Alluxio - How to check log4j version used in Alluxio release (alluxio-2.8.1) - security

We are using Alluxio(alluxio-2.8.1), and very curious to see and understand what version of log4j used in it. Please suggest where we can get that information.

According to this url https://github.com/Alluxio/alluxio/blob/master/pom.xml, log4j version may be 2.17.1.
Secondly, in the archive, you can found assembly director, extract some-thing-server.jar and find log4j class.
Thirdly, may be you can extract from running log, or set log to DEBUG

Related

How can I suppress the initial StatusLogger error message

I am using Apache POI 5.2.2 in my application. Apache POI is using log4j2 as it's internal logging mechanism for debugging. As a result log4j-api-2.17.2.jar is a required dependency. I should note here that I am not using maven, so I downloaded the POI binary distribution and include the required dependencies in the application class path.
The logging in POI is intended for POI developers and it is not recommended for normal operation (i.e. end users). For my use case I do not want to use logging at all. However, when my application first loads one of the POI classes the following message is printed on stderr:
ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath. Using SimpleLogger to log to the console...
I don't want to add log4j-core, because I really don't want the logging. I really just want to suppress this message, because logging is irrelevant to the app. I would like to do this programmatically so as to avoid adding a config file for something that I am not using. I tried to do this by setting the log4j2.StatusLogger.level property to OFF but this did not make any difference (I also tried setting it to 0).
Is there a simple incantation that I can use to suppress the StatusLogger message? Or do I have to fully get in to the log4j2 world and code up a null logger?
You can disable the message by explicitly setting the logger context factory to org.apache.logging.log4j.simple.SimpleLoggerContextFactory in one of the Log4j2 property sources.
You can, e.g., add:
log4j2.loggerContextFactory = org.apache.logging.log4j.simple.SimpleLoggerContextFactory
to a log4j2.component.properties file on your classpath.
Add to the command line flags:
-Dlog4j2.loggerContextFactory=org.apache.logging.log4j.simple.SimpleLoggerContextFactory
This factory will set SimpleLogger by default.

Do I need to update log4j.properties file if I use the Log4j 1.x bridge (log4j-1.2-api)

I've followed the doc here : https://logging.apache.org/log4j/2.x/manual/migration.html
Also looked at https://logging.apache.org/log4j/2.x/manual/configuration.html#Properties
My existing log4j.properties only uses DailyRollingFileAppender, ConsoleAppender, both of which are under the 'Supported Components', so I shouldn't be forced to convert my log4j.properties file into log4j2.properties format. I'm not accessing methods and classes internal to the Log4j 1.x implementation, as suggested by the document.
For using the bridge, I previously was using both log4j1.compatibility and log4j.configuration, but the document suggests using 'any one' (tried using just one, doesn't work)
I can build my application successfully, however, my application no longer logs anything. What am I missing?
You may want to consider reload4j as a drop-in replacement for log4j 1.x. Initiated by Ceki Gülcü, the original author of Apache log4j 1.x, the reload4j project is a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues.
The reload4j project offers a clear and easy migration path for the users who have an urgent need to fix vulnerabilities in log4j 1.2.17.
You don't need to update your properties file.
You can add a log4j2.component.properties file on the class path (in my case, in the same directory as my log4j.properties file) to set the log4j1.compatibility property, like this:
log4j1.compatibility=true
In our case, it only required setting the compatibility property and then it automatically picked up the log4j.properties file that was available on the class path.
Figured it out.
The answer lied in the Automatic Configuration section

Utility to convert log4j.xml to log4j2.xml

I am looking for the utility to convert log4j.xml to log4j2.xml syntax is there any utility available
At first I was going to respond that this cannot be done but it might be somewhat possible.
Log4j 2.13.0 added experimental support for using Log4j 1.x configuration files. If your configuration is compatible, in theory you could start up an application using a Log4j 1.x configuration and then call getRootNode() on the AbstractConfiguration. The root node is very similar to a DOM tree so walking it and converting it to XML wouldn't be too hard. However, Log4j doesn't have a tool provided to do this. Contributions are welcome!

Empty PropertyConfigurator implementation in log4j-1.2-api

I'm upgrading Log4j-1.2.17 to Log4j2-2.12.2 in my project.
To do that I'm using the log4j-1.2 bridge.
In old version I use property file to configure log4j.
After upgrade everything looks ok, no errors, no warnings. But logs don't appear in file pointed in properties file.
I realized that PropertyConfigurator.class exists in log4j-1.2-api.jar, but methods don't have implementation.
empty PropertyConfigurator.configure(Properties properties)
Can you explain me that?
Which configuration syntax is correct when I use log4j-1.2-api.jar? log4j or log4j2?
Prior to Log4j 2.13.0 log4j-1.2-api only provides compatibility for applications that used the log4j 1.x API for logging. The Log4j 2 configuration is still used as all logging calls are redirected to Log4j 2. So only the Log4j 2 configuration syntax would be valid.
Many of the old log4j 1.x internal classes are also present because many applications were using them in an attempt manually manipulate logging, much of which probably isn't necessary with Log4j 2.
In Log4j 2.13.0 the log4j-1.2-api was extended to provide experimental support for Log4j 1.x configuration files. You would have to compare your log4j 1 configurations with the documentation to determine if that support will work for you. However, the Log4j 1.x PropertyConfigurator still will be a no-op even with the compatibility support.

Log4j and Websphere 7 application server

I get below error and the log files is not created. I know log4j.properties is not being picked correctly
log4j:WARN No appenders could be found for logger
log4j jar is in lib and classpath
log4j.properties is in src folder and gets loaded to classes folder on build
I tried many ways to fix this error like adding services folder with log4j implementation class to fix WAS logging conflict also tried sfl4j
Has anyone found a way to fix log4j issue with WAS7 or later ?
You can troubleshoot Log4J itself by specifying the log4j.debug=true system variable. Then you'll know exactly what's going on with Log4J, internally.
Does your log4j.properties file contain any logger definitions? perhaps you can paste the file here?
I had this same problem (WAS ignoring my META-INF/services/org.apache.commons.logging.LogFactory file).
The problem was solved when I downgraded commons-logging to 1.0.3, to match WAS version. Check this article for more info.
Consider using the Java Logging framework instead, which is built into the standard Java Runtime Environment and requires no additional installations or configuration. The relevant classes are in the java.util.logging package and there is an overview of the process for using them here (it works in a very similar way to log4j).

Resources