalException);
-      throw new IllegalArgumentException(originalException);
-    } else if (0 > negativeTtl) {
-      log.warn("JVM specified negative DNS response cache TTL was negative (and not 'forever'). "
-          + "Falling back to default based on Oracle JVM 1.4+ (10s)");
-      negativeTtl = 10;
-    }
-    return negativeTtl;
-  }
-
-}
diff --git a/core/src/main/java/org/apache/accumulo/fate/zookeeper/TransactionWatcher.java b/core/src/main/java/org/apache/accumulo/fate/zookeeper/TransactionWatcher.java
deleted file mode 100644
index a36cfc5..0000000
--- a/core/src/main/java/org/apache/accumulo/fate/zookeeper/TransactionWatcher.java
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.fate.zookeeper;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.concurrent.Callable;
-import java.util.concurrent.atomic.AtomicInteger;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class TransactionWatcher {
-
-  public interface Arbitrator {
-    boolean transactionAlive(String type, long tid) throws Exception;
-
-    boolean transactionComplete(String type, long tid) throws Exception;
-  }
-
-  private static final Logger log = LoggerFactory.getLogger(TransactionWatcher.class);
-  private final Map<Long,AtomicInteger> counts = new HashMap<>();
-  private final Arbitrator arbitrator;
-
-  public TransactionWatcher(Arbitrator arbitrator) {
-    this.arbitrator = arbitrator;
-  }
-
-  public <T> T run(String ztxBulk, long tid, Callable<T> callable) throws Exception {
-    synchronized (counts) {
-      if (!arbitrator.transactionAlive(ztxBulk, tid)) {
-        throw new Exception("Transaction " + tid + " of type " + ztxBulk + " is no longer active");
-      }
-      AtomicInteger count = counts.get(tid);
-      if (count == null)
-        counts.put(tid, count = new AtomicInteger());
-      count.incrementAndGet();
-    }
-    try {
-      return callable.call();
-    } finally {
-      synchronized (counts) {
-        AtomicInteger count = counts.get(tid);
-        if (count == null) {
-          log.error("unexpected missing count for transaction {}", tid);
-        } else {
-          if (count.decrementAndGet() == 0)
-            counts.remove(tid);
-        }
-      }
-    }
-  }
-
-  public boolean isActive(long tid) {
-    synchronized (counts) {
-      log.debug("Transactions in progress {}", counts);
-      AtomicInteger count = counts.get(tid);
-      return count != null && count.get() > 0;
-    }
-  }
-
-}
diff --git a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooCache.java b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooCache.java
index c12374b..ca523bd 100644
--- a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooCache.java
+++ b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooCache.java
@@ -217,6 +217,10 @@ public class ZooCache {
     this(new ZooReader(zooKeepers, sessionTimeout), watcher);
   }
 
+  public ZooCache(ZooReader reader) {
+    this(reader, null);
+  }
+
   /**
    * Creates a new cache. The given watcher is called whenever a watched node changes.
    *
diff --git a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooLock.java b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooLock.java
index 6804eaa..a897bbf 100644
--- a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooLock.java
+++ b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooLock.java
@@ -67,6 +67,10 @@ public class ZooLock implements Watcher {
   private boolean watchingParent = false;
   private String asyncLock;
 
+  public ZooLock(ZooReaderWriter zoo, String path) {
+    this(new ZooCache(zoo), zoo, path);
+  }
+
   public ZooLock(String zookeepers, int timeInMillis, String scheme, byte[] auth, String path) {
     this(new ZooCacheFactory().getZooCache(zookeepers, timeInMillis),
         ZooReaderWriter.getInstance(zookeepers, timeInMillis, scheme, auth), path);
diff --git a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooQueueLock.java b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooQueueLock.java
index 0c1cf2e..264b95d 100644
--- a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooQueueLock.java
+++ b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooQueueLock.java
@@ -36,7 +36,7 @@ public class ZooQueueLock implements QueueLock {
   private String path;
   private boolean ephemeral;
 
-  protected ZooQueueLock(IZooReaderWriter zrw, String path, boolean ephemeral) {
+  public ZooQueueLock(IZooReaderWriter zrw, String path, boolean ephemeral) {
     this.zoo = zrw;
     this.path = path;
     this.ephemeral = ephemeral;
diff --git a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooReaderWriter.java b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooReaderWriter.java
index eb2c1cc..9229049 100644
--- a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooReaderWriter.java
+++ b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooReaderWriter.java
@@ -16,9 +16,13 @@
  */
 package org.apache.accumulo.fate.zookeeper;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
+
 import java.util.Arrays;
 import java.util.List;
 
+import org.apache.accumulo.core.conf.AccumuloConfiguration;
+import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.fate.util.Retry;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
@@ -34,6 +38,8 @@ import org.slf4j.LoggerFactory;
 
 public class ZooReaderWriter extends ZooReader implements IZooReaderWriter {
   private static final Logger log = LoggerFactory.getLogger(ZooReaderWriter.class);
+  private static final String SCHEME = "digest";
+  private static final String USER = "accumulo";
 
   private static ZooReaderWriter instance = null;
   private final String scheme;
@@ -45,6 +51,16 @@ public class ZooReaderWriter extends ZooReader implements IZooReaderWriter {
     return getSession(keepers, timeout, scheme, auth);
   }
 
+  public ZooReaderWriter(AccumuloConfiguration conf) {
+    this(conf.get(Property.INSTANCE_ZK_HOST),
+        (int) conf.getTimeInMillis(Property.INSTANCE_ZK_TIMEOUT),
+        conf.get(Property.INSTANCE_SECRET));
+  }
+
+  public ZooReaderWriter(String string, int timeInMillis, String secret) {
+    this(string, timeInMillis, SCHEME, (USER + ":" + secret).getBytes(UTF_8));
+  }
+
   public ZooReaderWriter(String string, int timeInMillis, String scheme, byte[] auth) {
     super(string, timeInMillis);
     this.scheme = scheme;
diff --git a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooSession.java b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooSession.java
index a0ad36f..774ad43 100644
--- a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooSession.java
+++ b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooSession.java
@@ -24,7 +24,7 @@ import java.security.SecureRandom;
 import java.util.HashMap;
 import java.util.Map;
 
-import org.apache.accumulo.fate.util.AddressUtil;
+import org.apache.accumulo.core.util.AddressUtil;
 import org.apache.accumulo.fate.util.UtilWaitThread;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
diff --git a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooUtil.java b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooUtil.java
index 849b627..01b76e8 100644
--- a/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooUtil.java
+++ b/core/src/main/java/org/apache/accumulo/fate/zookeeper/ZooUtil.java
@@ -19,16 +19,27 @@ package org.apache.accumulo.fate.zookeeper;
 import static java.util.Objects.requireNonNull;
 import static java.util.concurrent.TimeUnit.MILLISECONDS;
 
+import java.io.FileNotFoundException;
+import java.io.IOException;
 import java.math.BigInteger;
+import java.net.UnknownHostException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
 
+import org.apache.accumulo.core.Constants;
+import org.apache.accumulo.core.conf.AccumuloConfiguration;
+import org.apache.accumulo.core.util.CachedConfiguration;
+import org.apache.accumulo.core.volume.VolumeConfiguration;
 import org.apache.accumulo.fate.util.Retry;
 import org.apache.accumulo.fate.util.Retry.RetryFactory;
 import org.apache.commons.lang.builder.HashCodeBuilder;
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.fs.FileStatus;
+import org.apache.hadoop.fs.FileSystem;
+import org.apache.hadoop.fs.Path;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
@@ -563,4 +574,52 @@ public class ZooUtil {
     }
   }
 
+  public static String getRoot(final String instanceId) {
+    return Constants.ZROOT + "/" + instanceId;
+  }
+
+  /**
+   * Utility to support certain client side utilities to minimize command-line options.
+   */
+  public static String getInstanceIDFromHdfs(Path instanceDirectory, AccumuloConfiguration conf) {
+    return getInstanceIDFromHdfs(instanceDirectory, conf, CachedConfiguration.getInstance());
+  }
+
+  public static String getInstanceIDFromHdfs(Path instanceDirectory, AccumuloConfiguration conf,
+      Configuration hadoopConf) {
+    try {
+      FileSystem fs = VolumeConfiguration.getVolume(instanceDirectory.toString(), hadoopConf, conf)
+          .getFileSystem();
+      FileStatus[] files = null;
+      try {
+        files = fs.listStatus(instanceDirectory);
+      } catch (FileNotFoundException ex) {
+        // ignored
+      }
+      log.debug("Trying to read instance id from {}", instanceDirectory);
+      if (files == null || files.length == 0) {
+        log.error("unable obtain instance id at {}", instanceDirectory);
+        throw new RuntimeException(
+            "Accumulo not initialized, there is no instance id at " + instanceDirectory);
+      } else if (files.length != 1) {
+        log.error("multiple potential instances in {}", instanceDirectory);
+        throw new RuntimeException(
+            "Accumulo found multiple possible instance ids in " + instanceDirectory);
+      } else {
+        return files[0].getPath().getName();
+      }
+    } catch (IOException e) {
+      log.error("Problem reading instance id out of hdfs at " + instanceDirectory, e);
+      throw new RuntimeException(
+          "Can't tell if Accumulo is initialized; can't read instance id at " + instanceDirectory,
+          e);
+    } catch (IllegalArgumentException exception) {
+      /* HDFS throws this when there's a UnknownHostException due to DNS troubles. */
+      if (exception.getCause() instanceof UnknownHostException) {
+        log.error("Problem reading instance id out of hdfs at " + instanceDirectory, exception);
+      }
+      throw exception;
+    }
+  }
+
 }
diff --git a/core/src/main/spotbugs/exclude-filter.xml b/core/src/main/spotbugs/exclude-filter.xml
index 2be74ba..eb3f0c0 100644
--- a/core/src/main/spotbugs/exclude-filter.xml
+++ b/core/src/main/spotbugs/exclude-filter.xml
@@ -15,107 +15,10 @@
   limitations under the License.
 -->
 <FindBugsFilter>
-  <Match>
-    <!-- TODO ticket for this and BloomFilter OBJECT_DESERIALIZATION - ACCUMULO-3591 could satisfy -->
-    <Class name="org.apache.accumulo.fate.ZooStore" />
-    <Bug code="OBJECT" pattern="OBJECT_DESERIALIZATION" />
-  </Match>
-  <Match>
-    <!-- Ignore security bugs in Tests -->
-    <Or>
-      <Class name="org.apache.accumulo.core.conf.SiteConfigurationTest"/>
-      <Class name="org.apache.accumulo.core.client.impl.ClientContextTest"/>
-      <Class name="org.apache.accumulo.core.client.rfile.RFileTest"/>
-      <Class name="org.apache.accumulo.core.client.security.tokens.CredentialProviderTokenTest"/>
-      <Class name="org.apache.accumulo.core.conf.CredentialProviderFactoryShimTest"/>
-      <Class name="org.apache.accumulo.core.file.BloomFilterLayerLookupTest"/>
-    </Or>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Using CBC mode for Write ahead log encryption so OK with no integrity -->
-    <Or>
-      <Class name="org.apache.accumulo.core.security.crypto.CryptoTest"/>
-      <Class name="org.apache.accumulo.core.security.crypto.impl.AESCryptoService$AESCBCCryptoModule$AESCBCFileEncrypter"/>
-      <Class name="org.apache.accumulo.core.security.crypto.impl.AESCryptoService$AESCBCCryptoModule$AESCBCFileDecrypter"/>
-      <Class name="org.apache.accumulo.core.security.crypto.impl.AESKeyUtils"/>
-    </Or>
-    <Bug code="CIPHER" pattern="CIPHER_INTEGRITY" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.cli.ClientOpts" />
-    <Method name="getClientProperties" />
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.cli.ConfigOpts" />
-    <Method name="getSiteConfiguration" />
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.client.ClientConfiguration" />
-    <Or>
-      <Method name="getClientConfPath" params="java.lang.String"/>
-      <Method name="loadFromSearchPath" params="java.util.List" />
-    </Or>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.client.impl.ConnectorImpl$ConnectorBuilderImpl" />
-    <Method name="usingProperties" params="java.lang.String"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.conf.ClientProperty" />
-    <Method name="getAuthenticationToken" params="java.util.Properties"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.conf.Property" />
-    <Method name="precomputeDefaultValue" />
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.rpc.SslConnectionParams" />
-    <Method name="findKeystore" params="java.lang.String"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.rpc.ThriftUtil" />
-    <Method name="createSSLContext" params="org.apache.accumulo.core.rpc.SslConnectionParams"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.core.security.crypto.impl.AESKeyUtils" />
-    <Method name="loadKekFromUri" params="java.lang.String"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Only hash function compared not actual hash here -->
-    <Class name="org.apache.accumulo.core.client.sample.AbstractHashSampler" />
-    <Method name="init" params="org.apache.accumulo.core.client.sample.SamplerConfiguration" />
-    <Bug code="UNSAFE" pattern="UNSAFE_HASH_EQUALS" />
-  </Match>
-  <Match>
-    <!-- Printing stack traces of errors in Test is OK -->
-    <Class name="org.apache.accumulo.core.file.rfile.MultiThreadedRFileTest" />
-    <Method name="testMultipleReaders"  />
-    <Bug code="INFORMATION" pattern="INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE" />
-  </Match>
-  <Match>
-    <Class name="org.apache.accumulo.core.conf.SiteConfiguration" />
-    <Method name="&lt;init&gt;" params="java.net.URL,java.util.Map" returns="void"/>
-    <Bug code="URLCONNECTION" pattern="URLCONNECTION_SSRF_FD"/>
-  </Match>
+  <!--
+    DO NOT exclude anything other than generated files here. Other files
+    can be excluded inline by adding the @SuppressFBWarnings annotation.
+  -->
   <Match>
     <!-- ignore thrift-generated files -->
     <Or>
@@ -129,80 +32,4 @@
       <Package name="org.apache.accumulo.core.trace.thrift" />
     </Or>
   </Match>
-  <Match>
-    <!-- ignore Writable false positives about closing wrapped DataInput stream -->
-    <Class name="org.apache.accumulo.core.bloomfilter.BloomFilter" />
-    <Method name="readFields" params="java.io.DataInput" returns="void" />
-    <Or>
-      <Bug code="OBJECT" pattern="OBJECT_DESERIALIZATION" />
-      <Bug code="OS" pattern="OS_OPEN_STREAM" />
-    </Or>
-  </Match>
-  <Match>
-    <Class name="org.apache.accumulo.core.file.blockfile.impl.SeekableByteArrayInputStream" />
-    <Field name="buffer" />
-    <Bug code="VO" pattern="VO_VOLATILE_REFERENCE_TO_ARRAY" />
-  </Match>
-  <Match>
-    <!-- locking is confusing, but probably correct -->
-    <Class name="org.apache.accumulo.core.client.impl.TabletLocatorImpl" />
-    <Method name="processInvalidated" params="org.apache.accumulo.core.client.impl.ClientContext,org.apache.accumulo.core.client.impl.TabletLocatorImpl$LockCheckerSession" returns="void" />
-    <Bug code="UL" pattern="UL_UNRELEASED_LOCK" />
-  </Match>
-  <Match>
-    <!-- ignore intentional name shadowing -->
-    <Or>
-      <Package name="org.apache.accumulo.core.iterators.user" />
-      <Package name="org.apache.accumulo.core.iterators" />
-      <Package name="org.apache.accumulo.core.trace" />
-      <Class name="org.apache.accumulo.core.client.mapred.RangeInputSplit" />
-      <Class name="org.apache.accumulo.core.client.mapred.impl.BatchInputSplit" />
-      <Class name="org.apache.accumulo.core.util.AddressUtil" />
-      <Class name="org.apache.accumulo.core.zookeeper.ZooUtil" />
-      <Class name="org.apache.accumulo.core.security.VisibilityConstraint" />
-    </Or>
-    <Or>
-      <Bug code="NM" pattern="NM_SAME_SIMPLE_NAME_AS_SUPERCLASS" />
-      <Bug code="NM" pattern="NM_SAME_SIMPLE_NAME_AS_INTERFACE" />
-    </Or>
-  </Match>
-  <Match>
-    <!-- bad practice to start a thread in constructor; we should be careful using this class -->
-    <Class name="org.apache.accumulo.core.file.blockfile.cache.lru.LruBlockCache" />
-    <Bug code="SC" pattern="SC_START_IN_CTOR" />
-  </Match>
-  <Match>
-    <!-- locking is confusing, but probably correct -->
-    <Class name="org.apache.accumulo.core.file.blockfile.cache.lru.LruBlockCache$EvictionThread" />
-    <Or>
-      <Bug code="NN" pattern="NN_NAKED_NOTIFY" />
-      <Bug code="UW" pattern="UW_UNCOND_WAIT" />
-    </Or>
-  </Match>
-  <Match>
-    <!-- allowed only for backwards compatibility, but this is generally a pretty bad practice -->
-    <Class name="org.apache.accumulo.core.data.Value" />
-    <Method name="equals" params="java.lang.Object" returns="boolean" />
-    <Bug code="EQ" pattern="EQ_CHECK_FOR_OPERAND_NOT_COMPATIBLE_WITH_THIS" />
-  </Match>
-  <Match>
-    <!-- CryptoTest shouldn't close the given I/O streams, because they are just wrapping them -->
-    <Or>
-      <Class name="org.apache.accumulo.core.security.crypto.CryptoTest" />
-    </Or>
-    <Bug code="OS" pattern="OS_OPEN_STREAM" />
-  </Match>
-  <Match>
-    <!-- admin classes can call System.exit -->
-    <Or>
-      <Class name="org.apache.accumulo.core.file.rfile.PrintInfo" />
-      <Class name="org.apache.accumulo.fate.AdminUtil" />
-    </Or>
-    <Bug code="DM" pattern="DM_EXIT" />
-  </Match>
-  <Match>
-    <!-- The purpose of the method is to test a null argument -->
-    <Class name="org.apache.accumulo.core.client.impl.ScannerOptionsTest" />
-    <Bug code="NP" pattern="NP_NULL_PARAM_DEREF_ALL_TARGETS_DANGEROUS" />
-  </Match>
 </FindBugsFilter>
diff --git a/core/src/test/java/org/apache/accumulo/core/client/impl/ClientContextTest.java b/core/src/test/java/org/apache/accumulo/core/client/impl/ClientContextTest.java
index f7def43..9c20359 100644
--- a/core/src/test/java/org/apache/accumulo/core/client/impl/ClientContextTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/client/impl/ClientContextTest.java
@@ -32,6 +32,8 @@ import org.apache.accumulo.core.conf.Property;
 import org.junit.BeforeClass;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ClientContextTest {
 
   private static boolean isCredentialProviderAvailable = false;
@@ -41,6 +43,8 @@ public class ClientContextTest {
   // 'general.rpc.timeout'=>'timeout'}
   private static File keystore;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "provided keystoreUrl path isn't user provided")
   @BeforeClass
   public static void setUpBeforeClass() throws Exception {
     try {
diff --git a/core/src/test/java/org/apache/accumulo/core/client/rfile/RFileTest.java b/core/src/test/java/org/apache/accumulo/core/client/rfile/RFileTest.java
index 6ac89be..dfd52ab 100644
--- a/core/src/test/java/org/apache/accumulo/core/client/rfile/RFileTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/client/rfile/RFileTest.java
@@ -70,8 +70,11 @@ import org.junit.Test;
 
 import com.google.common.collect.ImmutableMap;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class RFileTest {
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path is set by test, not user")
   private String createTmpTestFile() throws IOException {
     File dir = new File(System.getProperty("user.dir") + "/target/rfile-test");
     assertTrue(dir.mkdirs() || dir.isDirectory());
diff --git a/core/src/test/java/org/apache/accumulo/core/client/security/tokens/CredentialProviderTokenTest.java b/core/src/test/java/org/apache/accumulo/core/client/security/tokens/CredentialProviderTokenTest.java
index 1a0b93b..a60c336 100644
--- a/core/src/test/java/org/apache/accumulo/core/client/security/tokens/CredentialProviderTokenTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/client/security/tokens/CredentialProviderTokenTest.java
@@ -31,6 +31,8 @@ import org.apache.accumulo.core.conf.CredentialProviderFactoryShim;
 import org.junit.BeforeClass;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CredentialProviderTokenTest {
 
   private static boolean isCredentialProviderAvailable = false;
@@ -38,6 +40,8 @@ public class CredentialProviderTokenTest {
   // Keystore contains: {'root.password':'password', 'bob.password':'bob'}
   private static String keystorePath;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "keystoreUrl location isn't provided by user input")
   @BeforeClass
   public static void setup() {
     try {
diff --git a/core/src/test/java/org/apache/accumulo/core/conf/CredentialProviderFactoryShimTest.java b/core/src/test/java/org/apache/accumulo/core/conf/CredentialProviderFactoryShimTest.java
index 1ba0ffa..051e623 100644
--- a/core/src/test/java/org/apache/accumulo/core/conf/CredentialProviderFactoryShimTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/conf/CredentialProviderFactoryShimTest.java
@@ -41,6 +41,8 @@ import org.junit.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CredentialProviderFactoryShimTest {
 
   private static final Logger log = LoggerFactory
@@ -50,6 +52,7 @@ public class CredentialProviderFactoryShimTest {
       emptyKeyStoreName = "/empty.jceks";
   private static File emptyKeyStore, populatedKeyStore;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "paths not set by user input")
   @BeforeClass
   public static void checkCredentialProviderAvailable() {
     try {
diff --git a/core/src/test/java/org/apache/accumulo/core/conf/SiteConfigurationTest.java b/core/src/test/java/org/apache/accumulo/core/conf/SiteConfigurationTest.java
index 8712347..c017b37 100644
--- a/core/src/test/java/org/apache/accumulo/core/conf/SiteConfigurationTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/conf/SiteConfigurationTest.java
@@ -33,6 +33,8 @@ import org.junit.Test;
 
 import com.google.common.collect.ImmutableMap;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class SiteConfigurationTest {
   private static boolean isCredentialProviderAvailable;
 
@@ -46,6 +48,8 @@ public class SiteConfigurationTest {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "path to keystore not provided by user input")
   @Test
   public void testOnlySensitivePropertiesExtractedFromCredentialProvider()
       throws SecurityException {
diff --git a/core/src/test/java/org/apache/accumulo/core/file/BloomFilterLayerLookupTest.java b/core/src/test/java/org/apache/accumulo/core/file/BloomFilterLayerLookupTest.java
index 83bdb2b..fe3a83e 100644
--- a/core/src/test/java/org/apache/accumulo/core/file/BloomFilterLayerLookupTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/file/BloomFilterLayerLookupTest.java
@@ -46,6 +46,8 @@ import org.junit.rules.TestName;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class BloomFilterLayerLookupTest {
 
   private static final Logger log = LoggerFactory.getLogger(BloomFilterLayerLookupTest.class);
@@ -58,6 +60,8 @@ public class BloomFilterLayerLookupTest {
   public TemporaryFolder tempDir = new TemporaryFolder(
       new File(System.getProperty("user.dir") + "/target"));
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "tempDir is not provided by user")
   @Test
   public void test() throws IOException {
     HashSet<Integer> valsSet = new HashSet<>();
diff --git a/core/src/test/java/org/apache/accumulo/core/file/rfile/MultiThreadedRFileTest.java b/core/src/test/java/org/apache/accumulo/core/file/rfile/MultiThreadedRFileTest.java
index 1906555..af807a6 100644
--- a/core/src/test/java/org/apache/accumulo/core/file/rfile/MultiThreadedRFileTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/file/rfile/MultiThreadedRFileTest.java
@@ -65,6 +65,8 @@ import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class MultiThreadedRFileTest {
 
   private static final Logger LOG = Logger.getLogger(MultiThreadedRFileTest.class);
@@ -210,6 +212,8 @@ public class MultiThreadedRFileTest {
 
   public AccumuloConfiguration conf = null;
 
+  @SuppressFBWarnings(value = "INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE",
+      justification = "information put into error message is safe and used for testing")
   @Test
   public void testMultipleReaders() throws IOException {
     final List<Throwable> threadExceptions = Collections
diff --git a/core/src/test/java/org/apache/accumulo/core/security/crypto/CryptoTest.java b/core/src/test/java/org/apache/accumulo/core/security/crypto/CryptoTest.java
index 00c3d66..3c05df7 100644
--- a/core/src/test/java/org/apache/accumulo/core/security/crypto/CryptoTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/security/crypto/CryptoTest.java
@@ -77,6 +77,8 @@ import org.junit.rules.ExpectedException;
 
 import com.google.common.collect.Iterables;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CryptoTest {
 
   public static final int MARKER_INT = 0xCADEFEDD;
@@ -274,6 +276,7 @@ public class CryptoTest {
     assertEquals(AESCryptoService.class, cs.getClass());
   }
 
+  @SuppressFBWarnings(value = "CIPHER_INTEGRITY", justification = "CBC is being tested")
   @Test
   public void testKeyManagerGeneratesKey() throws NoSuchAlgorithmException, NoSuchProviderException,
       NoSuchPaddingException, InvalidKeyException {
@@ -347,24 +350,23 @@ public class CryptoTest {
   }
 
   private void decrypt(byte[] resultingBytes, Scope scope, String configFile) throws Exception {
-    ByteArrayInputStream in = new ByteArrayInputStream(resultingBytes);
-    DataInputStream dataIn = new DataInputStream(in);
-    byte[] params = CryptoUtils.readParams(dataIn);
+    try (DataInputStream dataIn = new DataInputStream(new ByteArrayInputStream(resultingBytes))) {
+      byte[] params = CryptoUtils.readParams(dataIn);
 
-    AccumuloConfiguration conf = getAccumuloConfig(configFile);
-    CryptoService cryptoService = CryptoServiceFactory.newInstance(conf);
-    CryptoEnvironment env = new CryptoEnvironmentImpl(scope, params);
+      AccumuloConfiguration conf = getAccumuloConfig(configFile);
+      CryptoService cryptoService = CryptoServiceFactory.newInstance(conf);
+      CryptoEnvironment env = new CryptoEnvironmentImpl(scope, params);
 
-    FileDecrypter decrypter = cryptoService.getFileDecrypter(env);
+      FileDecrypter decrypter = cryptoService.getFileDecrypter(env);
 
-    DataInputStream decrypted = new DataInputStream(decrypter.decryptStream(dataIn));
-    String markerString = decrypted.readUTF();
-    int markerInt = decrypted.readInt();
+      try (DataInputStream decrypted = new DataInputStream(decrypter.decryptStream(dataIn))) {
+        String markerString = decrypted.readUTF();
+        int markerInt = decrypted.readInt();
 
