Skip to content

Latest commit

 

History

History
31 lines (22 loc) · 1.61 KB

README.md

File metadata and controls

31 lines (22 loc) · 1.61 KB
Raw

Learning-Log4j2

Background

See https://github.com/vorburger/Log4j_CVE-2021-44228

Providers & Priorities

$ ./gradlew run
Jan 14, 2022 6:30:52 PM ch.vorburger.log4j.App main
INFO: hello, world

As we can see, this logged "hello, world" using JUL to the console (unless otherwise configured). It uses the (new) log4j-to-jul module, which I (vorburger@) contributed in https://issues.apache.org/jira/browse/LOG4J2-3282.

The interesting part here is noticing that in this project we have dependencies to both log4j-to-jul AND log4j-core (which can happen, for various reasons) - but log4j-to-jul takes precedence over log4j-core, which is ignored.

This is because LogManager respects the priority of each Provider, and JUL's is 15 (or 20, after this PR) whereas Core's is 10.

We can make LogManager print details about this e.g. by putting a log4j2.StatusLogger.properties on the classpath, which after this bug is fixed will show:

WARN StatusLogger Multiple logging implementations found: 
Factory: org.apache.logging.log4j.core.impl.Log4jContextFactory, Weighting: 10
Factory: org.apache.logging.log4j.tojul.JULLoggerContextFactory, Weighting: 15
Using factory: org.apache.logging.log4j.tojul.JULLoggerContextFactory