sonar findbug missing class exception - sonarqube

Question

while I am using sonar findbug for code review, it throws exception, claiming some classes are missing.
After some research, it's clear that the jars needed to build the project, should be included in the pom.xml for sonar's use.
to do that, sonar official web site suggesting, add dependencies,
com.opensymphony
xwork-core
2.1.6
system
${basedir}/.../xwork-core.jar
however, for me, it's always not working.
I am using windows, would anyone please enlighten me, how to configure, especially the systempath?
Here is the pom.xml, for one module of the project.
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>DB</groupId>
<artifactId>Project1</artifactId>
<name>project1</name>
<version>1.0</version>
<dependencies>
<dependency>
<groupId>com.opensymphony</groupId>
<artifactId>xwork-core</artifactId>
<version>2.1.6</version><!--installed into .m2 folder, local repository, then refer it-->
</dependency>
<dependency>
<groupId>dep</groupId>
<artifactId>dep1</artifactId>
<version>1.0</version> <scope>system</scope>
<systemPath>${basedir}/lib//asn.jar</systemPath>
</dependency>
</dependencies>
<build>
<sourceDirectory>src</sourceDirectory>
<outputDirectory>build-to/classes</outputDirectory>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>1.5</source>
<target>1.5</target>
<excludes>
<exclude>**/*.*</exclude>
</excludes>
</configuration>
</plugin>
</plugins>
</build>
<properties>
<sonar.dynamicAnalysis>false</sonar.dynamicAnalysis>
</properties>
</project>
Thanks,
Jackie

Answer 1

Is your project already a maven project, or are you compiling things with ant or some other tool and then trying to get sonar to run against it? Sonar Light mode can be tricky with very complex projects. If you've got a multi-module project, i'd get the simplest project working under a local copy of sonar and then work towards adding more modules.
Additionally, I would try copying the files locally to a different directory that does not step up from ${basedir}. See if that helps. So ${basedir}/lib/xwork-core.jar something like that.
Perhaps for Sonar analysis, you can have a separate task copy the needed libraries to a temp folder that can be accessed appropriately, and then remove them once the analysis is complete.

Answer 2

i found out the problem. The official documentation of sonar is actually wrong.
"mvn sonar:sonar" would invoke the maven sonar plugin 2.0 beta, which won't enable the dependency of library jars work. Instead, call "mvn sonar3:sonar", invoke the maven sonar plugin 2.4.1, the latest version, works.