-    assertEquals(MARKER_STRING, markerString);
-    assertEquals(MARKER_INT, markerInt);
-    in.close();
-    dataIn.close();
+        assertEquals(MARKER_STRING, markerString);
+        assertEquals(MARKER_INT, markerInt);
+      }
+    }
   }
 
   private String getStringifiedBytes(byte[] params, String s, int i) throws IOException {
diff --git a/core/src/test/java/org/apache/accumulo/fate/util/AddressUtilTest.java b/core/src/test/java/org/apache/accumulo/core/util/AddressUtilTest.java
similarity index 99%
rename from core/src/test/java/org/apache/accumulo/fate/util/AddressUtilTest.java
rename to core/src/test/java/org/apache/accumulo/core/util/AddressUtilTest.java
index ae73693..9b1029c 100644
--- a/core/src/test/java/org/apache/accumulo/fate/util/AddressUtilTest.java
+++ b/core/src/test/java/org/apache/accumulo/core/util/AddressUtilTest.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.accumulo.fate.util;
+package org.apache.accumulo.core.util;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
diff --git a/minicluster/src/main/java/org/apache/accumulo/cluster/RemoteShellOptions.java b/minicluster/src/main/java/org/apache/accumulo/cluster/RemoteShellOptions.java
index 67bfb65..15f90eb 100644
--- a/minicluster/src/main/java/org/apache/accumulo/cluster/RemoteShellOptions.java
+++ b/minicluster/src/main/java/org/apache/accumulo/cluster/RemoteShellOptions.java
@@ -26,6 +26,8 @@ import java.util.Properties;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Property-based configuration of options to control how SSH is performed.
  *
@@ -51,6 +53,8 @@ public class RemoteShellOptions {
 
   protected Properties properties = new Properties();
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input file name")
   public RemoteShellOptions() {
     properties = new Properties();
     Properties systemProperties = System.getProperties();
diff --git a/minicluster/src/main/java/org/apache/accumulo/cluster/standalone/StandaloneAccumuloCluster.java b/minicluster/src/main/java/org/apache/accumulo/cluster/standalone/StandaloneAccumuloCluster.java
index 4b7ef2e..0733fe0 100644
--- a/minicluster/src/main/java/org/apache/accumulo/cluster/standalone/StandaloneAccumuloCluster.java
+++ b/minicluster/src/main/java/org/apache/accumulo/cluster/standalone/StandaloneAccumuloCluster.java
@@ -46,6 +46,8 @@ import org.apache.hadoop.fs.Path;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * AccumuloCluster implementation to connect to an existing deployment of Accumulo
  */
@@ -66,6 +68,8 @@ public class StandaloneAccumuloCluster implements AccumuloCluster {
   private SiteConfiguration siteConfig;
   private ServerContext context;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input file name")
   public StandaloneAccumuloCluster(ClientInfo info, Path tmp, List<ClusterUser> users,
       String serverAccumuloConfDir) {
     this.info = info;
@@ -217,6 +221,8 @@ public class StandaloneAccumuloCluster implements AccumuloCluster {
     return new ConfigurationCopy(siteConfig);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input file name")
   @Override
   public String getAccumuloPropertiesPath() {
     return new File(serverAccumuloConfDir, "accumulo.properties").toString();
diff --git a/minicluster/src/main/java/org/apache/accumulo/cluster/standalone/StandaloneClusterControl.java b/minicluster/src/main/java/org/apache/accumulo/cluster/standalone/StandaloneClusterControl.java
index 74e35ce..9bca414 100644
--- a/minicluster/src/main/java/org/apache/accumulo/cluster/standalone/StandaloneClusterControl.java
+++ b/minicluster/src/main/java/org/apache/accumulo/cluster/standalone/StandaloneClusterControl.java
@@ -44,6 +44,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.Maps;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Use the {@link RemoteShell} to control a standalone (possibly distributed) Accumulo instance
  */
@@ -65,6 +67,8 @@ public class StandaloneClusterControl implements ClusterControl {
 
   protected String accumuloServicePath, accumuloPath, accumuloUtilPath;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input file name")
   public StandaloneClusterControl(String accumuloHome, String clientAccumuloConfDir,
       String serverAccumuloConfDir, String clientCmdPrefix, String serverCmdPrefix) {
     this.options = new RemoteShellOptions();
@@ -364,6 +368,8 @@ public class StandaloneClusterControl implements ClusterControl {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input file name")
   protected File getClientConfDir() {
     File confDir = new File(clientAccumuloConfDir);
     if (!confDir.exists() || !confDir.isDirectory()) {
@@ -373,6 +379,8 @@ public class StandaloneClusterControl implements ClusterControl {
     return confDir;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input file name")
   protected File getServerConfDir() {
     File confDir = new File(serverAccumuloConfDir);
     if (!confDir.exists() || !confDir.isDirectory()) {
diff --git a/minicluster/src/main/java/org/apache/accumulo/minicluster/MiniAccumuloRunner.java b/minicluster/src/main/java/org/apache/accumulo/minicluster/MiniAccumuloRunner.java
index 71910b4..a0583a0 100644
--- a/minicluster/src/main/java/org/apache/accumulo/minicluster/MiniAccumuloRunner.java
+++ b/minicluster/src/main/java/org/apache/accumulo/minicluster/MiniAccumuloRunner.java
@@ -37,6 +37,8 @@ import org.slf4j.LoggerFactory;
 import com.beust.jcommander.IStringConverter;
 import com.beust.jcommander.Parameter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * A runner for starting up a {@link MiniAccumuloCluster} from the command line using an optional
  * configuration properties file. An example property file looks like the following:
@@ -109,6 +111,8 @@ public class MiniAccumuloRunner {
   }
 
   public static class PropertiesConverter implements IStringConverter<Properties> {
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+        justification = "code runs in same security context as user who provided input file name")
     @Override
     public Properties convert(String fileName) {
       Properties prop = new Properties();
@@ -146,6 +150,9 @@ public class MiniAccumuloRunner {
    * @param args
    *          An optional -p argument can be specified with the path to a valid properties file.
    */
+  @SuppressFBWarnings(value = {"PATH_TRAVERSAL_IN", "UNENCRYPTED_SERVER_SOCKET"},
+      justification = "code runs in same security context as user who provided input file name; "
+          + "socket need not be encrypted, since this class is provided for testing only")
   public static void main(String[] args) throws IOException, InterruptedException {
     Opts opts = new Opts();
     opts.parseArgs(MiniAccumuloRunner.class.getName(), args);
diff --git a/minicluster/src/main/java/org/apache/accumulo/minicluster/impl/MiniAccumuloClusterControl.java b/minicluster/src/main/java/org/apache/accumulo/minicluster/impl/MiniAccumuloClusterControl.java
index bf10434..389d397 100644
--- a/minicluster/src/main/java/org/apache/accumulo/minicluster/impl/MiniAccumuloClusterControl.java
+++ b/minicluster/src/main/java/org/apache/accumulo/minicluster/impl/MiniAccumuloClusterControl.java
@@ -45,6 +45,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.Maps;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class MiniAccumuloClusterControl implements ClusterControl {
   private static final Logger log = LoggerFactory.getLogger(MiniAccumuloClusterControl.class);
 
@@ -80,6 +82,8 @@ public class MiniAccumuloClusterControl implements ClusterControl {
     return exitCode;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input file name")
   @Override
   public Entry<Integer,String> execWithStdout(Class<?> clz, String[] args) throws IOException {
     Process p = cluster.exec(clz, args);
diff --git a/minicluster/src/main/java/org/apache/accumulo/minicluster/impl/MiniAccumuloClusterImpl.java b/minicluster/src/main/java/org/apache/accumulo/minicluster/impl/MiniAccumuloClusterImpl.java
index cfb337e..be8285f 100644
--- a/minicluster/src/main/java/org/apache/accumulo/minicluster/impl/MiniAccumuloClusterImpl.java
+++ b/minicluster/src/main/java/org/apache/accumulo/minicluster/impl/MiniAccumuloClusterImpl.java
@@ -77,8 +77,8 @@ import org.apache.accumulo.core.trace.Tracer;
 import org.apache.accumulo.core.util.CachedConfiguration;
 import org.apache.accumulo.core.util.Daemon;
 import org.apache.accumulo.core.util.Pair;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.master.state.SetGoalState;
 import org.apache.accumulo.minicluster.MiniAccumuloCluster;
 import org.apache.accumulo.minicluster.ServerType;
@@ -112,6 +112,8 @@ import com.google.common.base.Joiner;
 import com.google.common.collect.Iterables;
 import com.google.common.collect.Maps;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * This class provides the backing implementation for {@link MiniAccumuloCluster}, and may contain
  * features for internal testing which have not yet been promoted to the public API. It's best to
@@ -215,6 +217,8 @@ public class MiniAccumuloClusterImpl implements AccumuloCluster {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "mini runs in the same security context as user providing the url")
   private void append(StringBuilder classpathBuilder, URL url) throws URISyntaxException {
     File file = new File(url.toURI());
     // do not include dirs containing hadoop or accumulo config files
@@ -278,6 +282,8 @@ public class MiniAccumuloClusterImpl implements AccumuloCluster {
     }
   }
 
+  @SuppressFBWarnings(value = "COMMAND_INJECTION",
+      justification = "mini runs in the same security context as user providing the args")
   private Process _exec(Class<?> clazz, List<String> extraJvmOpts, String... args)
       throws IOException {
     String javaHome = System.getProperty("java.home");
@@ -515,6 +521,8 @@ public class MiniAccumuloClusterImpl implements AccumuloCluster {
   /**
    * Starts Accumulo and Zookeeper processes. Can only be called once.
    */
+  @SuppressFBWarnings(value = "UNENCRYPTED_SOCKET",
+      justification = "insecure socket used for reservation")
   @Override
   public synchronized void start() throws IOException, InterruptedException {
     if (config.useMiniDFS() && miniDFS == null) {
@@ -601,7 +609,7 @@ public class MiniAccumuloClusterImpl implements AccumuloCluster {
                     + config.getLogDir() + " for errors.  Last exception: " + e);
               }
               // Don't spin absurdly fast
-              Thread.sleep(250);
+              sleepUninterruptibly(250, TimeUnit.MILLISECONDS);
             } finally {
               if (s != null)
                 s.close();
diff --git a/minicluster/src/main/spotbugs/exclude-filter.xml b/minicluster/src/main/spotbugs/exclude-filter.xml
deleted file mode 100644
index baf15bc..0000000
--- a/minicluster/src/main/spotbugs/exclude-filter.xml
+++ /dev/null
@@ -1,62 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<FindBugsFilter>
-  <Match>
-    <!-- TODO Fix this in _exec? -->
-    <Class name="org.apache.accumulo.minicluster.impl.MiniAccumuloClusterImpl" />
-    <Bug code="COMMAND" pattern="COMMAND_INJECTION" />
-  </Match>
-  <Match>
-    <!-- locking is confusing, but probably correct -->
-    <Class name="org.apache.accumulo.minicluster.impl.MiniAccumuloClusterImpl" />
-    <Method name="start" params="" returns="void" />
-    <Bug code="SWL" pattern="SWL_SLEEP_WITH_LOCK_HELD" />
-  </Match>
-  <Match>
-    <!-- this is just bad practice, but is probably okay, if we're careful -->
-    <Class name="org.apache.accumulo.minicluster.impl.ProcessReference" />
-    <Method name="equals" params="java.lang.Object" returns="boolean" />
-    <Bug code="EQ" pattern="EQ_CHECK_FOR_OPERAND_NOT_COMPATIBLE_WITH_THIS" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Or>
-      <Class name="org.apache.accumulo.cluster.RemoteShellOptions" />
-      <Class name="org.apache.accumulo.cluster.standalone.StandaloneAccumuloCluster" />
-      <Class name="org.apache.accumulo.cluster.standalone.StandaloneClusterControl"/>
-      <Class name="org.apache.accumulo.minicluster.MiniAccumuloClusterExistingZooKeepersTest"/>
-      <Class name="org.apache.accumulo.minicluster.MiniAccumuloClusterStartStopTest"/>
-      <Class name="org.apache.accumulo.minicluster.MiniAccumuloRunner"/>
-      <Class name="org.apache.accumulo.minicluster.MiniAccumuloRunner$PropertiesConverter"/>
-      <Class name="org.apache.accumulo.minicluster.impl.MiniAccumuloClusterControl"/>
-      <Class name="org.apache.accumulo.minicluster.impl.MiniAccumuloClusterImpl"/>
-    </Or>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN"/>
-  </Match>
-  <Match>
-    <!-- Socket just for shutdown -->
-    <Class name="org.apache.accumulo.minicluster.MiniAccumuloRunner" />
-    <Method name="main" params="java.lang.String[]" returns="void"/>
-    <Bug code="UNENCRYPTED" pattern="UNENCRYPTED_SERVER_SOCKET"/>
-  </Match>
-  <Match>
-    <!-- temp socket just for starting up -->
-    <Class name="org.apache.accumulo.minicluster.impl.MiniAccumuloClusterImpl"/>
-    <Method name="start" params="" returns="void" />
-    <Bug code="UNENCRYPTED" pattern="UNENCRYPTED_SOCKET"/>
-  </Match>
-</FindBugsFilter>
diff --git a/minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterExistingZooKeepersTest.java b/minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterExistingZooKeepersTest.java
index 711023b..87784d6 100644
--- a/minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterExistingZooKeepersTest.java
+++ b/minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterExistingZooKeepersTest.java
@@ -39,6 +39,8 @@ import org.junit.rules.TestName;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class MiniAccumuloClusterExistingZooKeepersTest {
   private static final File BASE_DIR = new File(System.getProperty("user.dir")
       + "/target/mini-tests/" + MiniAccumuloClusterExistingZooKeepersTest.class.getName());
@@ -53,6 +55,7 @@ public class MiniAccumuloClusterExistingZooKeepersTest {
   @Rule
   public TestName testName = new TestName();
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "intput determined by test")
   @Before
   public void setupTestCluster() throws Exception {
     assertTrue(BASE_DIR.mkdirs() || BASE_DIR.isDirectory());
diff --git a/minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterStartStopTest.java b/minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterStartStopTest.java
index ed87ab3..8a1b7aa 100644
--- a/minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterStartStopTest.java
+++ b/minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterStartStopTest.java
@@ -31,6 +31,8 @@ import org.junit.rules.TestName;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class MiniAccumuloClusterStartStopTest {
 
   private static final Logger log = LoggerFactory.getLogger(MiniAccumuloClusterStartStopTest.class);
@@ -41,6 +43,7 @@ public class MiniAccumuloClusterStartStopTest {
   @Rule
   public TestName testName = new TestName();
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "input determined by test")
   @Before
   public void setupTestCluster() throws IOException {
     assertTrue(baseDir.mkdirs() || baseDir.isDirectory());
diff --git a/pom.xml b/pom.xml
index 70ce083..43a3ab1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -142,6 +142,7 @@
     <servlet.api.version>3.1.0</servlet.api.version>
     <slf4j.version>1.7.25</slf4j.version>
     <sourceReleaseAssemblyDescriptor>source-release-tar</sourceReleaseAssemblyDescriptor>
+    <spotbugs.version>3.1.6</spotbugs.version>
     <surefire.excludedGroups />
     <surefire.failIfNoSpecifiedTests>false</surefire.failIfNoSpecifiedTests>
     <surefire.groups />
@@ -199,6 +200,11 @@
         <version>2.6.2</version>
       </dependency>
       <dependency>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-annotations</artifactId>
+        <version>${spotbugs.version}</version>
+      </dependency>
+      <dependency>
         <groupId>com.google.auto.service</groupId>
         <artifactId>auto-service</artifactId>
         <version>1.0-rc4</version>
@@ -719,6 +725,13 @@
       </dependency>
     </dependencies>
   </dependencyManagement>
+  <dependencies>
+    <dependency>
+      <groupId>com.github.spotbugs</groupId>
+      <artifactId>spotbugs-annotations</artifactId>
+      <optional>true</optional>
+    </dependency>
+  </dependencies>
   <build>
     <pluginManagement>
       <plugins>
@@ -739,7 +752,7 @@
         <plugin>
           <groupId>com.github.spotbugs</groupId>
           <artifactId>spotbugs-maven-plugin</artifactId>
-          <version>3.1.6</version>
+          <version>${spotbugs.version}</version>
           <configuration>
             <xmlOutput>true</xmlOutput>
             <effort>Max</effort>
@@ -1016,6 +1029,8 @@
                 <unusedDeclaredDependency>junit:junit:jar:4.12</unusedDeclaredDependency>
                 <unusedDeclaredDependency>javax.servlet:javax.servlet-api:jar:${servlet.api.version}</unusedDeclaredDependency>
                 <unusedDeclaredDependency>javax.el:javax.el-api:jar:${javax.el.version}</unusedDeclaredDependency>
+                <!-- spotbugs annotations may or may not be used in each module -->
+                <unusedDeclaredDependency>com.github.spotbugs:spotbugs-annotations:jar:${spotbugs.version}</unusedDeclaredDependency>
               </ignoredUnusedDeclaredDependencies>
             </configuration>
           </execution>
diff --git a/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java b/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java
index 0dea95d..8d27cd3 100644
--- a/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java
+++ b/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java
@@ -55,6 +55,8 @@ import com.beust.jcommander.IStringConverter;
 import com.beust.jcommander.Parameter;
 import com.google.auto.service.AutoService;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 @AutoService(KeywordExecutable.class)
 public class Proxy implements KeywordExecutable {
 
@@ -77,6 +79,9 @@ public class Proxy implements KeywordExecutable {
   public static final String THRIFT_SERVER_HOSTNAME_DEFAULT = "0.0.0.0";
 
   public static class PropertiesConverter implements IStringConverter<Properties> {
+
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+        justification = "app is run in same security context as user providing the filename")
     @Override
     public Properties convert(String fileName) {
       Properties prop = new Properties();
@@ -119,6 +124,7 @@ public class Proxy implements KeywordExecutable {
     return "Starts Accumulo proxy";
   }
 
+  @SuppressFBWarnings(value = "DM_EXIT", justification = "System.exit() from a main class is okay")
   @Override
   public void execute(final String[] args) throws Exception {
     Opts opts = new Opts();
diff --git a/proxy/src/main/spotbugs/exclude-filter.xml b/proxy/src/main/spotbugs/exclude-filter.xml
index 18b7780..8d66ccf 100644
--- a/proxy/src/main/spotbugs/exclude-filter.xml
+++ b/proxy/src/main/spotbugs/exclude-filter.xml
@@ -15,18 +15,12 @@
   limitations under the License.
 -->
 <FindBugsFilter>
+  <!--
+    DO NOT exclude anything other than generated files here. Other files
+    can be excluded inline by adding the @SuppressFBWarnings annotation.
+  -->
   <Match>
     <!-- ignore thrift-generated classes -->
     <Package name="org.apache.accumulo.proxy.thrift" />
   </Match>
-  <Match>
-    <!-- admin classes can call System.exit -->
-    <Class name="org.apache.accumulo.proxy.Proxy" />
-    <Bug code="DM" pattern="DM_EXIT" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.proxy.Proxy$PropertiesConverter"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN"/>
-  </Match>
 </FindBugsFilter>
diff --git a/server/base/pom.xml b/server/base/pom.xml
index 96523a3..7c0cbba 100644
--- a/server/base/pom.xml
+++ b/server/base/pom.xml
@@ -57,10 +57,6 @@
       <artifactId>commons-configuration</artifactId>
     </dependency>
     <dependency>
-      <groupId>commons-io</groupId>
-      <artifactId>commons-io</artifactId>
-    </dependency>
-    <dependency>
       <groupId>commons-lang</groupId>
       <artifactId>commons-lang</artifactId>
     </dependency>
diff --git a/server/base/src/main/java/org/apache/accumulo/server/ServerConstants.java b/server/base/src/main/java/org/apache/accumulo/server/ServerConstants.java
index d45d210..71780f5 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/ServerConstants.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/ServerConstants.java
@@ -30,7 +30,7 @@ import org.apache.accumulo.core.util.CachedConfiguration;
 import org.apache.accumulo.core.util.Pair;
 import org.apache.accumulo.core.volume.Volume;
 import org.apache.accumulo.core.volume.VolumeConfiguration;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.fs.VolumeUtil;
 import org.apache.hadoop.fs.Path;
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/ServerContext.java b/server/base/src/main/java/org/apache/accumulo/server/ServerContext.java
index 228245c..83cbe97 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/ServerContext.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/ServerContext.java
@@ -36,6 +36,7 @@ import org.apache.accumulo.core.rpc.SslConnectionParams;
 import org.apache.accumulo.core.security.crypto.CryptoServiceFactory;
 import org.apache.accumulo.core.spi.crypto.CryptoService;
 import org.apache.accumulo.core.trace.DistributedTrace;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.server.conf.ServerConfigurationFactory;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.accumulo.server.metrics.MetricsSystemHelper;
@@ -45,7 +46,6 @@ import org.apache.accumulo.server.security.SecurityUtil;
 import org.apache.accumulo.server.security.delegation.AuthenticationTokenSecretManager;
 import org.apache.accumulo.server.tables.TableManager;
 import org.apache.accumulo.server.tablets.UniqueNameAllocator;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.hadoop.security.UserGroupInformation;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/ServerInfo.java b/server/base/src/main/java/org/apache/accumulo/server/ServerInfo.java
index d7c69b9..6a4b42a 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/ServerInfo.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/ServerInfo.java
@@ -31,9 +31,9 @@ import org.apache.accumulo.core.client.security.tokens.AuthenticationToken;
 import org.apache.accumulo.core.conf.ClientProperty;
 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.conf.SiteConfiguration;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooCacheFactory;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.accumulo.server.fs.VolumeManagerImpl;
 import org.apache.accumulo.server.security.SystemCredentials;
@@ -111,10 +111,12 @@ public class ServerInfo implements ClientInfo {
     return zooKeeperRoot;
   }
 
+  @Override
   public String getZooKeepers() {
     return zooKeepers;
   }
 
+  @Override
   public int getZooKeepersSessionTimeOut() {
     return zooKeepersSessionTimeOut;
   }
@@ -146,6 +148,7 @@ public class ServerInfo implements ClientInfo {
     return properties;
   }
 
+  @Override
   public String getInstanceName() {
     return instanceName;
   }
diff --git a/server/base/src/main/java/org/apache/accumulo/server/cli/ClientOnDefaultTable.java b/server/base/src/main/java/org/apache/accumulo/server/cli/ClientOnDefaultTable.java
deleted file mode 100644
index 02a9e04..0000000
--- a/server/base/src/main/java/org/apache/accumulo/server/cli/ClientOnDefaultTable.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.server.cli;
-
-import org.apache.accumulo.core.conf.SiteConfiguration;
-import org.apache.accumulo.server.ServerContext;
-
-public class ClientOnDefaultTable extends org.apache.accumulo.core.cli.ClientOnDefaultTable {
-  {
-    setPrincipal("root");
-  }
-
-  private ServerContext context;
-
-  public synchronized ServerContext getServerContext() {
-    if (context == null) {
-      if (instance == null) {
-        context = new ServerContext(new SiteConfiguration());
-      } else {
-        context = new ServerContext(new SiteConfiguration(), getClientInfo());
-      }
-    }
-    return context;
-  }
-
-  public ClientOnDefaultTable(String table) {
-    super(table);
-  }
-}
diff --git a/server/base/src/main/java/org/apache/accumulo/server/cli/ClientOnRequiredTable.java b/server/base/src/main/java/org/apache/accumulo/server/cli/ServerUtilOnRequiredTable.java
similarity index 91%
rename from server/base/src/main/java/org/apache/accumulo/server/cli/ClientOnRequiredTable.java
rename to server/base/src/main/java/org/apache/accumulo/server/cli/ServerUtilOnRequiredTable.java
index 98ee62f..305bbcb 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/cli/ClientOnRequiredTable.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/cli/ServerUtilOnRequiredTable.java
@@ -16,10 +16,11 @@
  */
 package org.apache.accumulo.server.cli;
 
+import org.apache.accumulo.core.cli.ClientOnRequiredTable;
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.server.ServerContext;
 
-public class ClientOnRequiredTable extends org.apache.accumulo.core.cli.ClientOnRequiredTable {
+public class ServerUtilOnRequiredTable extends ClientOnRequiredTable {
   {
     setPrincipal("root");
   }
diff --git a/server/base/src/main/java/org/apache/accumulo/server/cli/ClientOpts.java b/server/base/src/main/java/org/apache/accumulo/server/cli/ServerUtilOpts.java
similarity index 93%
rename from server/base/src/main/java/org/apache/accumulo/server/cli/ClientOpts.java
rename to server/base/src/main/java/org/apache/accumulo/server/cli/ServerUtilOpts.java
index 8f5ed5c..c299ff5 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/cli/ClientOpts.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/cli/ServerUtilOpts.java
@@ -16,11 +16,12 @@
  */
 package org.apache.accumulo.server.cli;
 
+import org.apache.accumulo.core.cli.ClientOpts;
 import org.apache.accumulo.core.client.impl.ClientContext;
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.server.ServerContext;
 
-public class ClientOpts extends org.apache.accumulo.core.cli.ClientOpts {
+public class ServerUtilOpts extends ClientOpts {
   {
     setPrincipal("root");
   }
diff --git a/server/base/src/main/java/org/apache/accumulo/server/conf/ZooConfiguration.java b/server/base/src/main/java/org/apache/accumulo/server/conf/ZooConfiguration.java
index ab41141..9547d04 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/conf/ZooConfiguration.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/conf/ZooConfiguration.java
@@ -27,8 +27,8 @@ import java.util.function.Predicate;
 import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.conf.Property;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/constraints/MetadataConstraints.java b/server/base/src/main/java/org/apache/accumulo/server/constraints/MetadataConstraints.java
index 54ada0e..9dd2b0f 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/constraints/MetadataConstraints.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/constraints/MetadataConstraints.java
@@ -40,12 +40,12 @@ import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.Da
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.LogColumnFamily;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.ScanFileColumnFamily;
 import org.apache.accumulo.core.util.ColumnFQ;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
-import org.apache.accumulo.fate.zookeeper.TransactionWatcher.Arbitrator;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.ServerContext;
+import org.apache.accumulo.server.zookeeper.TransactionWatcher.Arbitrator;
 import org.apache.accumulo.server.zookeeper.TransactionWatcher.ZooArbitrator;
-import org.apache.accumulo.server.zookeeper.ZooCache;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.apache.hadoop.io.Text;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -262,7 +262,7 @@ public class MetadataConstraints implements Constraint {
         } else if (new ColumnFQ(columnUpdate)
             .equals(TabletsSection.ServerColumnFamily.LOCK_COLUMN)) {
           if (zooCache == null) {
-            zooCache = new ZooCache(context);
+            zooCache = new ZooCache(context.getZooReaderWriter(), null);
           }
 
           if (zooRoot == null) {
diff --git a/server/base/src/main/java/org/apache/accumulo/server/fs/RandomVolumeChooser.java b/server/base/src/main/java/org/apache/accumulo/server/fs/RandomVolumeChooser.java
index d3daecd..7f8c5df 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/fs/RandomVolumeChooser.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/fs/RandomVolumeChooser.java
@@ -20,7 +20,7 @@ import java.security.SecureRandom;
 import java.util.Random;
 
 public class RandomVolumeChooser implements VolumeChooser {
-  private final Random random = new SecureRandom();
+  protected final Random random = new SecureRandom();
 
   @Override
   public String choose(VolumeChooserEnvironment env, String[] options)
diff --git a/server/base/src/main/java/org/apache/accumulo/server/fs/SpaceAwareVolumeChooser.java b/server/base/src/main/java/org/apache/accumulo/server/fs/SpaceAwareVolumeChooser.java
index 2982459..d98c8fb 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/fs/SpaceAwareVolumeChooser.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/fs/SpaceAwareVolumeChooser.java
@@ -51,7 +51,7 @@ public class SpaceAwareVolumeChooser extends PreferredVolumeChooser {
 
   // Default time to wait in ms. Defaults to 5 min
   private long defaultComputationCacheDuration = 300000;
-  LoadingCache<List<String>,WeightedRandomCollection> choiceCache = null;
+  private LoadingCache<List<String>,WeightedRandomCollection> choiceCache = null;
 
   private static final Logger log = LoggerFactory.getLogger(SpaceAwareVolumeChooser.class);
 
@@ -83,8 +83,9 @@ public class SpaceAwareVolumeChooser extends PreferredVolumeChooser {
       choiceCache = CacheBuilder.newBuilder()
           .expireAfterWrite(computationCacheDuration, TimeUnit.MILLISECONDS)
           .build(new CacheLoader<List<String>,WeightedRandomCollection>() {
+            @Override
             public WeightedRandomCollection load(List<String> key) {
-              return new WeightedRandomCollection(key, env);
+              return new WeightedRandomCollection(key, env, random);
             }
           });
     }
@@ -92,13 +93,14 @@ public class SpaceAwareVolumeChooser extends PreferredVolumeChooser {
     return choiceCache;
   }
 
-  public class WeightedRandomCollection {
-    private final NavigableMap<Double,String> map = new TreeMap<Double,String>();
+  private static class WeightedRandomCollection {
+    private final NavigableMap<Double,String> map = new TreeMap<>();
     private final Random random;
     private double total = 0;
 
-    public WeightedRandomCollection(List<String> options, VolumeChooserEnvironment env) {
-      this.random = new Random();
+    public WeightedRandomCollection(List<String> options, VolumeChooserEnvironment env,
+        Random random) {
+      this.random = random;
 
       if (options.size() < 1) {
         throw new IllegalStateException("Options was empty! No valid volumes to choose from.");
diff --git a/server/base/src/main/java/org/apache/accumulo/server/fs/VolumeUtil.java b/server/base/src/main/java/org/apache/accumulo/server/fs/VolumeUtil.java
index d676af5..4949566 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/fs/VolumeUtil.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/fs/VolumeUtil.java
@@ -32,6 +32,7 @@ import org.apache.accumulo.core.protobuf.ProtobufUtil;
 import org.apache.accumulo.core.tabletserver.log.LogEntry;
 import org.apache.accumulo.core.util.CachedConfiguration;
 import org.apache.accumulo.core.util.Pair;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.server.ServerConstants;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.fs.VolumeManager.FileType;
@@ -39,7 +40,6 @@ import org.apache.accumulo.server.replication.StatusUtil;
 import org.apache.accumulo.server.replication.proto.Replication.Status;
 import org.apache.accumulo.server.util.MetadataTableUtil;
 import org.apache.accumulo.server.util.ReplicationTableUtil;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.apache.commons.codec.digest.DigestUtils;
 import org.apache.hadoop.fs.FSDataInputStream;
 import org.apache.hadoop.fs.FileStatus;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/init/Initialize.java b/server/base/src/main/java/org/apache/accumulo/server/init/Initialize.java
index dd95fe8..5150cc3 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/init/Initialize.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/init/Initialize.java
@@ -77,7 +77,8 @@ import org.apache.accumulo.core.util.ColumnFQ;
 import org.apache.accumulo.core.util.LocalityGroupUtil;
 import org.apache.accumulo.core.util.Pair;
 import org.apache.accumulo.core.volume.VolumeConfiguration;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.Accumulo;
@@ -99,7 +100,6 @@ import org.apache.accumulo.server.tablets.TabletTime;
 import org.apache.accumulo.server.util.ReplicationTableUtil;
 import org.apache.accumulo.server.util.SystemPropUtil;
 import org.apache.accumulo.server.util.TablePropUtil;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.start.spi.KeywordExecutable;
 import org.apache.commons.lang.StringUtils;
 import org.apache.hadoop.conf.Configuration;
@@ -118,12 +118,14 @@ import com.beust.jcommander.Parameter;
 import com.google.auto.service.AutoService;
 import com.google.common.base.Joiner;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import jline.console.ConsoleReader;
 
 /**
  * This class is used to setup the directory structure and the root tablet to get an instance
  * started
  */
+@SuppressFBWarnings(value = "DM_EXIT", justification = "CLI utility can exit")
 @AutoService(KeywordExecutable.class)
 public class Initialize implements KeywordExecutable {
   private static final Logger log = LoggerFactory.getLogger(Initialize.class);
diff --git a/server/base/src/main/java/org/apache/accumulo/server/iterators/MetadataBulkLoadFilter.java b/server/base/src/main/java/org/apache/accumulo/server/iterators/MetadataBulkLoadFilter.java
index c5980ae..d46b2a7 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/iterators/MetadataBulkLoadFilter.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/iterators/MetadataBulkLoadFilter.java
@@ -28,8 +28,8 @@ import org.apache.accumulo.core.iterators.IteratorEnvironment;
 import org.apache.accumulo.core.iterators.IteratorUtil.IteratorScope;
 import org.apache.accumulo.core.iterators.SortedKeyValueIterator;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection;
-import org.apache.accumulo.fate.zookeeper.TransactionWatcher.Arbitrator;
 import org.apache.accumulo.server.ServerContext;
+import org.apache.accumulo.server.zookeeper.TransactionWatcher.Arbitrator;
 import org.apache.accumulo.server.zookeeper.TransactionWatcher.ZooArbitrator;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/log/WalStateManager.java b/server/base/src/main/java/org/apache/accumulo/server/log/WalStateManager.java
index 765c70f..961f3e3 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/log/WalStateManager.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/log/WalStateManager.java
@@ -27,11 +27,11 @@ import java.util.UUID;
 
 import org.apache.accumulo.core.client.impl.ClientContext;
 import org.apache.accumulo.core.util.Pair;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.master.state.TServerInstance;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.hadoop.fs.Path;
 import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/master/LiveTServerSet.java b/server/base/src/main/java/org/apache/accumulo/server/master/LiveTServerSet.java
index 97e57e2..30590fd 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/master/LiveTServerSet.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/master/LiveTServerSet.java
@@ -39,13 +39,13 @@ import org.apache.accumulo.core.trace.Tracer;
 import org.apache.accumulo.core.util.AddressUtil;
 import org.apache.accumulo.core.util.HostAndPort;
 import org.apache.accumulo.core.util.ServerServices;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooCache.ZcStat;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.master.state.TServerInstance;
 import org.apache.accumulo.server.util.Halt;
 import org.apache.accumulo.server.util.time.SimpleTimer;
-import org.apache.accumulo.server.zookeeper.ZooCache;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.apache.hadoop.io.Text;
 import org.apache.thrift.TException;
 import org.apache.thrift.transport.TTransport;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/master/state/DeadServerList.java b/server/base/src/main/java/org/apache/accumulo/server/master/state/DeadServerList.java
index 0d27c01..e83de0e 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/master/state/DeadServerList.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/master/state/DeadServerList.java
@@ -22,10 +22,10 @@ import java.util.ArrayList;
 import java.util.List;
 
 import org.apache.accumulo.core.master.thrift.DeadServer;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException.NoNodeException;
 import org.apache.zookeeper.data.Stat;
 import org.slf4j.Logger;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/master/state/ZooStore.java b/server/base/src/main/java/org/apache/accumulo/server/master/state/ZooStore.java
index 44c5ac8..f7e1cc8 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/master/state/ZooStore.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/master/state/ZooStore.java
@@ -22,10 +22,10 @@ import java.io.IOException;
 import java.util.List;
 
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -39,7 +39,7 @@ public class ZooStore implements DistributedStore {
 
   public ZooStore(ServerContext context) throws IOException {
     this.context = context;
-    cache = new ZooCache(context);
+    cache = new ZooCache(context.getZooReaderWriter(), null);
     String zkRoot = context.getZooKeeperRoot();
     if (zkRoot.endsWith("/"))
       zkRoot = zkRoot.substring(0, zkRoot.length() - 1);
diff --git a/server/base/src/main/java/org/apache/accumulo/server/metrics/AbstractMetricsImpl.java b/server/base/src/main/java/org/apache/accumulo/server/metrics/AbstractMetricsImpl.java
index 23df00c..0e76fa0 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/metrics/AbstractMetricsImpl.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/metrics/AbstractMetricsImpl.java
@@ -36,6 +36,8 @@ import org.apache.commons.lang.builder.ToStringBuilder;
 import org.apache.commons.lang.builder.ToStringStyle;
 import org.apache.commons.lang.time.DateUtils;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public abstract class AbstractMetricsImpl implements Metrics {
 
   public static class Metric {
@@ -164,6 +166,7 @@ public abstract class AbstractMetricsImpl implements Metrics {
     return registry.get(name).getMax();
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by admin")
   private void setupLogging() throws IOException {
     if (null == config.getMetricsConfiguration())
       return;
@@ -185,6 +188,7 @@ public abstract class AbstractMetricsImpl implements Metrics {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by admin")
   private void startNewLog() throws IOException {
     if (null != logWriter) {
       logWriter.flush();
diff --git a/server/base/src/main/java/org/apache/accumulo/server/monitor/LogService.java b/server/base/src/main/java/org/apache/accumulo/server/monitor/LogService.java
index be7fe3b..68b8aa7 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/monitor/LogService.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/monitor/LogService.java
@@ -19,6 +19,7 @@ package org.apache.accumulo.server.monitor;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
 import java.io.IOException;
+import java.io.UncheckedIOException;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.util.ArrayList;
@@ -30,8 +31,8 @@ import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.util.Daemon;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.log4j.LogManager;
 import org.apache.log4j.net.SocketNode;
 import org.apache.log4j.spi.LoggingEvent;
@@ -39,6 +40,8 @@ import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Hijack log4j and capture log events for display.
  */
@@ -52,11 +55,15 @@ public class LogService extends org.apache.log4j.AppenderSkeleton {
   static class SocketServer implements Runnable {
     private ServerSocket server = null;
 
+    @SuppressFBWarnings(value = "UNENCRYPTED_SERVER_SOCKET",
+        justification = "not obvious what credentials could be used to set up this log receiver"
+            + " socket in order to encrypt it, in case of errors; should probably remove this "
+            + "socket appender in the future and force users to watch their system logs")
     public SocketServer(int port) {
       try {
         server = new ServerSocket(port);
       } catch (IOException io) {
-        throw new RuntimeException(io);
+        throw new UncheckedIOException(io);
       }
     }
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/problems/ProblemReport.java b/server/base/src/main/java/org/apache/accumulo/server/problems/ProblemReport.java
index baf0da8..f32f458 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/problems/ProblemReport.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/problems/ProblemReport.java
@@ -33,11 +33,11 @@ import org.apache.accumulo.core.data.Key;
 import org.apache.accumulo.core.data.Mutation;
 import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.util.Encoding;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.util.MetadataTableUtil;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.hadoop.io.Text;
 import org.apache.zookeeper.KeeperException;
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/replication/ReplicationUtil.java b/server/base/src/main/java/org/apache/accumulo/server/replication/ReplicationUtil.java
index aa6079a..8a3fce5 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/replication/ReplicationUtil.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/replication/ReplicationUtil.java
@@ -47,10 +47,10 @@ import org.apache.accumulo.core.replication.ReplicationTable;
 import org.apache.accumulo.core.replication.ReplicationTableOfflineException;
 import org.apache.accumulo.core.replication.ReplicationTarget;
 import org.apache.accumulo.core.security.Authorizations;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.conf.TableConfiguration;
 import org.apache.accumulo.server.replication.proto.Replication.Status;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.io.Text;
 import org.slf4j.Logger;
@@ -68,7 +68,7 @@ public class ReplicationUtil {
   private final ReplicaSystemFactory factory;
 
   public ReplicationUtil(ServerContext context) {
-    this(context, new ZooCache(context), new ReplicaSystemFactory());
+    this(context, new ZooCache(context.getZooReaderWriter(), null), new ReplicaSystemFactory());
   }
 
   public ReplicationUtil(ServerContext context, ZooCache cache, ReplicaSystemFactory factory) {
diff --git a/server/base/src/main/java/org/apache/accumulo/server/replication/ZooKeeperInitialization.java b/server/base/src/main/java/org/apache/accumulo/server/replication/ZooKeeperInitialization.java
index 69555cf..ef0abdd 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/replication/ZooKeeperInitialization.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/replication/ZooKeeperInitialization.java
@@ -17,7 +17,7 @@
 package org.apache.accumulo.server.replication;
 
 import org.apache.accumulo.core.replication.ReplicationConstants;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException;
 
 /**
diff --git a/server/base/src/main/java/org/apache/accumulo/server/replication/proto/Replication.java b/server/base/src/main/java/org/apache/accumulo/server/replication/proto/Replication.java
index 534a2af..6a87080 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/replication/proto/Replication.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/replication/proto/Replication.java
@@ -139,7 +139,7 @@ package org.apache.accumulo.server.replication.proto;
       return defaultInstance;
     }
 
-    private final com.google.protobuf.UnknownFieldSet unknownFields;
+    private final transient com.google.protobuf.UnknownFieldSet unknownFields;
     @java.lang.Override
     public final com.google.protobuf.UnknownFieldSet
         getUnknownFields() {
@@ -217,7 +217,7 @@ package org.apache.accumulo.server.replication.proto;
               org.apache.accumulo.server.replication.proto.Replication.Status.class, org.apache.accumulo.server.replication.proto.Replication.Status.Builder.class);
     }
 
-    public static com.google.protobuf.Parser<Status> PARSER =
+    public static final com.google.protobuf.Parser<Status> PARSER =
         new com.google.protobuf.AbstractParser<Status>() {
       public Status parsePartialFrom(
           com.google.protobuf.CodedInputStream input,
diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java b/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
index 2ad5d3a..59e5dcc 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
@@ -47,6 +47,7 @@ import org.apache.accumulo.core.security.NamespacePermission;
 import org.apache.accumulo.core.security.SystemPermission;
 import org.apache.accumulo.core.security.TablePermission;
 import org.apache.accumulo.core.security.thrift.TCredentials;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.security.handler.Authenticator;
 import org.apache.accumulo.server.security.handler.Authorizor;
@@ -55,7 +56,6 @@ import org.apache.accumulo.server.security.handler.PermissionHandler;
 import org.apache.accumulo.server.security.handler.ZKAuthenticator;
 import org.apache.accumulo.server.security.handler.ZKAuthorizor;
 import org.apache.accumulo.server.security.handler.ZKPermHandler;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.hadoop.io.Text;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -113,7 +113,7 @@ public class SecurityOperation {
   protected SecurityOperation(ServerContext context) {
     this.context = context;
     ZKUserPath = Constants.ZROOT + "/" + context.getInstanceID() + "/users";
-    zooCache = new ZooCache(context);
+    zooCache = new ZooCache(context.getZooReaderWriter(), null);
   }
 
   public SecurityOperation(ServerContext context, Authorizor author, Authenticator authent,
diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/delegation/ZooAuthenticationKeyDistributor.java b/server/base/src/main/java/org/apache/accumulo/server/security/delegation/ZooAuthenticationKeyDistributor.java
index 15c1f9c..e822f13 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/delegation/ZooAuthenticationKeyDistributor.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/delegation/ZooAuthenticationKeyDistributor.java
@@ -29,9 +29,9 @@ import java.util.Collections;
 import java.util.List;
 import java.util.concurrent.atomic.AtomicBoolean;
 
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/handler/KerberosAuthenticator.java b/server/base/src/main/java/org/apache/accumulo/server/security/handler/KerberosAuthenticator.java
index 01561af..8024642 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/handler/KerberosAuthenticator.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/handler/KerberosAuthenticator.java
@@ -32,6 +32,7 @@ import org.apache.accumulo.core.client.security.tokens.AuthenticationToken;
 import org.apache.accumulo.core.client.security.tokens.KerberosToken;
 import org.apache.accumulo.core.security.thrift.TCredentials;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
@@ -39,7 +40,6 @@ import org.apache.accumulo.server.rpc.UGIAssumingProcessor;
 import org.apache.accumulo.server.security.SystemCredentials.SystemToken;
 import org.apache.accumulo.server.security.UserImpersonation;
 import org.apache.accumulo.server.security.UserImpersonation.UsersWithHosts;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -63,7 +63,7 @@ public class KerberosAuthenticator implements Authenticator {
   @Override
   public void initialize(ServerContext context, boolean initialize) {
     this.context = context;
-    zooCache = new ZooCache(context);
+    zooCache = new ZooCache(context.getZooReaderWriter(), null);
     impersonation = new UserImpersonation(context.getConfiguration());
     zkAuthenticator.initialize(context, initialize);
     zkUserPath = Constants.ZROOT + "/" + context.getInstanceID() + "/users";
diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKAuthenticator.java b/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKAuthenticator.java
index 862ca13..de69dce 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKAuthenticator.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKAuthenticator.java
@@ -30,10 +30,10 @@ import org.apache.accumulo.core.client.security.tokens.AuthenticationToken;
 import org.apache.accumulo.core.client.security.tokens.PasswordToken;
 import org.apache.accumulo.core.security.thrift.TCredentials;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -56,7 +56,7 @@ public final class ZKAuthenticator implements Authenticator {
   @Override
   public void initialize(ServerContext context, boolean initialize) {
     this.context = context;
-    zooCache = new ZooCache(context);
+    zooCache = new ZooCache(context.getZooReaderWriter(), null);
     ZKUserPath = Constants.ZROOT + "/" + context.getInstanceID() + "/users";
   }
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKAuthorizor.java b/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKAuthorizor.java
index 12bbcd9..5a088e4 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKAuthorizor.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKAuthorizor.java
@@ -37,11 +37,11 @@ import org.apache.accumulo.core.security.TablePermission;
 import org.apache.accumulo.core.security.thrift.TCredentials;
 import org.apache.accumulo.core.util.ByteBufferUtil;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooCache;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -65,7 +65,7 @@ public class ZKAuthorizor implements Authorizor {
   @Override
   public void initialize(ServerContext context, boolean initialize) {
     this.context = context;
-    zooCache = new ZooCache(context);
+    zooCache = new ZooCache(context.getZooReaderWriter(), null);
     ZKUserPath = ZKSecurityTool.getInstancePath(context.getInstanceID()) + "/users";
   }
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKPermHandler.java b/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKPermHandler.java
index 6cf77d3..2682313 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKPermHandler.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/handler/ZKPermHandler.java
@@ -37,11 +37,11 @@ import org.apache.accumulo.core.security.NamespacePermission;
 import org.apache.accumulo.core.security.SystemPermission;
 import org.apache.accumulo.core.security.TablePermission;
 import org.apache.accumulo.core.security.thrift.TCredentials;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooCache;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
 import org.slf4j.Logger;
@@ -68,7 +68,7 @@ public class ZKPermHandler implements PermissionHandler {
 
   @Override
   public void initialize(ServerContext context, boolean initialize) {
-    zooCache = new ZooCache(context);
+    zooCache = new ZooCache(context.getZooReaderWriter(), null);
     zoo = context.getZooReaderWriter();
     String instanceId = context.getInstanceID();
     ZKUserPath = ZKSecurityTool.getInstancePath(instanceId) + "/users";
diff --git a/server/base/src/main/java/org/apache/accumulo/server/tables/TableManager.java b/server/base/src/main/java/org/apache/accumulo/server/tables/TableManager.java
index b563f03..dcbe8b6 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/tables/TableManager.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/tables/TableManager.java
@@ -32,15 +32,15 @@ import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.client.impl.Tables;
 import org.apache.accumulo.core.master.state.tables.TableState;
 import org.apache.accumulo.core.util.Pair;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter.Mutator;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.util.TablePropUtil;
-import org.apache.accumulo.server.zookeeper.ZooCache;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.commons.lang.StringUtils;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/tablets/UniqueNameAllocator.java b/server/base/src/main/java/org/apache/accumulo/server/tablets/UniqueNameAllocator.java
index df14335..ae5d6d8 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/tablets/UniqueNameAllocator.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/tablets/UniqueNameAllocator.java
@@ -23,9 +23,9 @@ import java.util.Random;
 
 import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.util.FastFormat;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 
 /**
  * Allocates unique names for an accumulo instance. The names are unique for the lifetime of the
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/Admin.java b/server/base/src/main/java/org/apache/accumulo/server/util/Admin.java
index c401b86..8fbbae3 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/Admin.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/Admin.java
@@ -55,7 +55,7 @@ import org.apache.accumulo.core.util.HostAndPort;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.accumulo.server.security.SecurityUtil;
 import org.apache.accumulo.start.spi.KeywordExecutable;
 import org.apache.zookeeper.KeeperException;
@@ -68,11 +68,13 @@ import com.beust.jcommander.Parameters;
 import com.google.auto.service.AutoService;
 import com.google.common.collect.Lists;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 @AutoService(KeywordExecutable.class)
 public class Admin implements KeywordExecutable {
   private static final Logger log = LoggerFactory.getLogger(Admin.class);
 
-  static class AdminOpts extends ClientOpts {
+  static class AdminOpts extends ServerUtilOpts {
     @Parameter(names = {"-f", "--force"},
         description = "force the given server to stop by removing its lock")
     boolean force = false;
@@ -164,6 +166,7 @@ public class Admin implements KeywordExecutable {
     return "Executes administrative commands";
   }
 
+  @SuppressFBWarnings(value = "DM_EXIT", justification = "System.exit okay for CLI tool")
   @Override
   public void execute(final String[] args) {
     boolean everything;
@@ -434,6 +437,8 @@ public class Admin implements KeywordExecutable {
   private Map<String,String> siteConfig, systemConfig;
   private List<String> localUsers;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input")
   public void printConfig(ClientContext context, DumpConfigCommand opts) throws Exception {
 
     File outputDirectory = null;
@@ -510,6 +515,8 @@ public class Admin implements KeywordExecutable {
     return defaultValue;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input")
   private void printNameSpaceConfiguration(AccumuloClient accumuloClient, String namespace,
       File outputDirectory)
       throws IOException, AccumuloException, AccumuloSecurityException, NamespaceNotFoundException {
@@ -533,6 +540,8 @@ public class Admin implements KeywordExecutable {
     nsWriter.close();
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input")
   private static void printUserConfiguration(AccumuloClient accumuloClient, String user,
       File outputDirectory) throws IOException, AccumuloException, AccumuloSecurityException {
     File userScript = new File(outputDirectory, user + USER_FILE_SUFFIX);
@@ -588,6 +597,8 @@ public class Admin implements KeywordExecutable {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input")
   private void printTableConfiguration(AccumuloClient accumuloClient, String tableName,
       File outputDirectory)
       throws AccumuloException, TableNotFoundException, IOException, AccumuloSecurityException {
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/ChangeSecret.java b/server/base/src/main/java/org/apache/accumulo/server/util/ChangeSecret.java
index d6e47c7..0c3c4a9 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/ChangeSecret.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/ChangeSecret.java
@@ -28,14 +28,14 @@ import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.core.volume.Volume;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooReader;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerConstants;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.accumulo.server.fs.VolumeManagerImpl;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.hadoop.fs.FileStatus;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.fs.permission.FsAction;
@@ -49,7 +49,7 @@ import com.beust.jcommander.Parameter;
 
 public class ChangeSecret {
 
-  static class Opts extends ClientOpts {
+  static class Opts extends ServerUtilOpts {
     @Parameter(names = "--old", description = "old zookeeper password", password = true,
         hidden = true)
     String oldPass;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/CheckForMetadataProblems.java b/server/base/src/main/java/org/apache/accumulo/server/util/CheckForMetadataProblems.java
index 58e0b23..a0617a5 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/CheckForMetadataProblems.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/CheckForMetadataProblems.java
@@ -33,14 +33,14 @@ import org.apache.accumulo.core.metadata.RootTable;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection;
 import org.apache.accumulo.core.security.Authorizations;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.hadoop.io.Text;
 
 public class CheckForMetadataProblems {
   private static boolean sawProblems = false;
 
-  public static void checkTable(String tablename, TreeSet<KeyExtent> tablets, ClientOpts opts)
+  public static void checkTable(String tablename, TreeSet<KeyExtent> tablets, ServerUtilOpts opts)
       throws AccumuloSecurityException {
     // sanity check of metadata table entries
     // make sure tablets has no holes, and that it starts and ends w/ null
@@ -92,7 +92,7 @@ public class CheckForMetadataProblems {
       sawProblems = true;
   }
 
-  public static void checkMetadataAndRootTableEntries(String tableNameToCheck, ClientOpts opts,
+  public static void checkMetadataAndRootTableEntries(String tableNameToCheck, ServerUtilOpts opts,
       VolumeManager fs) throws Exception {
     System.out.println("Checking table: " + tableNameToCheck);
     Map<String,TreeSet<KeyExtent>> tables = new HashMap<>();
@@ -165,7 +165,7 @@ public class CheckForMetadataProblems {
   }
 
   public static void main(String[] args) throws Exception {
-    ClientOpts opts = new ClientOpts();
+    ServerUtilOpts opts = new ServerUtilOpts();
     opts.parseArgs(CheckForMetadataProblems.class.getName(), args);
 
     VolumeManager fs = opts.getServerContext().getVolumeManager();
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/ConvertConfig.java b/server/base/src/main/java/org/apache/accumulo/server/util/ConvertConfig.java
index fff775e..11cf2f5 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/ConvertConfig.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/ConvertConfig.java
@@ -33,6 +33,8 @@ import org.apache.hadoop.conf.Configuration;
 import com.beust.jcommander.Parameter;
 import com.google.auto.service.AutoService;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 @AutoService(KeywordExecutable.class)
 public class ConvertConfig implements KeywordExecutable {
 
@@ -70,6 +72,8 @@ public class ConvertConfig implements KeywordExecutable {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input")
   @Override
   public void execute(String[] args) throws Exception {
     Opts opts = new Opts();
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/DeleteZooInstance.java b/server/base/src/main/java/org/apache/accumulo/server/util/DeleteZooInstance.java
index c40708d..de06b32 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/DeleteZooInstance.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/DeleteZooInstance.java
@@ -25,8 +25,8 @@ import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.cli.Help;
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException;
 
 import com.beust.jcommander.Parameter;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/DumpZookeeper.java b/server/base/src/main/java/org/apache/accumulo/server/util/DumpZookeeper.java
index 22fcbd7..a27de3b 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/DumpZookeeper.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/DumpZookeeper.java
@@ -25,7 +25,7 @@ import java.util.Base64;
 import org.apache.accumulo.core.cli.Help;
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.log4j.Level;
 import org.apache.log4j.Logger;
 import org.apache.zookeeper.KeeperException;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/FileSystemMonitor.java b/server/base/src/main/java/org/apache/accumulo/server/util/FileSystemMonitor.java
index 9156279..4792e2c 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/FileSystemMonitor.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/FileSystemMonitor.java
@@ -37,6 +37,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.Sets;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class FileSystemMonitor {
   private static final String PROC_MOUNTS = "/proc/mounts";
   private static final Logger log = LoggerFactory.getLogger(FileSystemMonitor.class);
@@ -68,6 +70,8 @@ public class FileSystemMonitor {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "procFile path not from user input")
   static List<Mount> parse(String procFile) throws IOException {
 
     FileReader fr = new FileReader(procFile);
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/FindOfflineTablets.java b/server/base/src/main/java/org/apache/accumulo/server/util/FindOfflineTablets.java
index 4cade6c..277e2a3 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/FindOfflineTablets.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/FindOfflineTablets.java
@@ -31,7 +31,7 @@ import org.apache.accumulo.core.metadata.MetadataTable;
 import org.apache.accumulo.core.metadata.RootTable;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.accumulo.server.master.LiveTServerSet;
 import org.apache.accumulo.server.master.LiveTServerSet.Listener;
 import org.apache.accumulo.server.master.state.DistributedStoreException;
@@ -47,7 +47,7 @@ public class FindOfflineTablets {
   private static final Logger log = LoggerFactory.getLogger(FindOfflineTablets.class);
 
   public static void main(String[] args) throws Exception {
-    ClientOpts opts = new ClientOpts();
+    ServerUtilOpts opts = new ServerUtilOpts();
     opts.parseArgs(FindOfflineTablets.class.getName(), args);
     ServerContext context = opts.getServerContext();
     findOffline(context, null);
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/ListInstances.java b/server/base/src/main/java/org/apache/accumulo/server/util/ListInstances.java
index 081ca5c..17c8798 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/ListInstances.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/ListInstances.java
@@ -31,8 +31,8 @@ import org.apache.accumulo.core.cli.Help;
 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooReader;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/LocalityCheck.java b/server/base/src/main/java/org/apache/accumulo/server/util/LocalityCheck.java
index 1ff1256..261a0f5 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/LocalityCheck.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/LocalityCheck.java
@@ -31,7 +31,7 @@ import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.DataFileColumnFamily;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.util.HostAndPort;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.hadoop.fs.BlockLocation;
 import org.apache.hadoop.fs.FileStatus;
@@ -41,7 +41,7 @@ import org.apache.hadoop.fs.Path;
 public class LocalityCheck {
 
   public int run(String[] args) throws Exception {
-    ClientOpts opts = new ClientOpts();
+    ServerUtilOpts opts = new ServerUtilOpts();
     opts.parseArgs(LocalityCheck.class.getName(), args);
 
     VolumeManager fs = opts.getServerContext().getVolumeManager();
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/MasterMetadataUtil.java b/server/base/src/main/java/org/apache/accumulo/server/util/MasterMetadataUtil.java
index 2e86ba5..d143bb0 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/MasterMetadataUtil.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/MasterMetadataUtil.java
@@ -50,11 +50,11 @@ import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.Sc
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.util.ColumnFQ;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.fs.FileRef;
 import org.apache.accumulo.server.master.state.TServerInstance;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.apache.hadoop.io.Text;
 import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/MetadataTableUtil.java b/server/base/src/main/java/org/apache/accumulo/server/util/MetadataTableUtil.java
index 2951ed8..87cead9 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/MetadataTableUtil.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/MetadataTableUtil.java
@@ -80,6 +80,7 @@ import org.apache.accumulo.core.util.ColumnFQ;
 import org.apache.accumulo.core.util.FastFormat;
 import org.apache.accumulo.core.util.Pair;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerConstants;
@@ -88,7 +89,6 @@ import org.apache.accumulo.server.fs.FileRef;
 import org.apache.accumulo.server.fs.VolumeChooserEnvironment;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.accumulo.server.tablets.TabletTime;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.apache.hadoop.fs.FileStatus;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.io.Text;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/PortUtils.java b/server/base/src/main/java/org/apache/accumulo/server/util/PortUtils.java
index a03e626..8081dd3 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/PortUtils.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/PortUtils.java
@@ -19,8 +19,12 @@ package org.apache.accumulo.server.util;
 import java.io.IOException;
 import java.net.ServerSocket;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class PortUtils {
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SERVER_SOCKET",
+      justification = "this just reserves a port and doesn't need to be encrypted")
   public static int getRandomFreePort() {
     int count = 0;
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/RandomWriter.java b/server/base/src/main/java/org/apache/accumulo/server/util/RandomWriter.java
index 4c333d7..7fc3568 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/RandomWriter.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/RandomWriter.java
@@ -21,11 +21,11 @@ import java.util.Iterator;
 import java.util.Random;
 
 import org.apache.accumulo.core.cli.BatchWriterOpts;
+import org.apache.accumulo.core.cli.ClientOnDefaultTable;
 import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.BatchWriter;
 import org.apache.accumulo.core.data.Mutation;
 import org.apache.accumulo.core.data.Value;
-import org.apache.accumulo.server.cli.ClientOnDefaultTable;
 import org.apache.hadoop.io.Text;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -94,6 +94,7 @@ public class RandomWriter {
 
   public static void main(String[] args) throws Exception {
     Opts opts = new Opts(table_name);
+    opts.setPrincipal("root");
     BatchWriterOpts bwOpts = new BatchWriterOpts();
     opts.parseArgs(RandomWriter.class.getName(), args, bwOpts);
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/RandomizeVolumes.java b/server/base/src/main/java/org/apache/accumulo/server/util/RandomizeVolumes.java
index d5d2326..e56a506 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/RandomizeVolumes.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/RandomizeVolumes.java
@@ -40,7 +40,7 @@ import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.util.SimpleThreadPool;
 import org.apache.accumulo.server.ServerConstants;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.cli.ClientOnRequiredTable;
+import org.apache.accumulo.server.cli.ServerUtilOnRequiredTable;
 import org.apache.accumulo.server.fs.VolumeChooserEnvironment;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.hadoop.fs.Path;
@@ -51,7 +51,7 @@ public class RandomizeVolumes {
   private static final Logger log = LoggerFactory.getLogger(RandomizeVolumes.class);
 
   public static void main(String[] args) throws AccumuloException, AccumuloSecurityException {
-    ClientOnRequiredTable opts = new ClientOnRequiredTable();
+    ServerUtilOnRequiredTable opts = new ServerUtilOnRequiredTable();
     opts.parseArgs(RandomizeVolumes.class.getName(), args);
     ServerContext context = opts.getServerContext();
     AccumuloClient c;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/RemoveEntriesForMissingFiles.java b/server/base/src/main/java/org/apache/accumulo/server/util/RemoveEntriesForMissingFiles.java
index 2b7d114..25958f8 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/RemoveEntriesForMissingFiles.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/RemoveEntriesForMissingFiles.java
@@ -45,7 +45,7 @@ import org.apache.accumulo.core.metadata.schema.MetadataSchema;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.DataFileColumnFamily;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.commons.collections.map.LRUMap;
 import org.apache.hadoop.fs.Path;
@@ -57,7 +57,7 @@ import com.beust.jcommander.Parameter;
  */
 public class RemoveEntriesForMissingFiles {
 
-  static class Opts extends ClientOpts {
+  static class Opts extends ServerUtilOpts {
     @Parameter(names = "--fix")
     boolean fix = false;
   }
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/RestoreZookeeper.java b/server/base/src/main/java/org/apache/accumulo/server/util/RestoreZookeeper.java
index d25b98e..5f781cf 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/RestoreZookeeper.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/RestoreZookeeper.java
@@ -29,8 +29,8 @@ import javax.xml.parsers.SAXParserFactory;
 import org.apache.accumulo.core.cli.Help;
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.log4j.Level;
 import org.apache.log4j.Logger;
 import org.apache.zookeeper.KeeperException;
@@ -40,6 +40,8 @@ import org.xml.sax.helpers.DefaultHandler;
 
 import com.beust.jcommander.Parameter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class RestoreZookeeper {
 
   private static class Restore extends DefaultHandler {
@@ -110,6 +112,8 @@ public class RestoreZookeeper {
     String file;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "code runs in same security context as user who provided input")
   public static void main(String[] args) throws Exception {
     Logger.getRootLogger().setLevel(Level.WARN);
     Opts opts = new Opts();
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/SendLogToChainsaw.java b/server/base/src/main/java/org/apache/accumulo/server/util/SendLogToChainsaw.java
deleted file mode 100644
index cd855c0..0000000
--- a/server/base/src/main/java/org/apache/accumulo/server/util/SendLogToChainsaw.java
+++ /dev/null
@@ -1,281 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.server.util;
-
-import static java.nio.charset.StandardCharsets.UTF_8;
-
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.FilenameFilter;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.io.UnsupportedEncodingException;
-import java.net.Socket;
-import java.net.URLEncoder;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
-import java.util.Calendar;
-import java.util.Date;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-import javax.net.SocketFactory;
-
-import org.apache.accumulo.core.cli.Help;
-import org.apache.commons.io.filefilter.WildcardFileFilter;
-import org.apache.commons.lang.math.LongRange;
-import org.apache.log4j.Category;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.spi.Filter;
-import org.apache.log4j.spi.LoggingEvent;
-import org.apache.log4j.varia.LevelRangeFilter;
-import org.apache.log4j.xml.XMLLayout;
-
-import com.beust.jcommander.IStringConverter;
-import com.beust.jcommander.Parameter;
-
-public class SendLogToChainsaw extends XMLLayout {
-
-  private static Pattern logPattern = Pattern
-      .compile("^(\\d\\d)\\s(\\d\\d):(\\d\\d):(\\d\\d),(\\d\\d\\d)\\s\\[(.*)\\]\\s"
-          + "(TRACE|DEBUG|INFO|WARN|FATAL|ERROR)\\s*?:(.*)$", Pattern.UNIX_LINES);
-
-  private File[] logFiles = null;
-
-  private SocketFactory factory = SocketFactory.getDefault();
-
-  private WildcardFileFilter fileFilter = null;
-
-  private Socket socket = null;
-
-  private Pattern lineFilter = null;
-
-  private LongRange dateFilter = null;
-
-  private LevelRangeFilter levelFilter = null;
-
-  public SendLogToChainsaw(String directory, String fileNameFilter, String host, int port,
-      Date start, Date end, String regex, String level) throws Exception {
-
-    // Set up the file name filter
-    if (null != fileNameFilter) {
-      fileFilter = new WildcardFileFilter(fileNameFilter);
-    } else {
-      fileFilter = new WildcardFileFilter("*");
-    }
-
-    // Get the list of files that match
-    File dir = new File(directory);
-    if (dir.isDirectory()) {
-      logFiles = dir.listFiles((FilenameFilter) fileFilter);
-    } else {
-      throw new IllegalArgumentException(directory + " is not a directory or is not readable.");
-    }
-
-    if (logFiles == null || logFiles.length == 0) {
-      throw new IllegalArgumentException("No files match the supplied filter.");
-    }
-
-    socket = factory.createSocket(host, port);
-
-    lineFilter = Pattern.compile(regex);
-
-    // Create Date Filter
-    if (null != start) {
-      if (end == null)
-        end = new Date(System.currentTimeMillis());
-      dateFilter = new LongRange(start.getTime(), end.getTime());
-    }
-
-    if (null != level) {
-      Level base = Level.toLevel(level.toUpperCase());
-      levelFilter = new LevelRangeFilter();
-      levelFilter.setAcceptOnMatch(true);
-      levelFilter.setLevelMin(base);
-      levelFilter.setLevelMax(Level.FATAL);
-    }
-  }
-
-  public void processLogFiles() throws IOException {
-    String line = null;
-    String out = null;
-    BufferedReader reader = null;
-    try {
-      for (File log : logFiles) {
-        // Parse the server type and name from the log file name
-        String threadName = log.getName().substring(0, log.getName().indexOf("."));
-        FileInputStream fis;
-        try {
-          fis = new FileInputStream(log);
-        } catch (FileNotFoundException e) {
-          System.out.println("Unable to find file: " + log.getAbsolutePath());
-          throw e;
-        }
-        reader = new BufferedReader(new InputStreamReader(fis, UTF_8));
-
-        try {
-          line = reader.readLine();
-          while (null != line) {
-            out = convertLine(line, threadName);
-            if (null != out) {
-              if (socket != null && socket.isConnected())
-                socket.getOutputStream().write(out.getBytes(UTF_8));
-              else
-                System.err.println("Unable to send data to transport");
-            }
-            line = reader.readLine();
-          }
-        } catch (IOException e) {
-          System.out.println("Error processing line: " + line + ". Output was " + out);
-          throw e;
-        } finally {
-          if (reader != null) {
-            reader.close();
-          }
-        }
-      }
-    } finally {
-      if (socket != null && socket.isConnected()) {
-        socket.close();
-      }
-    }
-  }
-
-  private String convertLine(String line, String threadName) throws UnsupportedEncodingException {
-    String result = null;
-    Matcher m = logPattern.matcher(line);
-    if (m.matches()) {
-
-      Calendar cal = Calendar.getInstance();
-      cal.setTime(new Date(System.currentTimeMillis()));
-      Integer date = Integer.parseInt(m.group(1));
-      Integer hour = Integer.parseInt(m.group(2));
-      Integer min = Integer.parseInt(m.group(3));
-      Integer sec = Integer.parseInt(m.group(4));
-      Integer ms = Integer.parseInt(m.group(5));
-      String clazz = m.group(6);
-      String level = m.group(7);
-      String message = m.group(8);
-      // Apply the regex filter if supplied
-      if (null != lineFilter) {
-        Matcher match = lineFilter.matcher(message);
-        if (!match.matches())
-          return null;
-      }
-      // URL encode the message
-      message = URLEncoder.encode(message, UTF_8.name());
-      // Assume that we are processing logs from today.
-      // If the date in the line is greater than today, then it must be
-      // from the previous month.
-      cal.set(Calendar.DATE, date);
-      cal.set(Calendar.HOUR_OF_DAY, hour);
-      cal.set(Calendar.MINUTE, min);
-      cal.set(Calendar.SECOND, sec);
-      cal.set(Calendar.MILLISECOND, ms);
-      if (date > cal.get(Calendar.DAY_OF_MONTH)) {
-        cal.add(Calendar.MONTH, -1);
-      }
-      long ts = cal.getTimeInMillis();
-      // If this event is not between the start and end dates, then skip it.
-      if (null != dateFilter && !dateFilter.containsLong(ts))
-        return null;
-      Category c = Logger.getLogger(clazz);
-      Level l = Level.toLevel(level);
-      LoggingEvent event = new LoggingEvent(clazz, c, ts, l, message, threadName, null, null, null,
-          null);
-      // Check the log level filter
-      if (null != levelFilter && (levelFilter.decide(event) == Filter.DENY)) {
-        return null;
-      }
-      result = format(event);
-    }
-    return result;
-  }
-
-  private static class DateConverter implements IStringConverter<Date> {
-    @Override
-    public Date convert(String value) {
-      SimpleDateFormat formatter = new SimpleDateFormat("yyyyMMddHHmmss");
-      try {
-        return formatter.parse(value);
-      } catch (ParseException e) {
-        throw new RuntimeException(e);
-      }
-    }
-
-  }
-
-  private static class Opts extends Help {
-
-    @Parameter(names = {"-d", "--logDirectory"}, description = "ACCUMULO log directory path",
-        required = true)
-    String dir;
-
-    @Parameter(names = {"-f", "--fileFilter"}, description = "filter to apply to names of logs")
-    String filter;
-
-    @Parameter(names = {"-h", "--host"}, description = "host where chainsaw is running",
-        required = true)
-    String hostname;
-
-    @Parameter(names = {"-p", "--port"}, description = "port where XMLSocketReceiver is listening",
-        required = true)
-    int portnum;
-
-    @Parameter(names = {"-s", "--start"}, description = "start date filter (yyyyMMddHHmmss)",
-        required = true, converter = DateConverter.class)
-    Date startDate;
-
-    @Parameter(names = {"-e", "--end"}, description = "end date filter (yyyyMMddHHmmss)",
-        required = true, converter = DateConverter.class)
-    Date endDate;
-
-    @Parameter(names = {"-l", "--level"}, description = "filter log level")
-    String level;
-
-    @Parameter(names = {"-m", "--messageFilter"}, description = "regex filter for log messages")
-    String regex;
-  }
-
-  /**
-   *
-   * @param args
-   *          <ol>
-   *          <li>path to log directory</li>
-   *          <li>filter to apply for logs to include (uses wildcards (i.e. logger* and IS case
-   *          sensitive)</li>
-   *          <li>chainsaw host</li>
-   *          <li>chainsaw port</li>
-   *          <li>start date filter</li>
-   *          <li>end date filter</li>
-   *          <li>optional regex filter to match on each log4j message</li>
-   *          <li>optional level filter</li>
-   *          </ol>
-   */
-  public static void main(String[] args) throws Exception {
-    Opts opts = new Opts();
-    opts.parseArgs(SendLogToChainsaw.class.getName(), args);
-
-    SendLogToChainsaw c = new SendLogToChainsaw(opts.dir, opts.filter, opts.hostname, opts.portnum,
-        opts.startDate, opts.endDate, opts.regex, opts.level);
-    c.processLogFiles();
-  }
-
-}
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/TableDiskUsage.java b/server/base/src/main/java/org/apache/accumulo/server/util/TableDiskUsage.java
index d6a7f3c..201f5fc 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/TableDiskUsage.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/TableDiskUsage.java
@@ -43,7 +43,7 @@ import org.apache.accumulo.core.metadata.MetadataTable;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.DataFileColumnFamily;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.util.NumUtil;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.accumulo.server.fs.VolumeManager;
 import org.apache.hadoop.fs.FileStatus;
 import org.apache.hadoop.fs.Path;
@@ -291,7 +291,7 @@ public class TableDiskUsage {
     }
   }
 
-  static class Opts extends ClientOpts {
+  static class Opts extends ServerUtilOpts {
     @Parameter(description = " <table> { <table> ... } ")
     List<String> tables = new ArrayList<>();
   }
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/TablePropUtil.java b/server/base/src/main/java/org/apache/accumulo/server/util/TablePropUtil.java
index f96edee..75d709b 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/TablePropUtil.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/TablePropUtil.java
@@ -21,10 +21,10 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.conf.Property;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException;
 
 public class TablePropUtil {
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/TabletServerLocks.java b/server/base/src/main/java/org/apache/accumulo/server/util/TabletServerLocks.java
index a813f13..eb8979c 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/TabletServerLocks.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/TabletServerLocks.java
@@ -24,9 +24,9 @@ import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.cli.Help;
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooLock;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 
 import com.beust.jcommander.Parameter;
 
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/VerifyTabletAssignments.java b/server/base/src/main/java/org/apache/accumulo/server/util/VerifyTabletAssignments.java
index 8d69883..3b8a86c 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/VerifyTabletAssignments.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/VerifyTabletAssignments.java
@@ -51,7 +51,7 @@ import org.apache.accumulo.core.tabletserver.thrift.TabletClientService;
 import org.apache.accumulo.core.trace.Tracer;
 import org.apache.accumulo.core.trace.thrift.TInfo;
 import org.apache.accumulo.core.util.HostAndPort;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.hadoop.io.Text;
 import org.apache.thrift.TException;
 import org.apache.thrift.TServiceClient;
@@ -63,7 +63,7 @@ import com.beust.jcommander.Parameter;
 public class VerifyTabletAssignments {
   private static final Logger log = LoggerFactory.getLogger(VerifyTabletAssignments.class);
 
-  static class Opts extends ClientOpts {
+  static class Opts extends ServerUtilOpts {
     @Parameter(names = {"-v", "--verbose"},
         description = "verbose mode (prints locations of tablets)")
     boolean verbose = false;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/util/ZooZap.java b/server/base/src/main/java/org/apache/accumulo/server/util/ZooZap.java
index d7a44e6..b4bc194 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/util/ZooZap.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/util/ZooZap.java
@@ -23,12 +23,12 @@ import org.apache.accumulo.core.cli.Help;
 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.core.volume.VolumeConfiguration;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.security.SecurityUtil;
-import org.apache.accumulo.server.zookeeper.ZooLock;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.hadoop.fs.Path;
 import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/DistributedWorkQueue.java b/server/base/src/main/java/org/apache/accumulo/server/zookeeper/DistributedWorkQueue.java
index 8db7124..2db74bf 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/DistributedWorkQueue.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/zookeeper/DistributedWorkQueue.java
@@ -28,6 +28,7 @@ import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.atomic.AtomicInteger;
 
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.util.time.SimpleTimer;
diff --git a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/TransactionWatcher.java b/server/base/src/main/java/org/apache/accumulo/server/zookeeper/TransactionWatcher.java
index 68d4ece..b269bd5 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/TransactionWatcher.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/zookeeper/TransactionWatcher.java
@@ -16,9 +16,13 @@
  */
 package org.apache.accumulo.server.zookeeper;
 
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.Callable;
+import java.util.concurrent.atomic.AtomicInteger;
 
 import org.apache.accumulo.fate.zookeeper.IZooReader;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
@@ -27,8 +31,29 @@ import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.zookeeper.KeeperException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class TransactionWatcher {
+
+  private static final Logger log = LoggerFactory.getLogger(TransactionWatcher.class);
+  final private Map<Long,AtomicInteger> counts = new HashMap<>();
+  final private Arbitrator arbitrator;
+
+  public TransactionWatcher(Arbitrator arbitrator) {
+    this.arbitrator = arbitrator;
+  }
+
+  public TransactionWatcher(ServerContext context) {
+    this(new ZooArbitrator(context));
+  }
+
+  public interface Arbitrator {
+    boolean transactionAlive(String type, long tid) throws Exception;
+
+    boolean transactionComplete(String type, long tid) throws Exception;
+  }
 
-public class TransactionWatcher extends org.apache.accumulo.fate.zookeeper.TransactionWatcher {
   public static class ZooArbitrator implements Arbitrator {
 
     private ServerContext context;
@@ -97,7 +122,37 @@ public class TransactionWatcher extends org.apache.accumulo.fate.zookeeper.Trans
     }
   }
 
-  public TransactionWatcher(ServerContext context) {
-    super(new ZooArbitrator(context));
+  public <T> T run(String ztxBulk, long tid, Callable<T> callable) throws Exception {
+    synchronized (counts) {
+      if (!arbitrator.transactionAlive(ztxBulk, tid)) {
+        throw new Exception("Transaction " + tid + " of type " + ztxBulk + " is no longer active");
+      }
+      AtomicInteger count = counts.get(tid);
+      if (count == null)
+        counts.put(tid, count = new AtomicInteger());
+      count.incrementAndGet();
+    }
+    try {
+      return callable.call();
+    } finally {
+      synchronized (counts) {
+        AtomicInteger count = counts.get(tid);
+        if (count == null) {
+          log.error("unexpected missing count for transaction {}", tid);
+        } else {
+          if (count.decrementAndGet() == 0)
+            counts.remove(tid);
+        }
+      }
+    }
   }
+
+  public boolean isActive(long tid) {
+    synchronized (counts) {
+      log.debug("Transactions in progress {}", counts);
+      AtomicInteger count = counts.get(tid);
+      return count != null && count.get() > 0;
+    }
+  }
+
 }
diff --git a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooCache.java b/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooCache.java
deleted file mode 100644
index 78bc9f3..0000000
--- a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooCache.java
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.server.zookeeper;
-
-import org.apache.accumulo.server.ServerContext;
-import org.apache.zookeeper.Watcher;
-
-public class ZooCache extends org.apache.accumulo.fate.zookeeper.ZooCache {
-
-  public ZooCache(ServerContext context) {
-    this(context.getZooReaderWriter(), null);
-  }
-
-  public ZooCache(ZooReaderWriter zoo) {
-    this(zoo, null);
-  }
-
-  public ZooCache(ZooReaderWriter zoo, Watcher watcher) {
-    super(zoo, watcher);
-  }
-}
diff --git a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooLock.java b/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooLock.java
deleted file mode 100644
index 606e9c6..0000000
--- a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooLock.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.server.zookeeper;
-
-public class ZooLock extends org.apache.accumulo.fate.zookeeper.ZooLock {
-
-  public ZooLock(ZooReaderWriter zoo, String path) {
-    super(new ZooCache(zoo), zoo, path);
-  }
-}
diff --git a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooQueueLock.java b/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooQueueLock.java
deleted file mode 100644
index 633e710..0000000
--- a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooQueueLock.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.server.zookeeper;
-
-import static java.nio.charset.StandardCharsets.UTF_8;
-
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.locks.Lock;
-
-import org.apache.accumulo.core.conf.SiteConfiguration;
-import org.apache.accumulo.fate.zookeeper.DistributedReadWriteLock;
-import org.apache.zookeeper.KeeperException;
-
-public class ZooQueueLock extends org.apache.accumulo.fate.zookeeper.ZooQueueLock {
-
-  public ZooQueueLock(ZooReaderWriter zoo, String path, boolean ephemeral)
-      throws KeeperException, InterruptedException {
-    super(zoo, path, ephemeral);
-  }
-
-  public static void main(String args[]) throws InterruptedException, KeeperException {
-    ZooReaderWriter zoo = new ZooReaderWriter(new SiteConfiguration());
-    ZooQueueLock lock = new ZooQueueLock(zoo, "/lock", true);
-    DistributedReadWriteLock rlocker = new DistributedReadWriteLock(lock, "reader".getBytes(UTF_8));
-    DistributedReadWriteLock wlocker = new DistributedReadWriteLock(lock,
-        "wlocker".getBytes(UTF_8));
-    final Lock readLock = rlocker.readLock();
-    readLock.lock();
-    final Lock readLock2 = rlocker.readLock();
-    readLock2.lock();
-    final Lock writeLock = wlocker.writeLock();
-    if (writeLock.tryLock(100, TimeUnit.MILLISECONDS))
-      throw new RuntimeException("Write lock achieved during read lock!");
-    readLock.unlock();
-    readLock2.unlock();
-    writeLock.lock();
-    if (readLock.tryLock(100, TimeUnit.MILLISECONDS))
-      throw new RuntimeException("Read lock achieved during write lock!");
-    final Lock writeLock2 = DistributedReadWriteLock.recoverLock(lock, "wlocker".getBytes(UTF_8));
-    writeLock2.unlock();
-    readLock.lock();
-    System.out.println("success");
-  }
-
-}
diff --git a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooReaderWriter.java b/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooReaderWriter.java
deleted file mode 100644
index 4f78e77..0000000
--- a/server/base/src/main/java/org/apache/accumulo/server/zookeeper/ZooReaderWriter.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.accumulo.server.zookeeper;
-
-import static java.nio.charset.StandardCharsets.UTF_8;
-
-import org.apache.accumulo.core.conf.AccumuloConfiguration;
-import org.apache.accumulo.core.conf.Property;
-
-public class ZooReaderWriter extends org.apache.accumulo.fate.zookeeper.ZooReaderWriter {
-  private static final String SCHEME = "digest";
-  private static final String USER = "accumulo";
-
-  public ZooReaderWriter(AccumuloConfiguration conf) {
-    this(conf.get(Property.INSTANCE_ZK_HOST),
-        (int) conf.getTimeInMillis(Property.INSTANCE_ZK_TIMEOUT),
-        conf.get(Property.INSTANCE_SECRET));
-  }
-
-  public ZooReaderWriter(String string, int timeInMillis, String secret) {
-    super(string, timeInMillis, SCHEME, (USER + ":" + secret).getBytes(UTF_8));
-  }
-}
diff --git a/server/base/src/main/spotbugs/exclude-filter.xml b/server/base/src/main/spotbugs/exclude-filter.xml
deleted file mode 100644
index 27dfbfa..0000000
--- a/server/base/src/main/spotbugs/exclude-filter.xml
+++ /dev/null
@@ -1,68 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<FindBugsFilter>
-  <Match>
-    <!-- ignore proto-generated files -->
-    <Package name="org.apache.accumulo.server.replication.proto" />
-  </Match>
-  <Match>
-    <!-- ignore intentional name shadowing -->
-    <Or>
-      <Package name="org.apache.accumulo.server.zookeeper" />
-      <Package name="org.apache.accumulo.server.cli" />
-    </Or>
-    <Bug code="NM" pattern="NM_SAME_SIMPLE_NAME_AS_SUPERCLASS" />
-  </Match>
-  <Match>
-    <!-- admin classes can call System.exit -->
-    <Or>
-      <Class name="org.apache.accumulo.server.util.Admin" />
-      <Class name="org.apache.accumulo.server.init.Initialize" />
-    </Or>
-    <Bug code="DM" pattern="DM_EXIT" />
-  </Match>
-  <Match>
-    <!-- Tests, Monitor or Proxy don't need SSL sockets -->
-    <Or>
-        <Class name="org.apache.accumulo.server.monitor.LogService$SocketServer"/>
-      <Class name="org.apache.accumulo.server.util.TServerUtilsTest"/>
-      <Class name="org.apache.accumulo.server.util.PortUtils" />
-    </Or>
-    <Bug code="UNENCRYPTED" pattern="UNENCRYPTED_SERVER_SOCKET" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.server.metrics.AbstractMetricsImpl" />
-    <Or>
-      <Method name="setupLogging"/>
-      <Method name="startNewLog"/>
-    </Or>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN"/>
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Or>
-      <Class name="org.apache.accumulo.server.security.SystemCredentialsTest"/>
-      <Class name="org.apache.accumulo.server.util.Admin"/>
-      <Class name="org.apache.accumulo.server.util.FileSystemMonitor" />
-      <Class name="org.apache.accumulo.server.util.RestoreZookeeper" />
-      <Class name="org.apache.accumulo.server.util.SendLogToChainsaw" />
-      <Class name="org.apache.accumulo.server.util.ConvertConfig"/>
-    </Or>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-</FindBugsFilter>
diff --git a/server/base/src/test/java/org/apache/accumulo/server/conf/NamespaceConfigurationTest.java b/server/base/src/test/java/org/apache/accumulo/server/conf/NamespaceConfigurationTest.java
index 1ee9e2e..8a8ae5f 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/conf/NamespaceConfigurationTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/conf/NamespaceConfigurationTest.java
@@ -39,9 +39,9 @@ import org.apache.accumulo.core.client.impl.Namespace;
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.conf.ConfigurationObserver;
 import org.apache.accumulo.core.conf.Property;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooCacheFactory;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.ServerContext;
 import org.junit.Before;
 import org.junit.Test;
diff --git a/server/base/src/test/java/org/apache/accumulo/server/conf/TableConfigurationTest.java b/server/base/src/test/java/org/apache/accumulo/server/conf/TableConfigurationTest.java
index 0428c0b..cd52c3a 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/conf/TableConfigurationTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/conf/TableConfigurationTest.java
@@ -37,9 +37,9 @@ import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.conf.ConfigurationObserver;
 import org.apache.accumulo.core.conf.Property;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooCacheFactory;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.ServerContext;
 import org.junit.Before;
 import org.junit.Test;
diff --git a/server/base/src/test/java/org/apache/accumulo/server/constraints/MetadataConstraintsTest.java b/server/base/src/test/java/org/apache/accumulo/server/constraints/MetadataConstraintsTest.java
index 9d0586e..2dfce17 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/constraints/MetadataConstraintsTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/constraints/MetadataConstraintsTest.java
@@ -28,8 +28,8 @@ import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.metadata.schema.DataFileValue;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.DataFileColumnFamily;
-import org.apache.accumulo.fate.zookeeper.TransactionWatcher.Arbitrator;
 import org.apache.accumulo.server.ServerContext;
+import org.apache.accumulo.server.zookeeper.TransactionWatcher.Arbitrator;
 import org.apache.hadoop.io.Text;
 import org.apache.log4j.Level;
 import org.apache.log4j.Logger;
diff --git a/server/base/src/test/java/org/apache/accumulo/server/init/InitializeTest.java b/server/base/src/test/java/org/apache/accumulo/server/init/InitializeTest.java
index b87ae31..2ef34b6 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/init/InitializeTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/init/InitializeTest.java
@@ -28,8 +28,8 @@ import java.io.IOException;
 
 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.conf.SiteConfiguration;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.server.fs.VolumeManager;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.fs.Path;
 import org.junit.After;
diff --git a/server/base/src/test/java/org/apache/accumulo/server/iterators/MetadataBulkLoadFilterTest.java b/server/base/src/test/java/org/apache/accumulo/server/iterators/MetadataBulkLoadFilterTest.java
index 695409e..1fb6577 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/iterators/MetadataBulkLoadFilterTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/iterators/MetadataBulkLoadFilterTest.java
@@ -32,8 +32,8 @@ import org.apache.accumulo.core.metadata.schema.DataFileValue;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.DataFileColumnFamily;
 import org.apache.accumulo.core.util.ColumnFQ;
-import org.apache.accumulo.fate.zookeeper.TransactionWatcher.Arbitrator;
 import org.apache.accumulo.server.ServerContext;
+import org.apache.accumulo.server.zookeeper.TransactionWatcher.Arbitrator;
 import org.apache.hadoop.io.Text;
 import org.easymock.EasyMock;
 import org.junit.Test;
diff --git a/server/base/src/test/java/org/apache/accumulo/server/problems/ProblemReportTest.java b/server/base/src/test/java/org/apache/accumulo/server/problems/ProblemReportTest.java
index ad800d4..fcec313 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/problems/ProblemReportTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/problems/ProblemReportTest.java
@@ -34,11 +34,11 @@ import java.io.DataOutputStream;
 import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.util.Encoding;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.hadoop.io.Text;
 import org.junit.Before;
 import org.junit.Test;
diff --git a/server/base/src/test/java/org/apache/accumulo/server/replication/ReplicationUtilTest.java b/server/base/src/test/java/org/apache/accumulo/server/replication/ReplicationUtilTest.java
index b77764c..e85ba65 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/replication/ReplicationUtilTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/replication/ReplicationUtilTest.java
@@ -24,8 +24,8 @@ import java.util.Map.Entry;
 
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.conf.Property;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.easymock.EasyMock;
 import org.junit.Before;
 import org.junit.Test;
diff --git a/server/base/src/test/java/org/apache/accumulo/server/replication/ZooKeeperInitializationTest.java b/server/base/src/test/java/org/apache/accumulo/server/replication/ZooKeeperInitializationTest.java
index 76dce4f..f7545cb 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/replication/ZooKeeperInitializationTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/replication/ZooKeeperInitializationTest.java
@@ -23,7 +23,7 @@ import static org.easymock.EasyMock.replay;
 import static org.easymock.EasyMock.verify;
 
 import org.apache.accumulo.core.replication.ReplicationConstants;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.junit.Test;
 
 public class ZooKeeperInitializationTest {
diff --git a/server/base/src/test/java/org/apache/accumulo/server/security/SystemCredentialsTest.java b/server/base/src/test/java/org/apache/accumulo/server/security/SystemCredentialsTest.java
index a00120b..bfe840e 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/security/SystemCredentialsTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/security/SystemCredentialsTest.java
@@ -33,6 +33,8 @@ import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TestName;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class SystemCredentialsTest {
 
   @Rule
@@ -42,6 +44,7 @@ public class SystemCredentialsTest {
   private String instanceId = UUID.nameUUIDFromBytes(new byte[] {1, 2, 3, 4, 5, 6, 7, 8, 9, 0})
       .toString();
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "input not from a user")
   @BeforeClass
   public static void setUp() throws IOException {
     File testInstanceId = new File(
diff --git a/server/base/src/test/java/org/apache/accumulo/server/security/delegation/ZooAuthenticationKeyDistributorTest.java b/server/base/src/test/java/org/apache/accumulo/server/security/delegation/ZooAuthenticationKeyDistributorTest.java
index fb1ca5f..c9e2c0d 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/security/delegation/ZooAuthenticationKeyDistributorTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/security/delegation/ZooAuthenticationKeyDistributorTest.java
@@ -35,9 +35,9 @@ import java.util.List;
 import javax.crypto.KeyGenerator;
 
 import org.apache.accumulo.core.Constants;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException.AuthFailedException;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
diff --git a/server/base/src/test/java/org/apache/accumulo/server/util/TServerUtilsTest.java b/server/base/src/test/java/org/apache/accumulo/server/util/TServerUtilsTest.java
index 7c55ea9..cd203bb 100644
--- a/server/base/src/test/java/org/apache/accumulo/server/util/TServerUtilsTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/util/TServerUtilsTest.java
@@ -52,6 +52,8 @@ import org.easymock.EasyMock;
 import org.junit.After;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class TServerUtilsTest {
 
   protected static class TestServerConfigurationFactory extends ServerConfigurationFactory {
@@ -189,6 +191,7 @@ public class TServerUtilsTest {
     }
   }
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SERVER_SOCKET", justification = "socket for testing")
   @Test(expected = UnknownHostException.class)
   public void testStartServerUsedPort() throws Exception {
     int port = getFreePort(1024);
@@ -202,6 +205,7 @@ public class TServerUtilsTest {
     }
   }
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SERVER_SOCKET", justification = "socket for testing")
   @Test
   public void testStartServerUsedPortWithSearch() throws Exception {
     TServer server = null;
@@ -247,6 +251,7 @@ public class TServerUtilsTest {
     }
   }
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SERVER_SOCKET", justification = "socket for testing")
   @Test
   public void testStartServerPortRangeFirstPortUsed() throws Exception {
     TServer server = null;
@@ -282,6 +287,7 @@ public class TServerUtilsTest {
     return new int[] {low, high};
   }
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SERVER_SOCKET", justification = "socket for testing")
   private int getFreePort(int startingAddress) throws UnknownHostException {
     final InetAddress addr = InetAddress.getByName("localhost");
     for (int i = startingAddress; i < 65535; i++) {
diff --git a/core/src/test/java/org/apache/accumulo/fate/zookeeper/TransactionWatcherTest.java b/server/base/src/test/java/org/apache/accumulo/server/zookeeper/TransactionWatcherTest.java
similarity index 99%
rename from core/src/test/java/org/apache/accumulo/fate/zookeeper/TransactionWatcherTest.java
rename to server/base/src/test/java/org/apache/accumulo/server/zookeeper/TransactionWatcherTest.java
index f0b9b8c..633f27d 100644
--- a/core/src/test/java/org/apache/accumulo/fate/zookeeper/TransactionWatcherTest.java
+++ b/server/base/src/test/java/org/apache/accumulo/server/zookeeper/TransactionWatcherTest.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.accumulo.fate.zookeeper;
+package org.apache.accumulo.server.zookeeper;
 
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
diff --git a/server/gc/pom.xml b/server/gc/pom.xml
index a19bcc7..502be73 100644
--- a/server/gc/pom.xml
+++ b/server/gc/pom.xml
@@ -61,6 +61,10 @@
       <artifactId>hadoop-client-api</artifactId>
     </dependency>
     <dependency>
+      <groupId>org.apache.htrace</groupId>
+      <artifactId>htrace-core</artifactId>
+    </dependency>
+    <dependency>
       <groupId>org.apache.thrift</groupId>
       <artifactId>libthrift</artifactId>
     </dependency>
diff --git a/server/gc/src/main/java/org/apache/accumulo/gc/SimpleGarbageCollector.java b/server/gc/src/main/java/org/apache/accumulo/gc/SimpleGarbageCollector.java
index bb99852..e9f52a5 100644
--- a/server/gc/src/main/java/org/apache/accumulo/gc/SimpleGarbageCollector.java
+++ b/server/gc/src/main/java/org/apache/accumulo/gc/SimpleGarbageCollector.java
@@ -66,9 +66,9 @@ import org.apache.accumulo.core.replication.ReplicationTable;
 import org.apache.accumulo.core.replication.ReplicationTableOfflineException;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.security.thrift.TCredentials;
-import org.apache.accumulo.core.trace.ProbabilitySampler;
 import org.apache.accumulo.core.trace.Span;
 import org.apache.accumulo.core.trace.Trace;
+import org.apache.accumulo.core.trace.TraceSamplers;
 import org.apache.accumulo.core.trace.thrift.TInfo;
 import org.apache.accumulo.core.trace.wrappers.TraceWrap;
 import org.apache.accumulo.core.util.HostAndPort;
@@ -76,6 +76,7 @@ import org.apache.accumulo.core.util.NamingThreadFactory;
 import org.apache.accumulo.core.util.Pair;
 import org.apache.accumulo.core.util.ServerServices;
 import org.apache.accumulo.core.util.ServerServices.Service;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockLossReason;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockWatcher;
 import org.apache.accumulo.gc.replication.CloseWriteAheadLogReferences;
@@ -91,10 +92,10 @@ import org.apache.accumulo.server.rpc.TCredentialsUpdatingWrapper;
 import org.apache.accumulo.server.rpc.TServerUtils;
 import org.apache.accumulo.server.rpc.ThriftServerType;
 import org.apache.accumulo.server.util.Halt;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.apache.hadoop.fs.FileStatus;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.io.Text;
+import org.apache.htrace.impl.ProbabilitySampler;
 import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -104,6 +105,8 @@ import com.google.common.collect.Iterators;
 import com.google.common.collect.Maps;
 import com.google.protobuf.InvalidProtocolBufferException;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 // Could/Should implement HighlyAvaialbleService but the Thrift server is already started before
 // the ZK lock is acquired. The server is only for metrics, there are no concerns about clients
 // using the service before the lock is acquired.
@@ -504,6 +507,7 @@ public class SimpleGarbageCollector implements Iface {
     }
   }
 
+  @SuppressFBWarnings(value = "DM_EXIT", justification = "main class can call System.exit")
   private void run() {
     long tStart, tStop;
 
@@ -527,8 +531,8 @@ public class SimpleGarbageCollector implements Iface {
       return;
     }
 
-    ProbabilitySampler sampler = new ProbabilitySampler(
-        getConfiguration().getFraction(Property.GC_TRACE_PERCENT));
+    ProbabilitySampler sampler = TraceSamplers
+        .probabilitySampler(getConfiguration().getFraction(Property.GC_TRACE_PERCENT));
 
     while (true) {
       Trace.on("gc", sampler);
diff --git a/server/gc/src/main/spotbugs/exclude-filter.xml b/server/gc/src/main/spotbugs/exclude-filter.xml
deleted file mode 100644
index 0a34e52..0000000
--- a/server/gc/src/main/spotbugs/exclude-filter.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<FindBugsFilter>
-  <Match>
-    <!-- admin classes can call System.exit -->
-    <Class name="org.apache.accumulo.gc.SimpleGarbageCollector" />
-    <Bug code="DM" pattern="DM_EXIT" />
-  </Match>
-</FindBugsFilter>
diff --git a/server/master/src/main/java/org/apache/accumulo/master/Master.java b/server/master/src/main/java/org/apache/accumulo/master/Master.java
index 412b9c7..4d0baca 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/Master.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/Master.java
@@ -81,11 +81,13 @@ import org.apache.accumulo.core.trace.thrift.TInfo;
 import org.apache.accumulo.core.trace.wrappers.TraceWrap;
 import org.apache.accumulo.core.util.Daemon;
 import org.apache.accumulo.core.util.Pair;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.AgeOffStore;
 import org.apache.accumulo.fate.Fate;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockLossReason;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.master.metrics.MasterMetricsFactory;
@@ -144,8 +146,6 @@ import org.apache.accumulo.server.util.MetadataTableUtil;
 import org.apache.accumulo.server.util.ServerBulkImportStatus;
 import org.apache.accumulo.server.util.TableInfoUtil;
 import org.apache.accumulo.server.util.time.SimpleTimer;
-import org.apache.accumulo.server.zookeeper.ZooLock;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.start.classloader.vfs.AccumuloVFSClassLoader;
 import org.apache.accumulo.start.classloader.vfs.ContextManager;
 import org.apache.hadoop.fs.FSDataInputStream;
@@ -168,6 +168,8 @@ import org.slf4j.LoggerFactory;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Iterables;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * The Master is responsible for assigning and balancing tablets to tablet servers.
  * <p>
@@ -320,6 +322,8 @@ public class Master
 
   private boolean haveUpgradedZooKeeper = false;
 
+  @SuppressFBWarnings(value = "DM_EXIT",
+      justification = "TODO probably not the best to call System.exit here")
   private void upgradeZookeeper() {
     // 1.5.1 and 1.6.0 both do some state checking after obtaining the zoolock for the
     // monitor and before starting up. It's not tied to the data version at all (and would
@@ -507,6 +511,8 @@ public class Master
         Runnable upgradeTask = new Runnable() {
           int version = accumuloPersistentVersion;
 
+          @SuppressFBWarnings(value = "DM_EXIT",
+              justification = "TODO probably not the best to call System.exit here")
           @Override
           public void run() {
             try {
@@ -1715,6 +1721,7 @@ public class Master
     }
   }
 
+  @SuppressFBWarnings(value = "UW_UNCOND_WAIT", justification = "TODO needs triage")
   public void waitForBalance(TInfo tinfo) {
     synchronized (balancedNotifier) {
       long eventCounter;
diff --git a/server/master/src/main/java/org/apache/accumulo/master/MasterTime.java b/server/master/src/main/java/org/apache/accumulo/master/MasterTime.java
index 37cc739..73348e0 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/MasterTime.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/MasterTime.java
@@ -26,8 +26,8 @@ import java.util.Timer;
 import java.util.TimerTask;
 
 import org.apache.accumulo.core.Constants;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/server/master/src/main/java/org/apache/accumulo/master/recovery/RecoveryManager.java b/server/master/src/main/java/org/apache/accumulo/master/recovery/RecoveryManager.java
index 8417e76..6b9cfd3 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/recovery/RecoveryManager.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/recovery/RecoveryManager.java
@@ -35,6 +35,7 @@ import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.data.impl.KeyExtent;
 import org.apache.accumulo.core.util.NamingThreadFactory;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.master.Master;
 import org.apache.accumulo.server.ServerConstants;
 import org.apache.accumulo.server.fs.VolumeManager.FileType;
@@ -44,7 +45,6 @@ import org.apache.accumulo.server.master.recovery.HadoopLogCloser;
 import org.apache.accumulo.server.master.recovery.LogCloser;
 import org.apache.accumulo.server.master.recovery.RecoveryPath;
 import org.apache.accumulo.server.zookeeper.DistributedWorkQueue;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.hadoop.fs.Path;
 import org.apache.zookeeper.KeeperException;
 import org.slf4j.Logger;
@@ -64,7 +64,7 @@ public class RecoveryManager {
   public RecoveryManager(Master master) {
     this.master = master;
     executor = Executors.newScheduledThreadPool(4, new NamingThreadFactory("Walog sort starter "));
-    zooCache = new ZooCache(master.getContext());
+    zooCache = new ZooCache(master.getContext().getZooReaderWriter(), null);
     try {
       List<String> workIDs = new DistributedWorkQueue(
           master.getZooKeeperRoot() + Constants.ZRECOVERY, master.getConfiguration())
diff --git a/server/master/src/main/java/org/apache/accumulo/master/replication/DistributedWorkQueueWorkAssigner.java b/server/master/src/main/java/org/apache/accumulo/master/replication/DistributedWorkQueueWorkAssigner.java
index ed8c7eb..bf0e0d4 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/replication/DistributedWorkQueueWorkAssigner.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/replication/DistributedWorkQueueWorkAssigner.java
@@ -37,13 +37,13 @@ import org.apache.accumulo.core.replication.ReplicationSchema.WorkSection;
 import org.apache.accumulo.core.replication.ReplicationTable;
 import org.apache.accumulo.core.replication.ReplicationTableOfflineException;
 import org.apache.accumulo.core.replication.ReplicationTarget;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.replication.DistributedWorkQueueWorkAssignerHelper;
 import org.apache.accumulo.server.replication.StatusUtil;
 import org.apache.accumulo.server.replication.WorkAssigner;
 import org.apache.accumulo.server.replication.proto.Replication.Status;
 import org.apache.accumulo.server.zookeeper.DistributedWorkQueue;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.io.Text;
 import org.slf4j.Logger;
diff --git a/server/master/src/main/java/org/apache/accumulo/master/replication/ReplicationDriver.java b/server/master/src/main/java/org/apache/accumulo/master/replication/ReplicationDriver.java
index 5215371..33479a5 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/replication/ReplicationDriver.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/replication/ReplicationDriver.java
@@ -21,11 +21,12 @@ import org.apache.accumulo.core.client.AccumuloException;
 import org.apache.accumulo.core.client.AccumuloSecurityException;
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.conf.Property;
-import org.apache.accumulo.core.trace.ProbabilitySampler;
 import org.apache.accumulo.core.trace.Trace;
+import org.apache.accumulo.core.trace.TraceSamplers;
 import org.apache.accumulo.core.util.Daemon;
 import org.apache.accumulo.fate.util.UtilWaitThread;
 import org.apache.accumulo.master.Master;
+import org.apache.htrace.impl.ProbabilitySampler;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,8 +54,8 @@ public class ReplicationDriver extends Daemon {
 
   @Override
   public void run() {
-    ProbabilitySampler sampler = new ProbabilitySampler(
-        conf.getFraction(Property.REPLICATION_TRACE_PERCENT));
+    ProbabilitySampler sampler = TraceSamplers
+        .probabilitySampler(conf.getFraction(Property.REPLICATION_TRACE_PERCENT));
 
     long millisToWait = conf.getTimeInMillis(Property.REPLICATION_DRIVER_DELAY);
     log.debug("Waiting {}ms before starting main replication loop", millisToWait);
diff --git a/server/master/src/main/java/org/apache/accumulo/master/replication/SequentialWorkAssigner.java b/server/master/src/main/java/org/apache/accumulo/master/replication/SequentialWorkAssigner.java
index 26b35d9..416cd58 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/replication/SequentialWorkAssigner.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/replication/SequentialWorkAssigner.java
@@ -29,7 +29,7 @@ import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.replication.ReplicationConstants;
 import org.apache.accumulo.core.replication.ReplicationTarget;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.replication.DistributedWorkQueueWorkAssignerHelper;
 import org.apache.hadoop.fs.Path;
 import org.apache.zookeeper.KeeperException;
diff --git a/server/master/src/main/java/org/apache/accumulo/master/replication/UnorderedWorkAssigner.java b/server/master/src/main/java/org/apache/accumulo/master/replication/UnorderedWorkAssigner.java
index c44e008..73ddc3b 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/replication/UnorderedWorkAssigner.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/replication/UnorderedWorkAssigner.java
@@ -27,7 +27,7 @@ import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.replication.ReplicationConstants;
 import org.apache.accumulo.core.replication.ReplicationTarget;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.replication.DistributedWorkQueueWorkAssignerHelper;
 import org.apache.hadoop.fs.Path;
 import org.apache.zookeeper.KeeperException;
diff --git a/server/master/src/main/java/org/apache/accumulo/master/state/MergeStats.java b/server/master/src/main/java/org/apache/accumulo/master/state/MergeStats.java
index f9d151a..bf3ff04 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/state/MergeStats.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/state/MergeStats.java
@@ -33,8 +33,9 @@ import org.apache.accumulo.core.metadata.MetadataTable;
 import org.apache.accumulo.core.metadata.RootTable;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema;
 import org.apache.accumulo.core.security.Authorizations;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.accumulo.server.master.state.CurrentState;
 import org.apache.accumulo.server.master.state.MergeInfo;
 import org.apache.accumulo.server.master.state.MergeState;
@@ -42,7 +43,6 @@ import org.apache.accumulo.server.master.state.MetaDataTableScanner;
 import org.apache.accumulo.server.master.state.TabletLocationState;
 import org.apache.accumulo.server.master.state.TabletLocationState.BadLocationStateException;
 import org.apache.accumulo.server.master.state.TabletState;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.hadoop.io.DataInputBuffer;
 import org.apache.hadoop.io.Text;
 import org.apache.zookeeper.data.Stat;
@@ -258,7 +258,7 @@ public class MergeStats {
   }
 
   public static void main(String[] args) throws Exception {
-    ClientOpts opts = new ClientOpts();
+    ServerUtilOpts opts = new ServerUtilOpts();
     opts.parseArgs(MergeStats.class.getName(), args);
 
     AccumuloClient client = opts.getClient();
diff --git a/server/master/src/main/java/org/apache/accumulo/master/tableOps/Utils.java b/server/master/src/main/java/org/apache/accumulo/master/tableOps/Utils.java
index 7a3acc8..8deb4b0 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/tableOps/Utils.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/tableOps/Utils.java
@@ -38,13 +38,13 @@ import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.client.impl.Tables;
 import org.apache.accumulo.core.client.impl.thrift.TableOperation;
 import org.apache.accumulo.core.client.impl.thrift.TableOperationExceptionType;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.DistributedReadWriteLock;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooQueueLock;
 import org.apache.accumulo.fate.zookeeper.ZooReservation;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.master.Master;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.zookeeper.ZooQueueLock;
 import org.apache.hadoop.fs.FSDataInputStream;
 import org.apache.hadoop.io.Text;
 import org.apache.zookeeper.KeeperException;
diff --git a/server/master/src/main/java/org/apache/accumulo/master/tableOps/create/PopulateMetadata.java b/server/master/src/main/java/org/apache/accumulo/master/tableOps/create/PopulateMetadata.java
index 63c3b24..ebe95b8 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/tableOps/create/PopulateMetadata.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/tableOps/create/PopulateMetadata.java
@@ -30,13 +30,13 @@ import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.data.impl.KeyExtent;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema;
 import org.apache.accumulo.fate.Repo;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.master.Master;
 import org.apache.accumulo.master.tableOps.MasterRepo;
 import org.apache.accumulo.master.tableOps.TableInfo;
 import org.apache.accumulo.master.tableOps.Utils;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.util.MetadataTableUtil;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.apache.hadoop.io.Text;
 
 import com.google.common.base.Preconditions;
diff --git a/server/master/src/main/java/org/apache/accumulo/master/tableOps/tableImport/ImportTable.java b/server/master/src/main/java/org/apache/accumulo/master/tableOps/tableImport/ImportTable.java
index 98d3c88..1b2c678 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/tableOps/tableImport/ImportTable.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/tableOps/tableImport/ImportTable.java
@@ -40,6 +40,8 @@ import org.apache.hadoop.fs.Path;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ImportTable extends MasterRepo {
   private static final Logger log = LoggerFactory.getLogger(ImportTable.class);
 
@@ -81,6 +83,8 @@ public class ImportTable extends MasterRepo {
     }
   }
 
+  @SuppressFBWarnings(value = "OS_OPEN_STREAM",
+      justification = "closing intermediate readers would close the ZipInputStream")
   public void checkVersions(Master env) throws AcceptableThriftTableOperationException {
     Path path = new Path(tableInfo.exportDir, Constants.EXPORT_FILE);
     Integer exportVersion = null;
diff --git a/server/master/src/main/java/org/apache/accumulo/master/tserverOps/ShutdownTServer.java b/server/master/src/main/java/org/apache/accumulo/master/tserverOps/ShutdownTServer.java
index 79c6260..037c338 100644
--- a/server/master/src/main/java/org/apache/accumulo/master/tserverOps/ShutdownTServer.java
+++ b/server/master/src/main/java/org/apache/accumulo/master/tserverOps/ShutdownTServer.java
@@ -21,13 +21,13 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.accumulo.core.Constants;
 import org.apache.accumulo.core.master.thrift.TabletServerStatus;
 import org.apache.accumulo.fate.Repo;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.master.Master;
 import org.apache.accumulo.master.tableOps.MasterRepo;
 import org.apache.accumulo.server.master.LiveTServerSet.TServerConnection;
 import org.apache.accumulo.server.master.state.TServerInstance;
-import org.apache.accumulo.server.zookeeper.ZooLock;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.thrift.transport.TTransportException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/server/master/src/main/spotbugs/exclude-filter.xml b/server/master/src/main/spotbugs/exclude-filter.xml
deleted file mode 100644
index b7d3fae..0000000
--- a/server/master/src/main/spotbugs/exclude-filter.xml
+++ /dev/null
@@ -1,43 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<FindBugsFilter>
-  <Match>
-    <!-- locking is confusing, but probably correct -->
-    <Class name="org.apache.accumulo.master.Master" />
-    <Bug code="UW" pattern="UW_UNCOND_WAIT" />
-  </Match>
-  <Match>
-    <!-- shouldn't close the given I/O streams, because they are just wrapped -->
-    <Class name="org.apache.accumulo.master.tableOps.tableImport.ImportTable" />
-    <Method name="checkVersions" params="org.apache.accumulo.master.Master" returns="void" />
-    <Bug code="OS" pattern="OS_OPEN_STREAM" />
-  </Match>
-  <Match>
-    <!-- shouldn't close the given I/O streams, because they are just wrapped -->
-    <Class name="org.apache.accumulo.master.tableOps.tableExport.WriteExportFiles" />
-    <Method name="exportTable" params="org.apache.accumulo.server.fs.VolumeManager,org.apache.accumulo.server.ServerContext,java.lang.String,java.lang.String,java.lang.String" returns="void" />
-    <Bug code="OS" pattern="OS_OPEN_STREAM" />
-  </Match>
-  <Match>
-    <!-- admin classes can call System.exit -->
-    <Or>
-      <Class name="org.apache.accumulo.master.Master" />
-      <Class name="org.apache.accumulo.master.Master$2" />
-    </Or>
-    <Bug code="DM" pattern="DM_EXIT" />
-  </Match>
-</FindBugsFilter>
diff --git a/server/master/src/test/java/org/apache/accumulo/master/replication/SequentialWorkAssignerTest.java b/server/master/src/test/java/org/apache/accumulo/master/replication/SequentialWorkAssignerTest.java
index b64b97a..de8594e 100644
--- a/server/master/src/test/java/org/apache/accumulo/master/replication/SequentialWorkAssignerTest.java
+++ b/server/master/src/test/java/org/apache/accumulo/master/replication/SequentialWorkAssignerTest.java
@@ -30,10 +30,10 @@ import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.replication.ReplicationConstants;
 import org.apache.accumulo.core.replication.ReplicationTarget;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.server.replication.DistributedWorkQueueWorkAssignerHelper;
 import org.apache.accumulo.server.zookeeper.DistributedWorkQueue;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.junit.Before;
 import org.junit.Test;
 
diff --git a/server/master/src/test/java/org/apache/accumulo/master/replication/UnorderedWorkAssignerTest.java b/server/master/src/test/java/org/apache/accumulo/master/replication/UnorderedWorkAssignerTest.java
index 0c2f6e7..b7bf0a6 100644
--- a/server/master/src/test/java/org/apache/accumulo/master/replication/UnorderedWorkAssignerTest.java
+++ b/server/master/src/test/java/org/apache/accumulo/master/replication/UnorderedWorkAssignerTest.java
@@ -37,9 +37,9 @@ import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.accumulo.core.replication.ReplicationConstants;
 import org.apache.accumulo.core.replication.ReplicationTarget;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.server.replication.DistributedWorkQueueWorkAssignerHelper;
 import org.apache.accumulo.server.zookeeper.DistributedWorkQueue;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.hadoop.fs.Path;
 import org.junit.Before;
 import org.junit.Test;
diff --git a/server/monitor/src/main/java/org/apache/accumulo/monitor/Monitor.java b/server/monitor/src/main/java/org/apache/accumulo/monitor/Monitor.java
index 1a5843e..274be42 100644
--- a/server/monitor/src/main/java/org/apache/accumulo/monitor/Monitor.java
+++ b/server/monitor/src/main/java/org/apache/accumulo/monitor/Monitor.java
@@ -59,7 +59,9 @@ import org.apache.accumulo.core.util.Pair;
 import org.apache.accumulo.core.util.ServerServices;
 import org.apache.accumulo.core.util.ServerServices.Service;
 import org.apache.accumulo.fate.util.LoggingRunnable;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockLossReason;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
 import org.apache.accumulo.server.HighlyAvailableService;
@@ -72,8 +74,6 @@ import org.apache.accumulo.server.problems.ProblemType;
 import org.apache.accumulo.server.util.Halt;
 import org.apache.accumulo.server.util.TableInfoUtil;
 import org.apache.accumulo.server.util.time.SimpleTimer;
-import org.apache.accumulo.server.zookeeper.ZooLock;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.zookeeper.KeeperException;
 import org.eclipse.jetty.servlet.DefaultServlet;
 import org.eclipse.jetty.servlet.ServletHolder;
diff --git a/server/tracer/src/main/java/org/apache/accumulo/tracer/SendSpansViaThrift.java b/server/tracer/src/main/java/org/apache/accumulo/tracer/SendSpansViaThrift.java
index 839b85a..3016a1d 100644
--- a/server/tracer/src/main/java/org/apache/accumulo/tracer/SendSpansViaThrift.java
+++ b/server/tracer/src/main/java/org/apache/accumulo/tracer/SendSpansViaThrift.java
@@ -29,6 +29,8 @@ import org.apache.thrift.protocol.TProtocol;
 import org.apache.thrift.transport.TSocket;
 import org.apache.thrift.transport.TTransport;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Send Span data to a destination using thrift.
  */
@@ -46,6 +48,8 @@ public class SendSpansViaThrift extends AsyncSpanReceiver<String,Client> {
     super(conf);
   }
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SOCKET",
+      justification = "insecure, known risk; this is user-configurable to avoid insecure transfer")
   @Override
   protected Client createDestination(String destination) throws Exception {
     if (destination == null)
diff --git a/server/tracer/src/main/spotbugs/exclude-filter.xml b/server/tracer/src/main/spotbugs/exclude-filter.xml
index 80ee4d2..ce11cf3 100644
--- a/server/tracer/src/main/spotbugs/exclude-filter.xml
+++ b/server/tracer/src/main/spotbugs/exclude-filter.xml
@@ -15,21 +15,12 @@
   limitations under the License.
 -->
 <FindBugsFilter>
-  <Match>
-    <!-- TODO open ticket to make this use thrift SSL -->
-    <Class name="org.apache.accumulo.tracer.SendSpansViaThrift" />
-    <Bug code="UNENCRYPTED" pattern="UNENCRYPTED_SOCKET" />
-  </Match>
+  <!--
+    DO NOT exclude anything other than generated files here. Other files
+    can be excluded inline by adding the @SuppressFBWarnings annotation.
+  -->
   <Match>
     <!-- ignore thrift-generated classes -->
     <Package name="org.apache.accumulo.tracer.thrift" />
   </Match>
-  <Match>
-    <!-- Test doesn't need SSL -->
-    <Class name="org.apache.accumulo.tracer.TracerTest"/>
-    <Or>
-      <Bug code="UNENCRYPTED" pattern="UNENCRYPTED_SOCKET" />
-      <Bug code="UNENCRYPTED" pattern="UNENCRYPTED_SERVER_SOCKET" />
-    </Or>
-  </Match>
 </FindBugsFilter>
diff --git a/server/tracer/src/test/java/org/apache/accumulo/tracer/TracerTest.java b/server/tracer/src/test/java/org/apache/accumulo/tracer/TracerTest.java
index bfa0dca..cc1df86 100644
--- a/server/tracer/src/test/java/org/apache/accumulo/tracer/TracerTest.java
+++ b/server/tracer/src/test/java/org/apache/accumulo/tracer/TracerTest.java
@@ -52,6 +52,8 @@ import org.apache.thrift.transport.TTransport;
 import org.junit.Before;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class TracerTest {
   static class SpanStruct {
     public SpanStruct(long traceId, long spanId, long parentId, long start, long stop,
@@ -159,6 +161,8 @@ public class TracerTest {
     }
   }
 
+  @SuppressFBWarnings(value = {"UNENCRYPTED_SOCKET", "UNENCRYPTED_SERVER_SOCKET"},
+      justification = "insecure, known risk, test socket")
   @Test
   public void testThrift() throws Exception {
     TestReceiver tracer = new TestReceiver();
diff --git a/server/tserver/src/main/java/org/apache/accumulo/tserver/NativeMap.java b/server/tserver/src/main/java/org/apache/accumulo/tserver/NativeMap.java
index 9c6e46b..15fc4c3 100644
--- a/server/tserver/src/main/java/org/apache/accumulo/tserver/NativeMap.java
+++ b/server/tserver/src/main/java/org/apache/accumulo/tserver/NativeMap.java
@@ -52,6 +52,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.annotations.VisibleForTesting;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * This class stores data in a C++ map. Doing this allows us to store more in memory and avoid
  * pauses caused by Java GC.
@@ -116,6 +118,7 @@ public class NativeMap implements Iterable<Map.Entry<Key,Value>> {
    * @param searchPath
    *          a list of files and directories to search
    */
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "search paths provided by admin")
   public static void loadNativeLib(List<File> searchPath) {
     if (!isLoaded()) {
       List<String> names = getValidLibraryNames();
diff --git a/server/tserver/src/main/java/org/apache/accumulo/tserver/TabletServer.java b/server/tserver/src/main/java/org/apache/accumulo/tserver/TabletServer.java
index 03f404a..9a2b1ff 100644
--- a/server/tserver/src/main/java/org/apache/accumulo/tserver/TabletServer.java
+++ b/server/tserver/src/main/java/org/apache/accumulo/tserver/TabletServer.java
@@ -164,12 +164,15 @@ import org.apache.accumulo.core.util.SimpleThreadPool;
 import org.apache.accumulo.core.util.ratelimit.RateLimiter;
 import org.apache.accumulo.core.util.ratelimit.SharedRateLimiterFactory;
 import org.apache.accumulo.core.util.ratelimit.SharedRateLimiterFactory.RateProvider;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.util.LoggingRunnable;
 import org.apache.accumulo.fate.util.Retry;
 import org.apache.accumulo.fate.util.Retry.RetryFactory;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockLossReason;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockWatcher;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.server.GarbageCollectionLogger;
 import org.apache.accumulo.server.ServerContext;
@@ -216,9 +219,6 @@ import org.apache.accumulo.server.util.time.RelativeTime;
 import org.apache.accumulo.server.util.time.SimpleTimer;
 import org.apache.accumulo.server.zookeeper.DistributedWorkQueue;
 import org.apache.accumulo.server.zookeeper.TransactionWatcher;
-import org.apache.accumulo.server.zookeeper.ZooCache;
-import org.apache.accumulo.server.zookeeper.ZooLock;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.start.classloader.vfs.AccumuloVFSClassLoader;
 import org.apache.accumulo.start.classloader.vfs.ContextManager;
 import org.apache.accumulo.tserver.ConditionCheckerContext.ConditionChecker;
@@ -356,7 +356,7 @@ public class TabletServer implements Runnable {
 
   public TabletServer(ServerContext context) {
     this.context = context;
-    this.masterLockCache = new ZooCache(context);
+    this.masterLockCache = new ZooCache(context.getZooReaderWriter(), null);
     this.watcher = new TransactionWatcher(context);
     this.confFactory = context.getServerConfFactory();
     this.fs = context.getVolumeManager();
diff --git a/server/tserver/src/main/java/org/apache/accumulo/tserver/TabletServerResourceManager.java b/server/tserver/src/main/java/org/apache/accumulo/tserver/TabletServerResourceManager.java
index 8b2c60a..7e8f891 100644
--- a/server/tserver/src/main/java/org/apache/accumulo/tserver/TabletServerResourceManager.java
+++ b/server/tserver/src/main/java/org/apache/accumulo/tserver/TabletServerResourceManager.java
@@ -92,6 +92,8 @@ import com.google.common.cache.CacheBuilder;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableMap.Builder;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * ResourceManager is responsible for managing the resources of all tablets within a tablet server.
  */
@@ -309,6 +311,8 @@ public class TabletServerResourceManager {
     return builder.build();
   }
 
+  @SuppressFBWarnings(value = "DM_GC",
+      justification = "GC is run to get a good estimate of memory availability")
   public TabletServerResourceManager(TabletServer tserver, VolumeManager fs,
       ServerContext context) {
     this.tserver = tserver;
diff --git a/server/tserver/src/main/java/org/apache/accumulo/tserver/replication/AccumuloReplicaSystem.java b/server/tserver/src/main/java/org/apache/accumulo/tserver/replication/AccumuloReplicaSystem.java
index 1e71e8a..dd22862 100644
--- a/server/tserver/src/main/java/org/apache/accumulo/tserver/replication/AccumuloReplicaSystem.java
+++ b/server/tserver/src/main/java/org/apache/accumulo/tserver/replication/AccumuloReplicaSystem.java
@@ -58,9 +58,9 @@ import org.apache.accumulo.core.replication.thrift.ReplicationServicer;
 import org.apache.accumulo.core.replication.thrift.ReplicationServicer.Client;
 import org.apache.accumulo.core.replication.thrift.WalEdits;
 import org.apache.accumulo.core.security.thrift.TCredentials;
-import org.apache.accumulo.core.trace.ProbabilitySampler;
 import org.apache.accumulo.core.trace.Span;
 import org.apache.accumulo.core.trace.Trace;
+import org.apache.accumulo.core.trace.TraceSamplers;
 import org.apache.accumulo.core.util.HostAndPort;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.fs.VolumeManager;
@@ -78,10 +78,13 @@ import org.apache.commons.lang.StringUtils;
 import org.apache.hadoop.fs.FSDataInputStream;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.htrace.impl.ProbabilitySampler;
 import org.apache.thrift.transport.TTransportException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class AccumuloReplicaSystem implements ReplicaSystem {
   private static final Logger log = LoggerFactory.getLogger(AccumuloReplicaSystem.class);
   private static final String RFILE_SUFFIX = "." + RFile.EXTENSION;
@@ -156,6 +159,7 @@ public class AccumuloReplicaSystem implements ReplicaSystem {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by admin")
   @Override
   public Status replicate(final Path p, final Status status, final ReplicationTarget target,
       final ReplicaSystemHelper helper) {
@@ -238,7 +242,7 @@ public class AccumuloReplicaSystem implements ReplicaSystem {
       final ClientContext peerContext, final UserGroupInformation accumuloUgi) {
     try {
       double tracePercent = localConf.getFraction(Property.REPLICATION_TRACE_PERCENT);
-      ProbabilitySampler sampler = new ProbabilitySampler(tracePercent);
+      ProbabilitySampler sampler = TraceSamplers.probabilitySampler(tracePercent);
       Trace.on("AccumuloReplicaSystem", sampler);
 
       // Remote identifier is an integer (table id) in this case.
diff --git a/server/tserver/src/main/java/org/apache/accumulo/tserver/tablet/MinorCompactionTask.java b/server/tserver/src/main/java/org/apache/accumulo/tserver/tablet/MinorCompactionTask.java
index 7f44be7..c96ac71 100644
--- a/server/tserver/src/main/java/org/apache/accumulo/tserver/tablet/MinorCompactionTask.java
+++ b/server/tserver/src/main/java/org/apache/accumulo/tserver/tablet/MinorCompactionTask.java
@@ -19,12 +19,13 @@ package org.apache.accumulo.tserver.tablet;
 import java.io.IOException;
 
 import org.apache.accumulo.core.metadata.schema.DataFileValue;
-import org.apache.accumulo.core.trace.ProbabilitySampler;
 import org.apache.accumulo.core.trace.Span;
 import org.apache.accumulo.core.trace.Trace;
+import org.apache.accumulo.core.trace.TraceSamplers;
 import org.apache.accumulo.server.fs.FileRef;
 import org.apache.accumulo.tserver.MinorCompactionReason;
 import org.apache.accumulo.tserver.compaction.MajorCompactionReason;
+import org.apache.htrace.impl.ProbabilitySampler;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -56,7 +57,7 @@ class MinorCompactionTask implements Runnable {
   @Override
   public void run() {
     tablet.minorCompactionStarted();
-    ProbabilitySampler sampler = new ProbabilitySampler(tracePercent);
+    ProbabilitySampler sampler = TraceSamplers.probabilitySampler(tracePercent);
     Span minorCompaction = Trace.on("minorCompaction", sampler);
     try {
       FileRef newMapfileLocation = tablet.getNextMapFilename(mergeFile == null ? "F" : "M");
diff --git a/server/tserver/src/main/java/org/apache/accumulo/tserver/tablet/Tablet.java b/server/tserver/src/main/java/org/apache/accumulo/tserver/tablet/Tablet.java
index 6d2b2df..914f7f1 100644
--- a/server/tserver/src/main/java/org/apache/accumulo/tserver/tablet/Tablet.java
+++ b/server/tserver/src/main/java/org/apache/accumulo/tserver/tablet/Tablet.java
@@ -87,9 +87,9 @@ import org.apache.accumulo.core.security.ColumnVisibility;
 import org.apache.accumulo.core.spi.cache.BlockCache;
 import org.apache.accumulo.core.tabletserver.log.LogEntry;
 import org.apache.accumulo.core.tabletserver.thrift.TabletStats;
-import org.apache.accumulo.core.trace.ProbabilitySampler;
 import org.apache.accumulo.core.trace.Span;
 import org.apache.accumulo.core.trace.Trace;
+import org.apache.accumulo.core.trace.TraceSamplers;
 import org.apache.accumulo.core.util.LocalityGroupUtil;
 import org.apache.accumulo.core.util.Pair;
 import org.apache.accumulo.core.util.ratelimit.RateLimiter;
@@ -147,6 +147,7 @@ import org.apache.hadoop.fs.FileStatus;
 import org.apache.hadoop.fs.FileSystem;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.io.Text;
+import org.apache.htrace.impl.ProbabilitySampler;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.NoNodeException;
 import org.slf4j.Logger;
@@ -159,6 +160,8 @@ import com.google.common.cache.CacheBuilder;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSet.Builder;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  *
  * Provide access to a single row range in a living TabletServer.
@@ -2131,7 +2134,7 @@ public class Tablet implements TabletCommitter {
     try {
       double tracePercent = tabletServer.getConfiguration()
           .getFraction(Property.TSERV_MAJC_TRACE_PERCENT);
-      ProbabilitySampler sampler = new ProbabilitySampler(tracePercent);
+      ProbabilitySampler sampler = TraceSamplers.probabilitySampler(tracePercent);
       span = Trace.on("majorCompaction", sampler);
 
       majCStats = _majorCompact(reason);
@@ -2552,6 +2555,8 @@ public class Tablet implements TabletCommitter {
 
   // don't release the lock if this method returns true for success; instead, the caller should
   // clean up by calling finishUpdatingLogsUsed()
+  @SuppressFBWarnings(value = "UL_UNRELEASED_LOCK",
+      justification = "lock is released by caller calling finishedUpdatingLogsUsed method")
   @Override
   public boolean beginUpdatingLogsUsed(InMemoryMap memTable, DfsLogger more, boolean mincFinish) {
 
diff --git a/server/tserver/src/main/spotbugs/exclude-filter.xml b/server/tserver/src/main/spotbugs/exclude-filter.xml
deleted file mode 100644
index 23af6c0..0000000
--- a/server/tserver/src/main/spotbugs/exclude-filter.xml
+++ /dev/null
@@ -1,46 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<FindBugsFilter>
-  <Match>
-    <!-- locking is confusing, but probably correct -->
-    <Class name="org.apache.accumulo.tserver.tablet.Tablet" />
-    <Method name="beginUpdatingLogsUsed" params="org.apache.accumulo.tserver.InMemoryMap,org.apache.accumulo.tserver.log.DfsLogger,boolean" returns="boolean" />
-    <Bug code="UL" pattern="UL_UNRELEASED_LOCK" />
-  </Match>
-  <Match>
-    <!-- false positive about forced garbage collection in resource manager -->
-    <Class name="org.apache.accumulo.tserver.TabletServerResourceManager" />
-    <Method name="&lt;init&gt;" params="org.apache.accumulo.tserver.TabletServer,org.apache.accumulo.server.fs.VolumeManager,org.apache.accumulo.server.ServerContext" returns="void" />
-    <Bug code="DM" pattern="DM_GC" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.tserver.NativeMap" />
-    <Method name="loadNativeLib" params="java.util.List"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.tserver.replication.AccumuloReplicaSystem" />
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-  </Match>
-  <Match>
-    <!-- Calling new File on input can be dangerous, but OK here -->
-    <Class name="org.apache.accumulo.tserver.log.TestUpgradePathForWALogs" />
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN"/>
-  </Match>
-</FindBugsFilter>
diff --git a/server/tserver/src/test/java/org/apache/accumulo/tserver/log/TestUpgradePathForWALogs.java b/server/tserver/src/test/java/org/apache/accumulo/tserver/log/TestUpgradePathForWALogs.java
index b516f93..569976e 100644
--- a/server/tserver/src/test/java/org/apache/accumulo/tserver/log/TestUpgradePathForWALogs.java
+++ b/server/tserver/src/test/java/org/apache/accumulo/tserver/log/TestUpgradePathForWALogs.java
@@ -41,6 +41,8 @@ import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class TestUpgradePathForWALogs {
 
   private static final String WALOG_FROM_15 = "/walog-from-15.walog";
@@ -74,6 +76,7 @@ public class TestUpgradePathForWALogs {
     fs.create(SortedLogState.getFinishedMarkerPath(manyMapsPath)).close();
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test code")
   @Test
   public void testUpgradeOf15WALog() throws IOException {
     InputStream walogStream = null;
@@ -108,6 +111,7 @@ public class TestUpgradePathForWALogs {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test code")
   @Test
   public void testBasic16WALogRead() throws IOException {
     String walogToTest = WALOG_FROM_16;
diff --git a/shell/src/main/java/org/apache/accumulo/shell/Shell.java b/shell/src/main/java/org/apache/accumulo/shell/Shell.java
index 1f7d072..1f9b561 100644
--- a/shell/src/main/java/org/apache/accumulo/shell/Shell.java
+++ b/shell/src/main/java/org/apache/accumulo/shell/Shell.java
@@ -175,6 +175,7 @@ import com.beust.jcommander.JCommander;
 import com.beust.jcommander.ParameterException;
 import com.google.auto.service.AutoService;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import jline.console.ConsoleReader;
 import jline.console.UserInterruptException;
 import jline.console.history.FileHistory;
@@ -502,6 +503,7 @@ public class Shell extends ShellOptions implements KeywordExecutable {
     return "Runs Accumulo shell";
   }
 
+  @SuppressFBWarnings(value = "DM_EXIT", justification = "System.exit() from a main class is okay")
   @Override
   public void execute(final String[] args) throws IOException {
     try {
@@ -985,6 +987,8 @@ public class Shell extends ShellOptions implements KeywordExecutable {
   public static class PrintFile implements PrintLine {
     PrintWriter writer;
 
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_OUT",
+        justification = "app is run in same security context as user providing the filename")
     public PrintFile(String filename) throws FileNotFoundException {
       writer = new PrintWriter(
           new BufferedWriter(new OutputStreamWriter(new FileOutputStream(filename), UTF_8)));
diff --git a/shell/src/main/java/org/apache/accumulo/shell/ShellOptionsJC.java b/shell/src/main/java/org/apache/accumulo/shell/ShellOptionsJC.java
index 1bd8afa..22dc6db 100644
--- a/shell/src/main/java/org/apache/accumulo/shell/ShellOptionsJC.java
+++ b/shell/src/main/java/org/apache/accumulo/shell/ShellOptionsJC.java
@@ -38,6 +38,8 @@ import com.beust.jcommander.Parameter;
 import com.beust.jcommander.ParameterException;
 import com.beust.jcommander.converters.FileConverter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ShellOptionsJC {
 
   @Parameter(names = {"-u", "--user"}, description = "username")
@@ -54,6 +56,8 @@ public class ShellOptionsJC {
         }
       },
       FILE("file:") {
+        @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+            justification = "app is run in same security context as user providing the filename")
         @Override
         String process(String value) {
           Scanner scanner = null;
@@ -274,6 +278,8 @@ public class ShellOptionsJC {
     return clientConfigFile;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "app is run in same security context as user providing the filename")
   public Properties getClientProperties() {
     Properties props = new Properties();
     if (getClientConfigFile() != null) {
diff --git a/shell/src/main/java/org/apache/accumulo/shell/ShellUtil.java b/shell/src/main/java/org/apache/accumulo/shell/ShellUtil.java
index 6587ccd..6a1e0ee 100644
--- a/shell/src/main/java/org/apache/accumulo/shell/ShellUtil.java
+++ b/shell/src/main/java/org/apache/accumulo/shell/ShellUtil.java
@@ -34,6 +34,8 @@ import org.apache.hadoop.io.Text;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableMap.Builder;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ShellUtil {
 
   /**
@@ -49,6 +51,8 @@ public class ShellUtil {
    * @throws FileNotFoundException
    *           if the given file doesn't exist
    */
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "app is run in same security context as user providing the filename")
   public static List<Text> scanFile(String filename, boolean decode) throws FileNotFoundException {
     String line;
     List<Text> result = new ArrayList<>();
diff --git a/shell/src/main/java/org/apache/accumulo/shell/commands/ExecfileCommand.java b/shell/src/main/java/org/apache/accumulo/shell/commands/ExecfileCommand.java
index 1581d9a..b48f774 100644
--- a/shell/src/main/java/org/apache/accumulo/shell/commands/ExecfileCommand.java
+++ b/shell/src/main/java/org/apache/accumulo/shell/commands/ExecfileCommand.java
@@ -27,6 +27,8 @@ import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ExecfileCommand extends Command {
   private Option verboseOption;
 
@@ -35,6 +37,8 @@ public class ExecfileCommand extends Command {
     return "specifies a file containing accumulo commands to execute";
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "app is run in same security context as user providing the filename")
   @Override
   public int execute(final String fullCommand, final CommandLine cl, final Shell shellState)
       throws Exception {
diff --git a/shell/src/main/java/org/apache/accumulo/shell/commands/ScriptCommand.java b/shell/src/main/java/org/apache/accumulo/shell/commands/ScriptCommand.java
index 6e2bc60..9af9f3d 100644
--- a/shell/src/main/java/org/apache/accumulo/shell/commands/ScriptCommand.java
+++ b/shell/src/main/java/org/apache/accumulo/shell/commands/ScriptCommand.java
@@ -46,6 +46,8 @@ import org.apache.commons.cli.Option;
 import org.apache.commons.cli.OptionGroup;
 import org.apache.commons.cli.Options;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ScriptCommand extends Command {
 
   // Command to allow user to run scripts, see JSR-223
@@ -54,6 +56,8 @@ public class ScriptCommand extends Command {
   protected Option list, engine, script, file, args, out, function, object;
   private static final String DEFAULT_ENGINE = "rhino";
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "app is run in same security context as user providing the filename")
   @Override
   public int execute(String fullCommand, CommandLine cl, Shell shellState) throws Exception {
 
diff --git a/shell/src/main/spotbugs/exclude-filter.xml b/shell/src/main/spotbugs/exclude-filter.xml
deleted file mode 100644
index 1be3c69..0000000
--- a/shell/src/main/spotbugs/exclude-filter.xml
+++ /dev/null
@@ -1,49 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<FindBugsFilter>
-  <Match>
-    <!-- shell can call System.exit -->
-    <Class name="org.apache.accumulo.shell.Shell" />
-    <Bug code="DM" pattern="DM_EXIT" />
-  </Match>
-  <Match>
-    <!-- output to anywhere OK here -->
-    <Class name="org.apache.accumulo.shell.Shell$PrintFile"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_OUT"/>
-  </Match>
-  <Match>
-    <!-- new file input stream OK here -->
-    <Class name="org.apache.accumulo.shell.ShellOptionsJC"/>
-    <Method name="getClientProperties" params="" returns="java.util.Properties"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN"/>
-  </Match>
-  <Match>
-    <!-- new file input stream OK here -->
-    <Or>
-      <Class name="org.apache.accumulo.shell.commands.ExecfileCommand"/>
-      <Class name="org.apache.accumulo.shell.ShellOptionsJC$PasswordConverter$KeyType$2"/>
-      <Class name="org.apache.accumulo.shell.commands.ScriptCommand"/>
-    </Or>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN"/>
-  </Match>
-  <Match>
-    <!-- new file input stream OK here -->
-    <Class name="org.apache.accumulo.shell.ShellUtil"/>
-    <Method name="scanFile" params="java.lang.String,boolean" returns="java.util.List"/>
-    <Bug code="PATH" pattern="PATH_TRAVERSAL_IN"/>
-  </Match>
-</FindBugsFilter>
diff --git a/start/src/main/java/org/apache/accumulo/start/classloader/AccumuloClassLoader.java b/start/src/main/java/org/apache/accumulo/start/classloader/AccumuloClassLoader.java
index f5d74d6..bd8a46f 100644
--- a/start/src/main/java/org/apache/accumulo/start/classloader/AccumuloClassLoader.java
+++ b/start/src/main/java/org/apache/accumulo/start/classloader/AccumuloClassLoader.java
@@ -32,6 +32,8 @@ import org.apache.commons.configuration.PropertiesConfiguration;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class AccumuloClassLoader {
 
   public static final String GENERAL_CLASSPATHS = "general.classpaths";
@@ -116,6 +118,8 @@ public class AccumuloClassLoader {
   /**
    * Populate the list of URLs with the items in the classpath string
    */
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "class path configuration is controlled by admin, not unchecked user input")
   private static void addUrl(String classpath, ArrayList<URL> urls) throws MalformedURLException {
     classpath = classpath.trim();
     if (classpath.length() == 0)
diff --git a/start/src/main/java/org/apache/accumulo/start/classloader/vfs/AccumuloVFSClassLoader.java b/start/src/main/java/org/apache/accumulo/start/classloader/vfs/AccumuloVFSClassLoader.java
index 6c3ec6a..cb2e342 100644
--- a/start/src/main/java/org/apache/accumulo/start/classloader/vfs/AccumuloVFSClassLoader.java
+++ b/start/src/main/java/org/apache/accumulo/start/classloader/vfs/AccumuloVFSClassLoader.java
@@ -45,6 +45,8 @@ import org.apache.hadoop.fs.FileSystem;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * This class builds a hierarchy of Classloaders in the form of:
  *
@@ -289,6 +291,8 @@ public class AccumuloVFSClassLoader {
     return vfs;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "tmpdir is controlled by admin, not unchecked user input")
   private static File computeTopCacheDir() {
     String cacheDirPath = AccumuloClassLoader.getAccumuloProperty(VFS_CACHE_DIR,
         System.getProperty("java.io.tmpdir"));
diff --git a/start/src/main/java/org/apache/accumulo/start/classloader/vfs/UniqueFileReplicator.java b/start/src/main/java/org/apache/accumulo/start/classloader/vfs/UniqueFileReplicator.java
index 3e3748d..fa93664 100644
--- a/start/src/main/java/org/apache/accumulo/start/classloader/vfs/UniqueFileReplicator.java
+++ b/start/src/main/java/org/apache/accumulo/start/classloader/vfs/UniqueFileReplicator.java
@@ -33,6 +33,8 @@ import org.apache.commons.vfs2.provider.VfsComponentContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class UniqueFileReplicator implements VfsComponent, FileReplicator {
 
   private static final char[] TMP_RESERVED_CHARS = {'?', '/', '\\', ' ', '&', '"', '\'', '*', '#',
@@ -49,6 +51,8 @@ public class UniqueFileReplicator implements VfsComponent, FileReplicator {
       log.warn("Unexpected error creating directory {}", tempDir);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN",
+      justification = "input files are specified by admin, not unchecked user input")
   @Override
   public File replicateFile(FileObject srcFile, FileSelector selector) throws FileSystemException {
     String baseName = srcFile.getName().getBaseName();
diff --git a/start/src/main/spotbugs/exclude-filter.xml b/start/src/main/spotbugs/exclude-filter.xml
deleted file mode 100644
index 9159e5d..0000000
--- a/start/src/main/spotbugs/exclude-filter.xml
+++ /dev/null
@@ -1,36 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<FindBugsFilter>
-	<Match>
-		<!-- Calling new File on input can be dangerous, but OK here -->
-		<Class name="org.apache.accumulo.start.classloader.AccumuloClassLoader" />
-		<Method name="addUrl" params="java.lang.String, java.util.ArrayList"/>
-		<Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-	</Match>
-	<Match>
-		<!-- Calling new File on input can be dangerous, but OK here -->
-		<Class name="org.apache.accumulo.start.classloader.vfs.AccumuloVFSClassLoader" />
-		<Method name="computeTopCacheDir" />
-		<Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-	</Match>
-	<Match>
-		<!-- Calling new File on input can be dangerous, but OK here -->
-		<Class name="org.apache.accumulo.start.classloader.vfs.UniqueFileReplicator" />
-		<Method name="replicateFile" params="org.apache.commons.vfs2.FileObject, org.apache.commons.vfs2.FileSelector"/>
-		<Bug code="PATH" pattern="PATH_TRAVERSAL_IN" />
-	</Match>
-</FindBugsFilter>
diff --git a/test/src/main/java/org/apache/accumulo/harness/AccumuloITBase.java b/test/src/main/java/org/apache/accumulo/harness/AccumuloITBase.java
index 3cbf3c2..68309d0 100644
--- a/test/src/main/java/org/apache/accumulo/harness/AccumuloITBase.java
+++ b/test/src/main/java/org/apache/accumulo/harness/AccumuloITBase.java
@@ -28,6 +28,8 @@ import org.junit.rules.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Methods, setup and/or infrastructure which are common to any Accumulo integration test.
  */
@@ -55,11 +57,13 @@ public class AccumuloITBase {
    *          exist
    * @return the new directory (is not created)
    */
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public static File getSslDir(File baseDir) {
     assertTrue(baseDir.exists() && baseDir.isDirectory());
     return new File(baseDir.getParentFile(), baseDir.getName() + "-ssl");
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public static File createTestDir(String name) {
     File baseDir = new File(System.getProperty("user.dir") + "/target/mini-tests");
     assertTrue(baseDir.mkdirs() || baseDir.isDirectory());
diff --git a/test/src/main/java/org/apache/accumulo/harness/MiniClusterHarness.java b/test/src/main/java/org/apache/accumulo/harness/MiniClusterHarness.java
index 00ed99f..7a06019 100644
--- a/test/src/main/java/org/apache/accumulo/harness/MiniClusterHarness.java
+++ b/test/src/main/java/org/apache/accumulo/harness/MiniClusterHarness.java
@@ -47,6 +47,8 @@ import org.apache.hadoop.fs.CommonConfigurationKeysPublic;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Harness that sets up a MiniAccumuloCluster in a manner expected for Accumulo integration tests.
  */
@@ -195,6 +197,7 @@ public class MiniClusterHarness {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "paths provided by test")
   protected void configureForSsl(MiniAccumuloConfigImpl cfg, File folder) {
     Map<String,String> siteConfig = cfg.getSiteConfig();
     if (TRUE.equals(siteConfig.get(Property.INSTANCE_RPC_SSL_ENABLED.getKey()))) {
diff --git a/test/src/main/java/org/apache/accumulo/harness/TestingKdc.java b/test/src/main/java/org/apache/accumulo/harness/TestingKdc.java
index 5f2d4ef..9cd25c9 100644
--- a/test/src/main/java/org/apache/accumulo/harness/TestingKdc.java
+++ b/test/src/main/java/org/apache/accumulo/harness/TestingKdc.java
@@ -31,6 +31,8 @@ import org.apache.hadoop.minikdc.MiniKdc;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Creates a {@link MiniKdc} for tests to use to exercise secure Accumulo
  */
@@ -107,6 +109,8 @@ public class TestingKdc {
   /**
    * Starts the KDC and creates the principals and their keytabs
    */
+  @SuppressFBWarnings(value = {"PATH_TRAVERSAL_IN", "SWL_SLEEP_WITH_LOCK_HELD"},
+      justification = "path provided by test; sleep is okay for a brief pause")
   public synchronized void start() throws Exception {
     checkArgument(!started, "KDC was already started");
     kdc.start();
diff --git a/test/src/main/java/org/apache/accumulo/harness/conf/AccumuloClusterPropertyConfiguration.java b/test/src/main/java/org/apache/accumulo/harness/conf/AccumuloClusterPropertyConfiguration.java
index c21a9ab..d2aac5e 100644
--- a/test/src/main/java/org/apache/accumulo/harness/conf/AccumuloClusterPropertyConfiguration.java
+++ b/test/src/main/java/org/apache/accumulo/harness/conf/AccumuloClusterPropertyConfiguration.java
@@ -31,6 +31,8 @@ import org.apache.accumulo.harness.AccumuloClusterHarness.ClusterType;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Base class for extracting configuration values from Java Properties
  */
@@ -46,6 +48,7 @@ public abstract class AccumuloClusterPropertyConfiguration implements AccumuloCl
 
   public static final String ACCUMULO_CLUSTER_CLIENT_CONF_KEY = "accumulo.it.cluster.clientconf";
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public static AccumuloClusterPropertyConfiguration get() {
     Properties systemProperties = System.getProperties();
 
@@ -126,6 +129,7 @@ public abstract class AccumuloClusterPropertyConfiguration implements AccumuloCl
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public Map<String,String> getConfiguration(ClusterType type) {
     requireNonNull(type);
 
diff --git a/test/src/main/java/org/apache/accumulo/harness/conf/StandaloneAccumuloClusterConfiguration.java b/test/src/main/java/org/apache/accumulo/harness/conf/StandaloneAccumuloClusterConfiguration.java
index 9ec88c4..b272862 100644
--- a/test/src/main/java/org/apache/accumulo/harness/conf/StandaloneAccumuloClusterConfiguration.java
+++ b/test/src/main/java/org/apache/accumulo/harness/conf/StandaloneAccumuloClusterConfiguration.java
@@ -38,6 +38,8 @@ import org.apache.hadoop.security.UserGroupInformation;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Extract connection information to a standalone Accumulo instance from Java properties
  */
@@ -93,6 +95,7 @@ public class StandaloneAccumuloClusterConfiguration extends AccumuloClusterPrope
   private List<ClusterUser> clusterUsers;
   private File clientPropsFile;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public StandaloneAccumuloClusterConfiguration(File clientPropsFile) {
     ClusterType type = getClusterType();
     if (ClusterType.STANDALONE != type) {
@@ -155,6 +158,7 @@ public class StandaloneAccumuloClusterConfiguration extends AccumuloClusterPrope
     return password;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public File getAdminKeytab() {
     String keytabPath = conf.get(ACCUMULO_STANDALONE_ADMIN_KEYTAB_KEY);
     if (keytabPath == null || keytabPath.isEmpty()) {
diff --git a/test/src/main/java/org/apache/accumulo/test/AuditMessageIT.java b/test/src/main/java/org/apache/accumulo/test/AuditMessageIT.java
index a71defe..18c7037 100644
--- a/test/src/main/java/org/apache/accumulo/test/AuditMessageIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/AuditMessageIT.java
@@ -57,6 +57,8 @@ import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Tests that Accumulo is outputting audit messages as expected. Since this is using
  * MiniAccumuloCluster, it could take a while if we test everything in isolation. We test blocks of
@@ -282,6 +284,7 @@ public class AuditMessageIT extends ConfigurableMacBase {
         findAuditMessage(auditMessages, "action: dropUser; targetUser: " + AUDIT_USER_2));
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "paths provided by test")
   @Test
   public void testImportExportOperationsAudits()
       throws AccumuloSecurityException, AccumuloException, TableExistsException,
diff --git a/test/src/main/java/org/apache/accumulo/test/BadDeleteMarkersCreatedIT.java b/test/src/main/java/org/apache/accumulo/test/BadDeleteMarkersCreatedIT.java
index 25b7a01..480f1ea 100644
--- a/test/src/main/java/org/apache/accumulo/test/BadDeleteMarkersCreatedIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/BadDeleteMarkersCreatedIT.java
@@ -38,9 +38,9 @@ import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.metadata.MetadataTable;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema;
 import org.apache.accumulo.core.security.Authorizations;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooLock;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.harness.AccumuloClusterHarness;
 import org.apache.accumulo.minicluster.ServerType;
 import org.apache.accumulo.minicluster.impl.MiniAccumuloConfigImpl;
diff --git a/test/src/main/java/org/apache/accumulo/test/GetFileInfoBulkIT.java b/test/src/main/java/org/apache/accumulo/test/GetFileInfoBulkIT.java
index 5575775..b3f592e 100644
--- a/test/src/main/java/org/apache/accumulo/test/GetFileInfoBulkIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/GetFileInfoBulkIT.java
@@ -54,6 +54,8 @@ import org.junit.Test;
 
 import com.google.gson.Gson;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 // ACCUMULO-3949, ACCUMULO-3953
 public class GetFileInfoBulkIT extends ConfigurableMacBase {
 
@@ -63,17 +65,18 @@ public class GetFileInfoBulkIT extends ConfigurableMacBase {
     cfg.useMiniDFS(true);
   }
 
-  @SuppressWarnings("unchecked")
-  long getOpts() throws Exception {
+  @SuppressFBWarnings(value = {"PATH_TRAVERSAL_IN", "URLCONNECTION_SSRF_FD"},
+      justification = "path provided by test; url provided by test")
+  private long getOpts() throws Exception {
     String uri = getCluster().getMiniDfs().getHttpUri(0);
     URL url = new URL(uri + "/jmx");
     log.debug("Fetching web page " + url);
     String jsonString = FunctionalTestUtils.readAll(url.openStream());
     Gson gson = new Gson();
-    Map<Object,Object> jsonObject = (Map<Object,Object>) gson.fromJson(jsonString, Object.class);
-    List<Object> beans = (List<Object>) jsonObject.get("beans");
+    Map<?,?> jsonObject = (Map<?,?>) gson.fromJson(jsonString, Object.class);
+    List<?> beans = (List<?>) jsonObject.get("beans");
     for (Object bean : beans) {
-      Map<Object,Object> map = (Map<Object,Object>) bean;
+      Map<?,?> map = (Map<?,?>) bean;
       if (map.get("name").toString().equals("Hadoop:service=NameNode,name=NameNodeActivity")) {
         return (long) Double.parseDouble(map.get("FileInfoOps").toString());
       }
diff --git a/test/src/main/java/org/apache/accumulo/test/ListTables.java b/test/src/main/java/org/apache/accumulo/test/ListTables.java
index edce280..8cb5e76 100644
--- a/test/src/main/java/org/apache/accumulo/test/ListTables.java
+++ b/test/src/main/java/org/apache/accumulo/test/ListTables.java
@@ -20,14 +20,14 @@ import java.util.Map.Entry;
 
 import org.apache.accumulo.core.client.impl.Table;
 import org.apache.accumulo.core.client.impl.Tables;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 
 /**
  * This little program is used by the functional test to get a list of table ids.
  */
 public class ListTables {
   public static void main(String[] args) throws Exception {
-    ClientOpts opts = new ClientOpts();
+    ServerUtilOpts opts = new ServerUtilOpts();
     opts.parseArgs(ListTables.class.getName(), args);
     for (Entry<String,Table.ID> table : Tables.getNameToIdMap(opts.getClientContext()).entrySet())
       System.out.println(table.getKey() + " => " + table.getValue());
diff --git a/test/src/main/java/org/apache/accumulo/test/QueryMetadataTable.java b/test/src/main/java/org/apache/accumulo/test/QueryMetadataTable.java
index b8ea0d7..125bad7 100644
--- a/test/src/main/java/org/apache/accumulo/test/QueryMetadataTable.java
+++ b/test/src/main/java/org/apache/accumulo/test/QueryMetadataTable.java
@@ -38,7 +38,7 @@ import org.apache.accumulo.core.data.impl.KeyExtent;
 import org.apache.accumulo.core.metadata.MetadataTable;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection;
 import org.apache.accumulo.core.security.Authorizations;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.hadoop.io.Text;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -87,7 +87,7 @@ public class QueryMetadataTable {
     }
   }
 
-  static class Opts extends ClientOpts {
+  static class Opts extends ServerUtilOpts {
     @Parameter(names = "--numQueries", description = "number of queries to run")
     int numQueries = 1;
     @Parameter(names = "--numThreads", description = "number of threads used to run the queries")
diff --git a/test/src/main/java/org/apache/accumulo/test/ShellServerIT.java b/test/src/main/java/org/apache/accumulo/test/ShellServerIT.java
index a0e59cb..55cb011 100644
--- a/test/src/main/java/org/apache/accumulo/test/ShellServerIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/ShellServerIT.java
@@ -113,6 +113,7 @@ import org.slf4j.LoggerFactory;
 import com.google.common.collect.Iterables;
 import com.google.common.collect.Iterators;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import jline.console.ConsoleReader;
 
 @Category({MiniClusterOnlyTests.class, SunnyDayTests.class})
@@ -351,6 +352,7 @@ public class ShellServerIT extends SharedMiniClusterBase {
     return 60;
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void exporttableImporttable() throws Exception {
     final String table = name.getMethodName(), table2 = table + "2";
@@ -445,6 +447,7 @@ public class ShellServerIT extends SharedMiniClusterBase {
 
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void execfile() throws Exception {
     // execfile
@@ -1378,6 +1381,7 @@ public class ShellServerIT extends SharedMiniClusterBase {
     ts.exec("history", true, "history", true);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void importDirectory() throws Exception {
     final String table = name.getMethodName();
@@ -1616,6 +1620,7 @@ public class ShellServerIT extends SharedMiniClusterBase {
     ts.exec("deletetable -f " + table, true);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void testPertableClasspath() throws Exception {
     final String table = name.getMethodName();
@@ -2738,6 +2743,8 @@ public class ShellServerIT extends SharedMiniClusterBase {
     return splits;
   }
 
+  @SuppressFBWarnings(value = "PREDICTABLE_RANDOM",
+      justification = "predictable random is okay for testing")
   private Collection<Text> generateBinarySplits(final int numItems, final int len) {
     Set<Text> splits = new HashSet<>();
     Random rand = new Random();
diff --git a/test/src/main/java/org/apache/accumulo/test/TestBinaryRows.java b/test/src/main/java/org/apache/accumulo/test/TestBinaryRows.java
index 22652e1..fbac539 100644
--- a/test/src/main/java/org/apache/accumulo/test/TestBinaryRows.java
+++ b/test/src/main/java/org/apache/accumulo/test/TestBinaryRows.java
@@ -34,7 +34,7 @@ import org.apache.accumulo.core.data.Mutation;
 import org.apache.accumulo.core.data.Range;
 import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.util.TextUtil;
-import org.apache.accumulo.server.cli.ClientOnRequiredTable;
+import org.apache.accumulo.server.cli.ServerUtilOnRequiredTable;
 import org.apache.hadoop.io.Text;
 
 import com.beust.jcommander.Parameter;
@@ -75,7 +75,7 @@ public class TestBinaryRows {
     return l;
   }
 
-  public static class Opts extends ClientOnRequiredTable {
+  public static class Opts extends ServerUtilOnRequiredTable {
     @Parameter(names = "--mode",
         description = "either 'ingest', 'delete', 'randomLookups', 'split',"
             + " 'verify', 'verifyDeleted'",
diff --git a/test/src/main/java/org/apache/accumulo/test/TestIngest.java b/test/src/main/java/org/apache/accumulo/test/TestIngest.java
index b710b76..61c6a37 100644
--- a/test/src/main/java/org/apache/accumulo/test/TestIngest.java
+++ b/test/src/main/java/org/apache/accumulo/test/TestIngest.java
@@ -57,6 +57,8 @@ import org.apache.log4j.Logger;
 
 import com.beust.jcommander.Parameter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class TestIngest {
   public static final Authorizations AUTHS = new Authorizations("L1", "L2", "G1", "GROUP2");
 
@@ -206,6 +208,8 @@ public class TestIngest {
     }
   }
 
+  @SuppressFBWarnings(value = "PREDICTABLE_RANDOM",
+      justification = "predictable random is okay for testing")
   public static void ingest(AccumuloClient accumuloClient, FileSystem fs, Opts opts,
       BatchWriterOpts bwOpts) throws IOException, AccumuloException, AccumuloSecurityException,
       TableNotFoundException, MutationsRejectedException, TableExistsException {
diff --git a/test/src/main/java/org/apache/accumulo/test/ThriftServerBindsBeforeZooKeeperLockIT.java b/test/src/main/java/org/apache/accumulo/test/ThriftServerBindsBeforeZooKeeperLockIT.java
index 3ee711b..33b0ec2 100644
--- a/test/src/main/java/org/apache/accumulo/test/ThriftServerBindsBeforeZooKeeperLockIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/ThriftServerBindsBeforeZooKeeperLockIT.java
@@ -44,6 +44,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.ImmutableMap;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Test class that verifies "HA-capable" servers put up their thrift servers before acquiring their
  * ZK lock.
@@ -124,6 +126,8 @@ public class ThriftServerBindsBeforeZooKeeperLockIT extends AccumuloClusterHarne
     }
   }
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SOCKET",
+      justification = "unencrypted socket is okay for testing")
   @Test
   public void testMasterService() throws Exception {
     final MiniAccumuloClusterImpl cluster = (MiniAccumuloClusterImpl) getCluster();
@@ -187,6 +191,8 @@ public class ThriftServerBindsBeforeZooKeeperLockIT extends AccumuloClusterHarne
     }
   }
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SOCKET",
+      justification = "unencrypted socket is okay for testing")
   @Test
   public void testGarbageCollectorPorts() throws Exception {
     final MiniAccumuloClusterImpl cluster = (MiniAccumuloClusterImpl) getCluster();
diff --git a/test/src/main/java/org/apache/accumulo/test/TransportCachingIT.java b/test/src/main/java/org/apache/accumulo/test/TransportCachingIT.java
index 5af4aee..bb8fba5 100644
--- a/test/src/main/java/org/apache/accumulo/test/TransportCachingIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/TransportCachingIT.java
@@ -32,8 +32,8 @@ import org.apache.accumulo.core.conf.ConfigurationTypeHelper;
 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.util.ServerServices;
 import org.apache.accumulo.core.util.ServerServices.Service;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.harness.AccumuloClusterHarness;
 import org.apache.thrift.transport.TTransport;
 import org.apache.thrift.transport.TTransportException;
diff --git a/test/src/main/java/org/apache/accumulo/test/UnusedWALIT.java b/test/src/main/java/org/apache/accumulo/test/UnusedWALIT.java
index 3fad6ca..f823073 100644
--- a/test/src/main/java/org/apache/accumulo/test/UnusedWALIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/UnusedWALIT.java
@@ -33,12 +33,12 @@ import org.apache.accumulo.core.data.Range;
 import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.metadata.MetadataTable;
 import org.apache.accumulo.core.security.Authorizations;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.minicluster.ServerType;
 import org.apache.accumulo.minicluster.impl.MiniAccumuloConfigImpl;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.log.WalStateManager;
 import org.apache.accumulo.server.master.state.TServerInstance;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.test.functional.ConfigurableMacBase;
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.fs.RawLocalFileSystem;
diff --git a/test/src/main/java/org/apache/accumulo/test/UserCompactionStrategyIT.java b/test/src/main/java/org/apache/accumulo/test/UserCompactionStrategyIT.java
index 6e955d0..ad4afbc 100644
--- a/test/src/main/java/org/apache/accumulo/test/UserCompactionStrategyIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/UserCompactionStrategyIT.java
@@ -60,6 +60,8 @@ import org.junit.Test;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class UserCompactionStrategyIT extends AccumuloClusterHarness {
 
   @Override
@@ -180,6 +182,7 @@ public class UserCompactionStrategyIT extends AccumuloClusterHarness {
     assertEquals(2, FunctionalTestUtils.countRFiles(c, tableName));
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   private static File installJar(File destDir, String jarFile) throws IOException {
     File destName = new File(destDir, new File(jarFile).getName());
     FileUtils.copyInputStreamToFile(ConfigurableCompactionIT.class.getResourceAsStream(jarFile),
diff --git a/test/src/main/java/org/apache/accumulo/test/VerifyIngest.java b/test/src/main/java/org/apache/accumulo/test/VerifyIngest.java
index c04dea0..85d8d1c 100644
--- a/test/src/main/java/org/apache/accumulo/test/VerifyIngest.java
+++ b/test/src/main/java/org/apache/accumulo/test/VerifyIngest.java
@@ -40,6 +40,8 @@ import org.slf4j.LoggerFactory;
 
 import com.beust.jcommander.Parameter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class VerifyIngest {
 
   private static final Logger log = LoggerFactory.getLogger(VerifyIngest.class);
@@ -77,6 +79,8 @@ public class VerifyIngest {
     }
   }
 
+  @SuppressFBWarnings(value = "PREDICTABLE_RANDOM",
+      justification = "predictable random is okay for testing")
   public static void verifyIngest(AccumuloClient accumuloClient, Opts opts, ScannerOpts scanOpts)
       throws AccumuloException, AccumuloSecurityException, TableNotFoundException {
     byte[][] bytevals = TestIngest.generateValues(opts.dataSize);
diff --git a/test/src/main/java/org/apache/accumulo/test/VolumeIT.java b/test/src/main/java/org/apache/accumulo/test/VolumeIT.java
index 202e2cb..67446e7 100644
--- a/test/src/main/java/org/apache/accumulo/test/VolumeIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/VolumeIT.java
@@ -61,8 +61,8 @@ import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.Da
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.security.TablePermission;
 import org.apache.accumulo.core.util.CachedConfiguration;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooReader;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.minicluster.impl.MiniAccumuloConfigImpl;
 import org.apache.accumulo.server.ServerConstants;
 import org.apache.accumulo.server.init.Initialize;
@@ -81,6 +81,8 @@ import org.apache.hadoop.io.Text;
 import org.apache.zookeeper.KeeperException.NoNodeException;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class VolumeIT extends ConfigurableMacBase {
 
   private static final Text EMPTY = new Text();
@@ -518,6 +520,7 @@ public class VolumeIT extends ConfigurableMacBase {
 
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "paths provided by test")
   private void testReplaceVolume(boolean cleanShutdown) throws Exception {
     String[] tableNames = getUniqueNames(3);
 
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/BulkLoadIT.java b/test/src/main/java/org/apache/accumulo/test/functional/BulkLoadIT.java
index 77e26b0..3aadc9a 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/BulkLoadIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/BulkLoadIT.java
@@ -70,6 +70,8 @@ import org.junit.Test;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Tests new bulk import technique. If the old technique ever gets removed this will replace
  * {@link BulkFileIT}
@@ -376,6 +378,8 @@ public class BulkLoadIT extends AccumuloClusterHarness {
     }
   }
 
+  @SuppressFBWarnings(value = {"PATH_TRAVERSAL_IN", "WEAK_MESSAGE_DIGEST_SHA1"},
+      justification = "path provided by test; sha-1 is okay for test")
   private String hash(String filename) {
     try {
       byte data[] = Files.readAllBytes(Paths.get(filename.replaceFirst("^file:", "")));
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/CacheTestClean.java b/test/src/main/java/org/apache/accumulo/test/functional/CacheTestClean.java
index e6b094f..3ac49c1 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/CacheTestClean.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/CacheTestClean.java
@@ -21,12 +21,15 @@ import java.io.IOException;
 
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.commons.io.FileUtils;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CacheTestClean {
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public static void main(String[] args) throws Exception {
     String rootDir = args[0];
     File reportDir = new File(args[1]);
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/CacheTestReader.java b/test/src/main/java/org/apache/accumulo/test/functional/CacheTestReader.java
index 809d75a..fb4631f 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/CacheTestReader.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/CacheTestReader.java
@@ -31,7 +31,11 @@ import java.util.concurrent.TimeUnit;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CacheTestReader {
+
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public static void main(String[] args) throws Exception {
     String rootDir = args[0];
     String reportDir = args[1];
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/CacheTestWriter.java b/test/src/main/java/org/apache/accumulo/test/functional/CacheTestWriter.java
index 43ac5f6..31f6d2c 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/CacheTestWriter.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/CacheTestWriter.java
@@ -33,14 +33,18 @@ import java.util.concurrent.TimeUnit;
 
 import org.apache.accumulo.core.conf.SiteConfiguration;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeMissingPolicy;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 
 public class CacheTestWriter {
 
   static final int NUM_DATA = 3;
 
+  @SuppressFBWarnings(value = {"PATH_TRAVERSAL_IN", "OBJECT_DESERIALIZATION"},
+      justification = "path provided by test; object deserialization is okay for test")
   public static void main(String[] args) throws Exception {
     IZooReaderWriter zk = new ZooReaderWriter(new SiteConfiguration());
 
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/ConfigurableCompactionIT.java b/test/src/main/java/org/apache/accumulo/test/functional/ConfigurableCompactionIT.java
index d1d87c0..93f8a66 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/ConfigurableCompactionIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/ConfigurableCompactionIT.java
@@ -49,6 +49,8 @@ import org.junit.Test;
 
 import com.google.common.collect.Iterators;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ConfigurableCompactionIT extends ConfigurableMacBase {
 
   @Override
@@ -126,6 +128,7 @@ public class ConfigurableCompactionIT extends ConfigurableMacBase {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   private static File installJar(File destDir, String jarFile) throws IOException {
     File destName = new File(destDir, new File(jarFile).getName());
     FileUtils.copyInputStreamToFile(ConfigurableCompactionIT.class.getResourceAsStream(jarFile),
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/ConfigurableMacBase.java b/test/src/main/java/org/apache/accumulo/test/functional/ConfigurableMacBase.java
index 7d3e157..98f664d 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/ConfigurableMacBase.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/ConfigurableMacBase.java
@@ -54,6 +54,8 @@ import org.junit.experimental.categories.Category;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * General Integration-Test base class that provides access to a {@link MiniAccumuloCluster} for
  * testing. Tests using these typically do very disruptive things to the instance, and require
@@ -83,6 +85,7 @@ public class ConfigurableMacBase extends AccumuloITBase {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "paths provided by test")
   protected static void configureForSsl(MiniAccumuloConfigImpl cfg, File sslDir) {
     Map<String,String> siteConfig = cfg.getSiteConfig();
     if ("true".equals(siteConfig.get(Property.INSTANCE_RPC_SSL_ENABLED.getKey()))) {
@@ -148,6 +151,7 @@ public class ConfigurableMacBase extends AccumuloITBase {
         lastException);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   private void createMiniAccumulo() throws Exception {
     // createTestDir will give us a empty directory, we don't need to clean it up ourselves
     File baseDir = createTestDir(this.getClass().getName() + "_" + this.testName.getMethodName());
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/CreateInitialSplitsIT.java b/test/src/main/java/org/apache/accumulo/test/functional/CreateInitialSplitsIT.java
index 7774223..0e1da68 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/CreateInitialSplitsIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/CreateInitialSplitsIT.java
@@ -44,6 +44,8 @@ import org.apache.hadoop.io.Text;
 import org.junit.Before;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CreateInitialSplitsIT extends AccumuloClusterHarness {
 
   private AccumuloClient client;
@@ -216,6 +218,8 @@ public class CreateInitialSplitsIT extends AccumuloClusterHarness {
     return generateBinarySplits(numItems, len, false);
   }
 
+  @SuppressFBWarnings(value = "PREDICTABLE_RANDOM",
+      justification = "predictable random is okay for testing")
   private SortedSet<Text> generateBinarySplits(final int numItems, final int len,
       final boolean useB64) {
     SortedSet<Text> splits = new TreeSet<>();
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/FunctionalTestUtils.java b/test/src/main/java/org/apache/accumulo/test/functional/FunctionalTestUtils.java
index e80edcb..9464eff 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/FunctionalTestUtils.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/FunctionalTestUtils.java
@@ -63,6 +63,8 @@ import org.apache.zookeeper.KeeperException;
 
 import com.google.common.collect.Iterators;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class FunctionalTestUtils {
 
   public static int countRFiles(AccumuloClient c, String tableName) throws Exception {
@@ -164,6 +166,7 @@ public class FunctionalTestUtils {
     return result.toString();
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public static String readAll(MiniAccumuloClusterImpl c, Class<?> klass, Process p)
       throws Exception {
     for (LogWriter writer : c.getLogWriters())
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/GarbageCollectorIT.java b/test/src/main/java/org/apache/accumulo/test/functional/GarbageCollectorIT.java
index 05589fc..dd90324 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/GarbageCollectorIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/GarbageCollectorIT.java
@@ -52,15 +52,15 @@ import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.security.TablePermission;
 import org.apache.accumulo.core.util.ServerServices;
 import org.apache.accumulo.core.util.ServerServices.Service;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooLock;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.gc.SimpleGarbageCollector;
 import org.apache.accumulo.minicluster.MemoryUnit;
 import org.apache.accumulo.minicluster.ServerType;
 import org.apache.accumulo.minicluster.impl.MiniAccumuloConfigImpl;
 import org.apache.accumulo.minicluster.impl.ProcessNotFoundException;
 import org.apache.accumulo.minicluster.impl.ProcessReference;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.test.TestIngest;
 import org.apache.accumulo.test.VerifyIngest;
 import org.apache.hadoop.conf.Configuration;
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/HalfDeadTServerIT.java b/test/src/main/java/org/apache/accumulo/test/functional/HalfDeadTServerIT.java
index ae0dc8b..704aa93 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/HalfDeadTServerIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/HalfDeadTServerIT.java
@@ -44,6 +44,8 @@ import org.apache.accumulo.tserver.TabletServer;
 import org.apache.hadoop.conf.Configuration;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class HalfDeadTServerIT extends ConfigurableMacBase {
 
   @Override
@@ -112,6 +114,8 @@ public class HalfDeadTServerIT extends ConfigurableMacBase {
     return test(seconds, false);
   }
 
+  @SuppressFBWarnings(value = {"PATH_TRAVERSAL_IN", "COMMAND_INJECTION"},
+      justification = "path provided by test; command args provided by test")
   public String test(int seconds, boolean expectTserverDied) throws Exception {
     if (!makeDiskFailureLibrary())
       return null;
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/KerberosIT.java b/test/src/main/java/org/apache/accumulo/test/functional/KerberosIT.java
index 2fb8229..96f3092 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/KerberosIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/KerberosIT.java
@@ -85,6 +85,8 @@ import org.slf4j.LoggerFactory;
 import com.google.common.collect.Iterables;
 import com.google.common.collect.Sets;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * MAC test which uses {@link MiniKdc} to simulate ta secure environment. Can be used as a sanity
  * check for Kerberos/SASL testing.
@@ -180,6 +182,7 @@ public class KerberosIT extends AccumuloITBase {
     });
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void testNewUser() throws Exception {
     String newUser = testName.getMethodName();
@@ -233,6 +236,7 @@ public class KerberosIT extends AccumuloITBase {
     });
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void testUserPrivilegesThroughGrant() throws Exception {
     String user1 = testName.getMethodName();
@@ -294,6 +298,7 @@ public class KerberosIT extends AccumuloITBase {
     });
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void testUserPrivilegesForTable() throws Exception {
     String user1 = testName.getMethodName();
@@ -469,6 +474,7 @@ public class KerberosIT extends AccumuloITBase {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void testGetDelegationTokenDenied() throws Exception {
     String newUser = testName.getMethodName();
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/KerberosProxyIT.java b/test/src/main/java/org/apache/accumulo/test/functional/KerberosProxyIT.java
index 23c288d..38ed7e5 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/KerberosProxyIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/KerberosProxyIT.java
@@ -88,6 +88,8 @@ import org.slf4j.LoggerFactory;
 import com.google.common.base.Throwables;
 import com.google.common.collect.Iterables;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Tests impersonation of clients over Kerberos+SASL. "Proxy" may be referring to the Accumulo Proxy
  * service or it may be referring to the notion of a username overriding the real username of the
@@ -421,6 +423,7 @@ public class KerberosProxyIT extends AccumuloITBase {
     ugiTransport.close();
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void testDisallowedClientForImpersonation() throws Exception {
     String user = testName.getMethodName();
@@ -472,6 +475,7 @@ public class KerberosProxyIT extends AccumuloITBase {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void testMismatchPrincipals() throws Exception {
     ClusterUser rootUser = kdc.getRootUser();
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/LargeRowIT.java b/test/src/main/java/org/apache/accumulo/test/functional/LargeRowIT.java
index b9f0cf9..d77c8b7 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/LargeRowIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/LargeRowIT.java
@@ -49,6 +49,8 @@ import org.junit.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class LargeRowIT extends AccumuloClusterHarness {
   private static final Logger log = LoggerFactory.getLogger(LargeRowIT.class);
 
@@ -106,6 +108,8 @@ public class LargeRowIT extends AccumuloClusterHarness {
     }
   }
 
+  @SuppressFBWarnings(value = "PREDICTABLE_RANDOM",
+      justification = "predictable random is okay for testing")
   @Test
   public void run() throws Exception {
     Random r = new Random();
@@ -146,6 +150,8 @@ public class LargeRowIT extends AccumuloClusterHarness {
     basicTest(c, PRE_SPLIT_TABLE_NAME, NUM_PRE_SPLITS);
   }
 
+  @SuppressFBWarnings(value = "PREDICTABLE_RANDOM",
+      justification = "predictable random is okay for testing")
   private void basicTest(AccumuloClient c, String table, int expectedSplits) throws Exception {
     BatchWriter bw = c.createBatchWriter(table, new BatchWriterConfig());
 
@@ -187,6 +193,8 @@ public class LargeRowIT extends AccumuloClusterHarness {
     FunctionalTestUtils.checkSplits(c, table, expectedSplits, expectedSplits);
   }
 
+  @SuppressFBWarnings(value = "PREDICTABLE_RANDOM",
+      justification = "predictable random is okay for testing")
   private void verify(AccumuloClient c, String table) throws Exception {
     Random r = new Random();
     byte rowData[] = new byte[ROW_SIZE];
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/MapReduceIT.java b/test/src/main/java/org/apache/accumulo/test/functional/MapReduceIT.java
index c234ad6..ea95724 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/MapReduceIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/MapReduceIT.java
@@ -43,6 +43,8 @@ import org.apache.accumulo.test.mapreduce.RowHash;
 import org.apache.hadoop.io.Text;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class MapReduceIT extends ConfigurableMacBase {
 
   @Override
@@ -65,6 +67,7 @@ public class MapReduceIT extends ConfigurableMacBase {
     runTest(getClient(), getCluster());
   }
 
+  @SuppressFBWarnings(value = "WEAK_MESSAGE_DIGEST_MD5", justification = "md5 is okay for testing")
   static void runTest(AccumuloClient c, MiniAccumuloClusterImpl cluster) throws AccumuloException,
       AccumuloSecurityException, TableExistsException, TableNotFoundException,
       MutationsRejectedException, IOException, InterruptedException, NoSuchAlgorithmException {
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/MaxOpenIT.java b/test/src/main/java/org/apache/accumulo/test/functional/MaxOpenIT.java
index 3a9bbc4..454798b 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/MaxOpenIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/MaxOpenIT.java
@@ -39,6 +39,8 @@ import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * A functional test that exercises hitting the max open file limit on a tablet server. This test
  * assumes there are one or two tablet servers.
@@ -128,6 +130,8 @@ public class MaxOpenIT extends AccumuloClusterHarness {
 
   }
 
+  @SuppressFBWarnings(value = "PREDICTABLE_RANDOM",
+      justification = "predictable random is okay for testing")
   private long batchScan(AccumuloClient c, String tableName, List<Range> ranges, int threads)
       throws Exception {
     try (BatchScanner bs = c.createBatchScanner(tableName, TestIngest.AUTHS, threads)) {
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/MonitorSslIT.java b/test/src/main/java/org/apache/accumulo/test/functional/MonitorSslIT.java
index 85f85a0..6deee37 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/MonitorSslIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/MonitorSslIT.java
@@ -43,13 +43,15 @@ import org.apache.hadoop.conf.Configuration;
 import org.junit.BeforeClass;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Check SSL for the Monitor
  */
 public class MonitorSslIT extends ConfigurableMacBase {
   @BeforeClass
   public static void initHttps() throws NoSuchAlgorithmException, KeyManagementException {
-    SSLContext ctx = SSLContext.getInstance("SSL");
+    SSLContext ctx = SSLContext.getInstance("TLSv1.2");
     TrustManager[] tm = {new TestTrustManager()};
     ctx.init(new KeyManager[0], tm, new SecureRandom());
     SSLContext.setDefault(ctx);
@@ -57,6 +59,8 @@ public class MonitorSslIT extends ConfigurableMacBase {
     HttpsURLConnection.setDefaultHostnameVerifier(new TestHostnameVerifier());
   }
 
+  @SuppressFBWarnings(value = "WEAK_TRUST_MANAGER",
+      justification = "trust manager is okay for testing")
   private static class TestTrustManager implements X509TrustManager {
     @Override
     public void checkClientTrusted(X509Certificate[] arg0, String arg1)
@@ -72,6 +76,7 @@ public class MonitorSslIT extends ConfigurableMacBase {
     }
   }
 
+  @SuppressFBWarnings(value = "WEAK_HOSTNAME_VERIFIER", justification = "okay for test")
   private static class TestHostnameVerifier implements HostnameVerifier {
     @Override
     public boolean verify(String hostname, SSLSession session) {
@@ -115,6 +120,7 @@ public class MonitorSslIT extends ConfigurableMacBase {
     cfg.setSiteConfig(siteConfig);
   }
 
+  @SuppressFBWarnings(value = "URLCONNECTION_SSRF_FD", justification = "url provided by test")
   @Test
   public void test() throws Exception {
     log.debug("Starting Monitor");
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/ReadWriteIT.java b/test/src/main/java/org/apache/accumulo/test/functional/ReadWriteIT.java
index 29488e2..200d9ba 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/ReadWriteIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/ReadWriteIT.java
@@ -83,10 +83,10 @@ import org.apache.accumulo.core.metadata.MetadataTable;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.DataFileColumnFamily;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.util.MonitorUtil;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooReader;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.harness.AccumuloClusterHarness;
 import org.apache.accumulo.minicluster.ServerType;
 import org.apache.accumulo.minicluster.impl.MiniAccumuloConfigImpl;
@@ -105,6 +105,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.Iterators;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 @Category({StandaloneCapableClusterTests.class, SunnyDayTests.class})
 public class ReadWriteIT extends AccumuloClusterHarness {
   @Override
@@ -129,6 +131,8 @@ public class ReadWriteIT extends AccumuloClusterHarness {
         .usingToken(getAdminPrincipal(), getAdminToken()).build();
   }
 
+  @SuppressFBWarnings(value = {"PATH_TRAVERSAL_IN", "URLCONNECTION_SSRF_FD"},
+      justification = "path provided by test; url provided by test")
   @Test
   public void sunnyDay() throws Exception {
     // Start accumulo, create a table, insert some data, verify we can read it out.
@@ -161,7 +165,7 @@ public class ReadWriteIT extends AccumuloClusterHarness {
               "Setting scheme to HTTPS since monitor ssl keystore configuration was observed in {}",
               accumuloProps);
           scheme = "https://";
-          SSLContext ctx = SSLContext.getInstance("SSL");
+          SSLContext ctx = SSLContext.getInstance("TLSv1.2");
           TrustManager[] tm = {new TestTrustManager()};
           ctx.init(new KeyManager[0], tm, new SecureRandom());
           SSLContext.setDefault(ctx);
@@ -520,6 +524,8 @@ public class ReadWriteIT extends AccumuloClusterHarness {
     return groups;
   }
 
+  @SuppressFBWarnings(value = "WEAK_TRUST_MANAGER",
+      justification = "trust manager is okay for testing")
   private static class TestTrustManager implements X509TrustManager {
     @Override
     public void checkClientTrusted(X509Certificate[] arg0, String arg1)
@@ -535,6 +541,7 @@ public class ReadWriteIT extends AccumuloClusterHarness {
     }
   }
 
+  @SuppressFBWarnings(value = "WEAK_HOSTNAME_VERIFIER", justification = "okay for test")
   private static class TestHostnameVerifier implements HostnameVerifier {
     @Override
     public boolean verify(String hostname, SSLSession session) {
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/RestartIT.java b/test/src/main/java/org/apache/accumulo/test/functional/RestartIT.java
index 34674d4..6876c9a 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/RestartIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/RestartIT.java
@@ -40,10 +40,10 @@ import org.apache.accumulo.core.client.security.tokens.PasswordToken;
 import org.apache.accumulo.core.conf.ClientProperty;
 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.metadata.MetadataTable;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooReader;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.harness.AccumuloClusterHarness;
 import org.apache.accumulo.minicluster.ServerType;
 import org.apache.accumulo.minicluster.impl.MiniAccumuloConfigImpl;
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/SplitRecoveryIT.java b/test/src/main/java/org/apache/accumulo/test/functional/SplitRecoveryIT.java
index b931887..87fd6de 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/SplitRecoveryIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/SplitRecoveryIT.java
@@ -47,8 +47,10 @@ import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema.TabletsSection.DataFileColumnFamily;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.util.ColumnFQ;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockLossReason;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockWatcher;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.server.ServerConstants;
 import org.apache.accumulo.server.ServerContext;
@@ -59,12 +61,12 @@ import org.apache.accumulo.server.tablets.TabletTime;
 import org.apache.accumulo.server.util.MasterMetadataUtil;
 import org.apache.accumulo.server.util.MetadataTableUtil;
 import org.apache.accumulo.server.zookeeper.TransactionWatcher;
-import org.apache.accumulo.server.zookeeper.ZooLock;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.tserver.TabletServer;
 import org.apache.hadoop.io.Text;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class SplitRecoveryIT extends ConfigurableMacBase {
 
   @Override
@@ -84,12 +86,16 @@ public class SplitRecoveryIT extends ConfigurableMacBase {
     ZooLock zl = new ZooLock(zoo, zPath);
     boolean gotLock = zl.tryLock(new LockWatcher() {
 
+      @SuppressFBWarnings(value = "DM_EXIT",
+          justification = "System.exit() is a bad idea here, but okay for now, since it's a test")
       @Override
       public void lostLock(LockLossReason reason) {
         System.exit(-1);
 
       }
 
+      @SuppressFBWarnings(value = "DM_EXIT",
+          justification = "System.exit() is a bad idea here, but okay for now, since it's a test")
       @Override
       public void unableToMonitorLockNode(Throwable e) {
         System.exit(-1);
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/TableChangeStateIT.java b/test/src/main/java/org/apache/accumulo/test/functional/TableChangeStateIT.java
index e6b8bd9..547d2d6 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/TableChangeStateIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/TableChangeStateIT.java
@@ -48,10 +48,10 @@ import org.apache.accumulo.core.data.Mutation;
 import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.master.state.tables.TableState;
 import org.apache.accumulo.core.security.Authorizations;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.AdminUtil;
 import org.apache.accumulo.fate.ZooStore;
 import org.apache.accumulo.fate.zookeeper.IZooReaderWriter;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.harness.AccumuloClusterHarness;
 import org.apache.accumulo.server.zookeeper.ZooReaderWriterFactory;
 import org.apache.hadoop.io.Text;
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/TabletStateChangeIteratorIT.java b/test/src/main/java/org/apache/accumulo/test/functional/TabletStateChangeIteratorIT.java
index 9b122c7..07a3621 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/TabletStateChangeIteratorIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/TabletStateChangeIteratorIT.java
@@ -50,16 +50,16 @@ import org.apache.accumulo.core.master.thrift.MasterState;
 import org.apache.accumulo.core.metadata.MetadataTable;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema;
 import org.apache.accumulo.core.security.Authorizations;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.util.UtilWaitThread;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.harness.AccumuloClusterHarness;
 import org.apache.accumulo.server.master.state.CurrentState;
 import org.apache.accumulo.server.master.state.MergeInfo;
 import org.apache.accumulo.server.master.state.MetaDataTableScanner;
 import org.apache.accumulo.server.master.state.TServerInstance;
 import org.apache.accumulo.server.master.state.TabletStateChangeIterator;
-import org.apache.accumulo.server.zookeeper.ZooLock;
 import org.apache.hadoop.io.Text;
 import org.junit.Test;
 
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/WatchTheWatchCountIT.java b/test/src/main/java/org/apache/accumulo/test/functional/WatchTheWatchCountIT.java
index 6fb902f..5efafd4 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/WatchTheWatchCountIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/WatchTheWatchCountIT.java
@@ -28,6 +28,8 @@ import org.junit.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 // ACCUMULO-2757 - make sure we don't make too many more watchers
 public class WatchTheWatchCountIT extends ConfigurableMacBase {
   private static final Logger log = LoggerFactory.getLogger(WatchTheWatchCountIT.class);
@@ -41,6 +43,8 @@ public class WatchTheWatchCountIT extends ConfigurableMacBase {
     cfg.setNumTservers(3);
   }
 
+  @SuppressFBWarnings(value = "UNENCRYPTED_SOCKET",
+      justification = "unencrypted socket is okay for testing")
   @Test
   public void test() throws Exception {
     AccumuloClient c = getClient();
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/ZombieTServer.java b/test/src/main/java/org/apache/accumulo/test/functional/ZombieTServer.java
index eba0e8f..76f8c37 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/ZombieTServer.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/ZombieTServer.java
@@ -36,20 +36,22 @@ import org.apache.accumulo.core.trace.thrift.TInfo;
 import org.apache.accumulo.core.util.HostAndPort;
 import org.apache.accumulo.core.util.ServerServices;
 import org.apache.accumulo.core.util.ServerServices.Service;
+import org.apache.accumulo.fate.zookeeper.ZooLock;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockLossReason;
 import org.apache.accumulo.fate.zookeeper.ZooLock.LockWatcher;
+import org.apache.accumulo.fate.zookeeper.ZooReaderWriter;
 import org.apache.accumulo.fate.zookeeper.ZooUtil.NodeExistsPolicy;
 import org.apache.accumulo.server.ServerContext;
 import org.apache.accumulo.server.rpc.ServerAddress;
 import org.apache.accumulo.server.rpc.TServerUtils;
 import org.apache.accumulo.server.rpc.ThriftServerType;
 import org.apache.accumulo.server.zookeeper.TransactionWatcher;
-import org.apache.accumulo.server.zookeeper.ZooLock;
-import org.apache.accumulo.server.zookeeper.ZooReaderWriter;
 import org.apache.thrift.TException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Tablet server that creates a lock in zookeeper, responds to one status request, and then hangs on
  * subsequent requests. Exits with code zero if halted.
@@ -118,6 +120,9 @@ public class ZombieTServer {
     ZooLock zlock = new ZooLock(zoo, zPath);
 
     LockWatcher lw = new LockWatcher() {
+
+      @SuppressFBWarnings(value = "DM_EXIT",
+          justification = "System.exit() is a bad idea here, but okay for now, since it's a test")
       @Override
       public void lostLock(final LockLossReason reason) {
         try {
@@ -128,6 +133,8 @@ public class ZombieTServer {
         }
       }
 
+      @SuppressFBWarnings(value = "DM_EXIT",
+          justification = "System.exit() is a bad idea here, but okay for now, since it's a test")
       @Override
       public void unableToMonitorLockNode(Throwable e) {
         try {
diff --git a/test/src/main/java/org/apache/accumulo/test/functional/ZooCacheIT.java b/test/src/main/java/org/apache/accumulo/test/functional/ZooCacheIT.java
index fdb3dc8..bf15cdf 100644
--- a/test/src/main/java/org/apache/accumulo/test/functional/ZooCacheIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/functional/ZooCacheIT.java
@@ -28,6 +28,8 @@ import org.apache.commons.io.FileUtils;
 import org.junit.BeforeClass;
 import org.junit.Test;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ZooCacheIT extends ConfigurableMacBase {
 
   @Override
@@ -38,6 +40,7 @@ public class ZooCacheIT extends ConfigurableMacBase {
   private static String pathName = "/zcTest-42";
   private static File testDir;
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @BeforeClass
   public static void createTestDirectory() {
     testDir = new File(createTestDir(ZooCacheIT.class.getName()), pathName);
diff --git a/test/src/main/java/org/apache/accumulo/test/mapred/TokenFileIT.java b/test/src/main/java/org/apache/accumulo/test/mapred/TokenFileIT.java
index 5d08de1..445babb 100644
--- a/test/src/main/java/org/apache/accumulo/test/mapred/TokenFileIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/mapred/TokenFileIT.java
@@ -53,6 +53,8 @@ import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class TokenFileIT extends AccumuloClusterHarness {
   private static AssertionError e1 = null;
 
@@ -128,6 +130,7 @@ public class TokenFileIT extends AccumuloClusterHarness {
       return JobClient.runJob(job).isSuccessful() ? 0 : 1;
     }
 
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
     public static void main(String[] args) throws Exception {
       Configuration conf = CachedConfiguration.getInstance();
       conf.set("hadoop.tmp.dir", new File(args[0]).getParent());
diff --git a/test/src/main/java/org/apache/accumulo/test/mapreduce/TokenFileIT.java b/test/src/main/java/org/apache/accumulo/test/mapreduce/TokenFileIT.java
index f020037..7de1107 100644
--- a/test/src/main/java/org/apache/accumulo/test/mapreduce/TokenFileIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/mapreduce/TokenFileIT.java
@@ -50,6 +50,8 @@ import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class TokenFileIT extends AccumuloClusterHarness {
   private static AssertionError e1 = null;
 
@@ -121,6 +123,7 @@ public class TokenFileIT extends AccumuloClusterHarness {
       return job.isSuccessful() ? 0 : 1;
     }
 
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
     public static void main(String[] args) throws Exception {
       Configuration conf = CachedConfiguration.getInstance();
       conf.set("hadoop.tmp.dir", new File(args[0]).getParent());
diff --git a/test/src/main/java/org/apache/accumulo/test/performance/ContinuousIngest.java b/test/src/main/java/org/apache/accumulo/test/performance/ContinuousIngest.java
index 4b97088..a92e77f 100644
--- a/test/src/main/java/org/apache/accumulo/test/performance/ContinuousIngest.java
+++ b/test/src/main/java/org/apache/accumulo/test/performance/ContinuousIngest.java
@@ -38,8 +38,8 @@ import org.apache.accumulo.core.client.TableNotFoundException;
 import org.apache.accumulo.core.data.Mutation;
 import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.security.ColumnVisibility;
-import org.apache.accumulo.core.trace.CountSampler;
 import org.apache.accumulo.core.trace.Trace;
+import org.apache.accumulo.core.trace.TraceSamplers;
 import org.apache.accumulo.core.util.FastFormat;
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.fs.FileSystem;
@@ -98,7 +98,7 @@ public class ContinuousIngest {
 
     BatchWriter bw = client.createBatchWriter(clientOpts.getTableName(),
         bwOpts.getBatchWriterConfig());
-    bw = Trace.wrapAll(bw, new CountSampler(1024));
+    bw = Trace.wrapAll(bw, TraceSamplers.countSampler(1024));
 
     Random r = new SecureRandom();
 
diff --git a/test/src/main/java/org/apache/accumulo/test/performance/scan/CollectTabletStats.java b/test/src/main/java/org/apache/accumulo/test/performance/scan/CollectTabletStats.java
index f880776..79c6726 100644
--- a/test/src/main/java/org/apache/accumulo/test/performance/scan/CollectTabletStats.java
+++ b/test/src/main/java/org/apache/accumulo/test/performance/scan/CollectTabletStats.java
@@ -66,7 +66,7 @@ import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.util.HostAndPort;
 import org.apache.accumulo.core.util.Stat;
 import org.apache.accumulo.server.ServerContext;
-import org.apache.accumulo.server.cli.ClientOnRequiredTable;
+import org.apache.accumulo.server.cli.ServerUtilOnRequiredTable;
 import org.apache.accumulo.server.conf.ServerConfigurationFactory;
 import org.apache.accumulo.server.conf.TableConfiguration;
 import org.apache.accumulo.server.fs.FileRef;
@@ -82,10 +82,12 @@ import org.slf4j.LoggerFactory;
 
 import com.beust.jcommander.Parameter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CollectTabletStats {
   private static final Logger log = LoggerFactory.getLogger(CollectTabletStats.class);
 
-  static class CollectOptions extends ClientOnRequiredTable {
+  static class CollectOptions extends ServerUtilOnRequiredTable {
     @Parameter(names = "--iterations", description = "number of iterations")
     int iterations = 3;
     @Parameter(names = "--numThreads", description = "number of threads")
@@ -313,6 +315,7 @@ public class CollectTabletStats {
 
   }
 
+  @SuppressFBWarnings(value = "DM_GC", justification = "gc is okay for test")
   private static void runTest(String desc, List<Test> tests, int numThreads,
       ExecutorService threadPool) throws Exception {
 
diff --git a/test/src/main/java/org/apache/accumulo/test/proxy/ProxyDurabilityIT.java b/test/src/main/java/org/apache/accumulo/test/proxy/ProxyDurabilityIT.java
index a4de1a6..5865c54 100644
--- a/test/src/main/java/org/apache/accumulo/test/proxy/ProxyDurabilityIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/proxy/ProxyDurabilityIT.java
@@ -60,6 +60,8 @@ import org.junit.Test;
 
 import com.google.common.collect.Iterators;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class ProxyDurabilityIT extends ConfigurableMacBase {
 
   @Override
@@ -79,6 +81,7 @@ public class ProxyDurabilityIT extends ConfigurableMacBase {
     return ByteBuffer.wrap(value.getBytes());
   }
 
+  @SuppressFBWarnings(value = "HARD_CODE_PASSWORD", justification = "test password is okay")
   @Test
   public void testDurability() throws Exception {
     AccumuloClient c = getClient();
diff --git a/test/src/main/java/org/apache/accumulo/test/proxy/TestProxyClient.java b/test/src/main/java/org/apache/accumulo/test/proxy/TestProxyClient.java
index 85e7d06..657a0a9 100644
--- a/test/src/main/java/org/apache/accumulo/test/proxy/TestProxyClient.java
+++ b/test/src/main/java/org/apache/accumulo/test/proxy/TestProxyClient.java
@@ -47,6 +47,8 @@ import org.apache.thrift.transport.TSocket;
 import org.apache.thrift.transport.TTransport;
 import org.apache.thrift.transport.TTransportException;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class TestProxyClient {
 
   protected AccumuloProxy.Client proxy;
@@ -93,6 +95,7 @@ public class TestProxyClient {
     return proxy;
   }
 
+  @SuppressFBWarnings(value = "HARD_CODE_PASSWORD", justification = "test password is okay")
   public static void main(String[] args) throws Exception {
 
     TestProxyClient tpc = new TestProxyClient("localhost", 42424);
diff --git a/test/src/main/java/org/apache/accumulo/test/replication/CyclicReplicationIT.java b/test/src/main/java/org/apache/accumulo/test/replication/CyclicReplicationIT.java
index 1dc0cff..f1b8486 100644
--- a/test/src/main/java/org/apache/accumulo/test/replication/CyclicReplicationIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/replication/CyclicReplicationIT.java
@@ -68,6 +68,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.Iterables;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 @Category(MiniClusterOnlyTests.class)
 public class CyclicReplicationIT {
   private static final Logger log = LoggerFactory.getLogger(CyclicReplicationIT.class);
@@ -87,6 +89,7 @@ public class CyclicReplicationIT {
   @Rule
   public TestName testName = new TestName();
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   private File createTestDir(String name) {
     File baseDir = new File(System.getProperty("user.dir") + "/target/mini-tests");
     assertTrue(baseDir.mkdirs() || baseDir.isDirectory());
diff --git a/test/src/main/java/org/apache/accumulo/test/replication/MultiTserverReplicationIT.java b/test/src/main/java/org/apache/accumulo/test/replication/MultiTserverReplicationIT.java
index f494e7a..b43a156 100644
--- a/test/src/main/java/org/apache/accumulo/test/replication/MultiTserverReplicationIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/replication/MultiTserverReplicationIT.java
@@ -31,8 +31,8 @@ import org.apache.accumulo.core.client.impl.ClientContext;
 import org.apache.accumulo.core.replication.ReplicationConstants;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.util.HostAndPort;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooReader;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.minicluster.impl.MiniAccumuloConfigImpl;
 import org.apache.accumulo.test.functional.ConfigurableMacBase;
 import org.apache.hadoop.conf.Configuration;
diff --git a/test/src/main/java/org/apache/accumulo/test/replication/ReplicationIT.java b/test/src/main/java/org/apache/accumulo/test/replication/ReplicationIT.java
index 1ebac67..40e729a 100644
--- a/test/src/main/java/org/apache/accumulo/test/replication/ReplicationIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/replication/ReplicationIT.java
@@ -77,10 +77,10 @@ import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.security.TablePermission;
 import org.apache.accumulo.core.tabletserver.log.LogEntry;
 import org.apache.accumulo.core.util.Pair;
-import org.apache.accumulo.core.zookeeper.ZooUtil;
 import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.fate.zookeeper.ZooCacheFactory;
 import org.apache.accumulo.fate.zookeeper.ZooLock;
+import org.apache.accumulo.fate.zookeeper.ZooUtil;
 import org.apache.accumulo.gc.SimpleGarbageCollector;
 import org.apache.accumulo.minicluster.ServerType;
 import org.apache.accumulo.minicluster.impl.MiniAccumuloConfigImpl;
diff --git a/test/src/main/java/org/apache/accumulo/test/replication/SequentialWorkAssignerIT.java b/test/src/main/java/org/apache/accumulo/test/replication/SequentialWorkAssignerIT.java
index e6078d6..f5acd09 100644
--- a/test/src/main/java/org/apache/accumulo/test/replication/SequentialWorkAssignerIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/replication/SequentialWorkAssignerIT.java
@@ -36,11 +36,11 @@ import org.apache.accumulo.core.replication.ReplicationSchema.WorkSection;
 import org.apache.accumulo.core.replication.ReplicationTable;
 import org.apache.accumulo.core.replication.ReplicationTarget;
 import org.apache.accumulo.core.security.TablePermission;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.master.replication.SequentialWorkAssigner;
 import org.apache.accumulo.server.replication.DistributedWorkQueueWorkAssignerHelper;
 import org.apache.accumulo.server.replication.proto.Replication.Status;
 import org.apache.accumulo.server.zookeeper.DistributedWorkQueue;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.accumulo.test.functional.ConfigurableMacBase;
 import org.apache.hadoop.io.Text;
 import org.junit.Before;
diff --git a/test/src/main/java/org/apache/accumulo/test/replication/UnorderedWorkAssignerIT.java b/test/src/main/java/org/apache/accumulo/test/replication/UnorderedWorkAssignerIT.java
index e887ae8..6fc11f9 100644
--- a/test/src/main/java/org/apache/accumulo/test/replication/UnorderedWorkAssignerIT.java
+++ b/test/src/main/java/org/apache/accumulo/test/replication/UnorderedWorkAssignerIT.java
@@ -35,12 +35,12 @@ import org.apache.accumulo.core.replication.ReplicationSchema.WorkSection;
 import org.apache.accumulo.core.replication.ReplicationTable;
 import org.apache.accumulo.core.replication.ReplicationTarget;
 import org.apache.accumulo.core.security.TablePermission;
+import org.apache.accumulo.fate.zookeeper.ZooCache;
 import org.apache.accumulo.master.replication.UnorderedWorkAssigner;
 import org.apache.accumulo.server.replication.DistributedWorkQueueWorkAssignerHelper;
 import org.apache.accumulo.server.replication.StatusUtil;
 import org.apache.accumulo.server.replication.proto.Replication.Status;
 import org.apache.accumulo.server.zookeeper.DistributedWorkQueue;
-import org.apache.accumulo.server.zookeeper.ZooCache;
 import org.apache.accumulo.test.functional.ConfigurableMacBase;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.io.Text;
diff --git a/test/src/main/java/org/apache/accumulo/test/util/CertUtils.java b/test/src/main/java/org/apache/accumulo/test/util/CertUtils.java
index ef5013a..b392eaf 100644
--- a/test/src/main/java/org/apache/accumulo/test/util/CertUtils.java
+++ b/test/src/main/java/org/apache/accumulo/test/util/CertUtils.java
@@ -63,6 +63,8 @@ import org.slf4j.LoggerFactory;
 import com.beust.jcommander.JCommander;
 import com.beust.jcommander.Parameter;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CertUtils {
   private static final Logger log = LoggerFactory.getLogger(CertUtils.class);
   static {
@@ -123,6 +125,7 @@ public class CertUtils {
     @Parameter(names = "--keysize", description = "Key size used by encryption algorithm")
     public int keysize = 2048;
 
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
     public SiteConfiguration getSiteConfiguration() {
       if (accumuloPropsFile == null) {
         return new SiteConfiguration();
@@ -132,6 +135,7 @@ public class CertUtils {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "paths provided by test")
   public static void main(String[] args) throws Exception {
     Opts opts = new Opts();
     opts.parseArgs(CertUtils.class.getName(), args);
@@ -196,6 +200,7 @@ public class CertUtils {
         rootKeystorePassword, truststorePassword);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public void createPublicCert(File targetKeystoreFile, String keyName, String rootKeystorePath,
       String rootKeystorePassword, String truststorePassword)
       throws NoSuchAlgorithmException, CertificateException, FileNotFoundException, IOException,
@@ -215,6 +220,7 @@ public class CertUtils {
     }
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   public void createSignedCert(File targetKeystoreFile, String keyName, String keystorePassword,
       String signerKeystorePath, String signerKeystorePassword) throws KeyStoreException,
       CertificateException, NoSuchAlgorithmException, IOException, OperatorCreationException,
diff --git a/test/src/main/java/org/apache/accumulo/test/util/SerializationUtil.java b/test/src/main/java/org/apache/accumulo/test/util/SerializationUtil.java
index c8b5e36..a3472ab 100644
--- a/test/src/main/java/org/apache/accumulo/test/util/SerializationUtil.java
+++ b/test/src/main/java/org/apache/accumulo/test/util/SerializationUtil.java
@@ -33,6 +33,8 @@ import org.apache.hadoop.io.Writable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 /**
  * Partially based from {@link org.apache.commons.lang3.SerializationUtils}.
  *
@@ -208,6 +210,7 @@ public class SerializationUtil {
    * @throws IllegalArgumentException
    *           if {@code inputStream} is {@code null}
    */
+  @SuppressFBWarnings(value = "OBJECT_DESERIALIZATION", justification = "okay for test")
   public static Object deserialize(InputStream inputStream) {
     Objects.requireNonNull(inputStream);
     ObjectInputStream in = null;
diff --git a/test/src/main/java/org/apache/accumulo/test/util/memory/MemoryUsageCheck.java b/test/src/main/java/org/apache/accumulo/test/util/memory/MemoryUsageCheck.java
index 7e60124..946d71f 100644
--- a/test/src/main/java/org/apache/accumulo/test/util/memory/MemoryUsageCheck.java
+++ b/test/src/main/java/org/apache/accumulo/test/util/memory/MemoryUsageCheck.java
@@ -16,6 +16,8 @@
  */
 package org.apache.accumulo.test.util.memory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 abstract class MemoryUsageCheck {
   abstract void addEntry(int i);
 
@@ -29,6 +31,7 @@ abstract class MemoryUsageCheck {
 
   abstract void init();
 
+  @SuppressFBWarnings(value = "DM_GC", justification = "gc is okay for test")
   public void run() {
     System.gc();
     long usedMem = Runtime.getRuntime().totalMemory() - Runtime.getRuntime().freeMemory();
diff --git a/test/src/main/java/org/apache/accumulo/test/util/tablet/WrongTablet.java b/test/src/main/java/org/apache/accumulo/test/util/tablet/WrongTablet.java
index 47b5a4a..6b69972 100644
--- a/test/src/main/java/org/apache/accumulo/test/util/tablet/WrongTablet.java
+++ b/test/src/main/java/org/apache/accumulo/test/util/tablet/WrongTablet.java
@@ -25,14 +25,14 @@ import org.apache.accumulo.core.tabletserver.thrift.TDurability;
 import org.apache.accumulo.core.tabletserver.thrift.TabletClientService;
 import org.apache.accumulo.core.trace.Tracer;
 import org.apache.accumulo.core.util.HostAndPort;
-import org.apache.accumulo.server.cli.ClientOpts;
+import org.apache.accumulo.server.cli.ServerUtilOpts;
 import org.apache.hadoop.io.Text;
 
 import com.beust.jcommander.Parameter;
 
 public class WrongTablet {
 
-  static class Opts extends ClientOpts {
+  static class Opts extends ServerUtilOpts {
     @Parameter(names = "--location", required = true)
     String location;
   }
diff --git a/test/src/main/spotbugs/exclude-filter.xml b/test/src/main/spotbugs/exclude-filter.xml
index dec316c..54df747 100644
--- a/test/src/main/spotbugs/exclude-filter.xml
+++ b/test/src/main/spotbugs/exclude-filter.xml
@@ -15,45 +15,12 @@
   limitations under the License.
 -->
 <FindBugsFilter>
-  <Match>
-    <!-- ignore security bugs in tests -->
-    <Bug category="SECURITY" />
-  </Match>
+  <!--
+    DO NOT exclude anything other than generated files here. Other files
+    can be excluded inline by adding the @SuppressFBWarnings annotation.
+  -->
   <Match>
     <!-- ignore thrift-generated files -->
-    <Or>
-      <Package name="org.apache.accumulo.test.rpc.thrift" />
-    </Or>
-  </Match>
-  <Match>
-    <!-- ignore intentional infinite loop in test main methods -->
-    <Or>
-      <Class name="org.apache.accumulo.test.stress.random.Write" />
-    </Or>
-    <Method name="main" params="java.lang.String[]" returns="void" />
-    <Bug code="IL" pattern="IL_INFINITE_LOOP" />
-  </Match>
-  <Match>
-    <!-- locking is confusing, but probably correct -->
-    <Class name="org.apache.accumulo.harness.TestingKdc" />
-    <Method name="start" params="" returns="void" />
-    <Bug code="SWL" pattern="SWL_SLEEP_WITH_LOCK_HELD" />
-  </Match>
-  <Match>
-    <!-- test classes can call System.exit -->
-    <Or>
-      <Package name="org.apache.accumulo.test.functional" />
-      <Package name="org.apache.accumulo.test.scalability" />
-      <Package name="org.apache.accumulo.test.performance" />
-    </Or>
-    <Bug code="DM" pattern="DM_EXIT" />
-  </Match>
-  <Match>
-    <!-- test classes can force garbage collection -->
-    <Or>
-      <Class name="org.apache.accumulo.test.performance.scan.CollectTabletStats" />
-      <Class name="org.apache.accumulo.test.util.memory.MemoryUsageCheck" />
-    </Or>
-    <Bug code="DM" pattern="DM_GC" />
+    <Package name="org.apache.accumulo.test.rpc.thrift" />
   </Match>
 </FindBugsFilter>
diff --git a/test/src/test/java/org/apache/accumulo/test/security/KerberosTokenEmbeddedKDCTest.java b/test/src/test/java/org/apache/accumulo/test/security/KerberosTokenEmbeddedKDCTest.java
index 471ed45..61d623f 100644
--- a/test/src/test/java/org/apache/accumulo/test/security/KerberosTokenEmbeddedKDCTest.java
+++ b/test/src/test/java/org/apache/accumulo/test/security/KerberosTokenEmbeddedKDCTest.java
@@ -36,6 +36,8 @@ import org.junit.rules.TestName;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class KerberosTokenEmbeddedKDCTest {
 
   private static final Logger log = LoggerFactory.getLogger(KerberosTokenEmbeddedKDCTest.class);
@@ -65,6 +67,7 @@ public class KerberosTokenEmbeddedKDCTest {
     UserGroupInformation.setConfiguration(conf);
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void test() throws Exception {
     String user = testName.getMethodName();
@@ -88,6 +91,7 @@ public class KerberosTokenEmbeddedKDCTest {
     assertEquals(token.hashCode(), tokenWithPrinc.hashCode());
   }
 
+  @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "path provided by test")
   @Test
   public void testDestroy() throws Exception {
     String user = testName.getMethodName();
diff --git a/test/src/test/java/org/apache/accumulo/test/util/CertUtilsTest.java b/test/src/test/java/org/apache/accumulo/test/util/CertUtilsTest.java
index b97d7f3..6aaea30 100644
--- a/test/src/test/java/org/apache/accumulo/test/util/CertUtilsTest.java
+++ b/test/src/test/java/org/apache/accumulo/test/util/CertUtilsTest.java
@@ -30,6 +30,8 @@ import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 public class CertUtilsTest {
   private static final String KEYSTORE_TYPE = "JKS";
   private static final String PASSWORD = "CertUtilsTestPassword";
@@ -44,6 +46,7 @@ public class CertUtilsTest {
     return new CertUtils(KEYSTORE_TYPE, RDN_STRING, "RSA", 2048, "sha1WithRSAEncryption");
   }
 
+  @SuppressFBWarnings(value = "HARD_CODE_PASSWORD", justification = "test password is okay")
   @Test
   public void createSelfSigned() throws Exception {
     CertUtils certUtils = getUtils();
@@ -82,6 +85,7 @@ public class CertUtilsTest {
     cert.verify(cert.getPublicKey()); // throws exception if it can't be verified
   }
 
+  @SuppressFBWarnings(value = "HARD_CODE_PASSWORD", justification = "test password is okay")
   @Test
   public void createSigned() throws Exception {
     CertUtils certUtils = getUtils();
@@ -151,6 +155,7 @@ public class CertUtilsTest {
     signedCert.verify(rootCert.getPublicKey()); // throws exception if it can't be verified
   }
 
+  @SuppressFBWarnings(value = "HARD_CODE_PASSWORD", justification = "test password is okay")
   @Test
   public void signingChain() throws Exception {
     // no reason the keypair we generate for the tservers need to be able to sign anything,


Mime
View raw message