Log4j2 Kullanımı

Log4J2 Vulnerabilities

Açıklaması şöyle

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Açıklaması şöyle

Upgrade to Log4j 2.3.2 (for Java 6), 2.12.4 (for Java 7), or 2.17.1 (for Java 8 and later).

Maven

Log4J - Eski

Açıklaması şöyle. Yani 2012 yılından beri güncellenmiyor. Kullanmamak lazım

The reload4j project aims to fix the most urgent issues in log4j 1.2.17 which hasn't seen a new release since 2012. Note that on 2022-01-06 the Apache Logging PMC formally voted to reaffirm the EOL (End of Life) status of log4j 1.x. Despite our best efforts it was therefore impossible to revive the log4j 1.x project within the Apache Software Foundation.

Örnek

Şu satırı dahil ederiz

<dependency>
  <groupId>log4j</groupId>
  <artifactId>log4j</artifactId>
  <version>1.2.17</version>
</dependency>

Log4J2

Örnek - BOM

Şu satırı dahil ederiz. log4j-api, log4j-core, log4j-layout-template-json, log4j-slf4j-impl gibi tüm kütüphaneleri getiriyor.

<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-bom</artifactId>
  <version>2.20.0</version>
  <scope>import</scope>
  <type>pom</type>
</dependency>

Örnek

Şu satırı dahil ederiz. Api ve Implementation olarak iki kısma bölünmüş durumda

<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-api</artifactId>
  <version>2.17.1</version>
</dependency>
<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-core</artifactId>
  <version>2.17.1</version>
</dependency>

LogManager ve Logger gibi sınıflar api jar'ının içinde. Aslında sadece log4j-core bağımlılığını eklemek yeterli. Açıklaması şöyle

Log4j 2 can be thought of SLF4J with Logback. log4j-api is equivalent to SLF4J, and log4j-core is equivalent to Logback. So to use only Log4j 2, we can simply add log4j-core dependency and log4j-api is included in the log4j-core. 

Note: it will not work if you only include the log4j-api dependency without log4j-core in your project.

Gradle

Şöyle yaparız

implementation("org.apache.logging.log4j:log4j-core:2.17.1")

Ayar Dosyası

Log4j2 Ayar Dosyası yazısına taşıdım

Log4j ve SLF4J Bridge

Açıklaması şöyle

Log4j2 includes a log4j-to-slf4j bridge module. Any application coded against the Log4j2 API can choose to switch the backing implementation to any slf4j-compliant implementation at any time.

Şeklen şöyle Yani Log4J bu sefer SLF4J gibi "facade for a facade" olarak davranıyor

Eğer logback kullanmak istersek şunları dahil ederiz

og4j-api, log4j-to-slf4j, slf4j, logback

SLF4J To Log4J

Örnek

Şöyle yaparız

implementation("org.apache.logging.log4j:log4j-slf4j-impl:2.17.1") {
    exclude("org.apache.logging.log4j", "log4j-api") // this line is optional
}
implementation("org.apache.logging.log4j:log4j-core:2.17.1")

Açıklaması şöyle

log4j-slf4j-impl is a bridge module that allows you to use Log4j 2 as the underlying logging implementation for SLF4J. It depends on both slf4j-api and log4j-core, but it provides a simplified API for users who are already familiar with SLF4J and prefer to use it for logging. Since log4j-slf4j-impl also includes log4j-api and slf4j-api, so we don’t need to explicitly include slf4j-api.

Örnek

Şöyle yaparız

private static final Logger logger = LoggerFactory.getLogger(SLF4JExample.class);

public static void main(String[] args) {
  logger.trace("This is a trace message.");
  logger.debug("This is a debug message.");
  logger.info("This is an info message.");
  logger.warn("This is a warn message.");
  logger.error("This is an error message.");
  // logger.fatal("This is a fatal message"); // Cannot resolve method 'fatal' in 'Logger'
}

Appender Sınıfları

Bazıları şöyle

ConsoleAppender — writes the data to System.out or System.err with the default begin the first one (a Java best practice when logging in containers)

FileAppender — appender that uses the FileManager to write the data to a defined file

RollingFileAppender — appender that writes data to a defined file and rolls over the file according to a defined policy

MemoryMappedFileAppender — added in version 2.1, uses memory-mapped files and relies on the operating system virtual memory manager to synchronize the changes in the file with the storage device

FlumeAppender — appender that writes data to Apache Flume

CassandraAppender — appender that writes data to Apache Cassandra

JDBCAppender — writes data to a database using standard JDBC driver

HTTPAppender — writes data to a defined HTTP endpoint

KafkaAppender — writes data to Apache Kafka

SyslogAppender — writes data to a Syslog-compatible destination

ZeroMQAppender — writes data to ZeroMQ

AsyncAppender — encapsulates another appender and uses a different thread to write data, which results in asynchronous logging

LogManager Sınıfı

Şu satırı dahil ederiz.

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

getLogger metodu

Şöyle yaparız.

private static final Logger logger = LogManager.getLogger(MyApplication.class);

Logger Sınıfı
Şu satırı dahil ederiz.

import org.apache.logging.log4j.Logger;

Seviyeler için açıklama şöyle

Log4j provides seven log levels: TRACE, DEBUG, INFO, WARN, ERROR, FATAL, and OFF in ascending order of severity. If the log level is set to OFF, logging is disabled.

debug metodu
Şöyle yaparız.

logger.debug("Skipping...");

fatal metodu
Şöyle yaparız.

IOException e = ...
logger.fatal("Failed to perform operations ", e);

info metodu
Şöyle yaparız.

logger.info("Foo is at {}", foo);

warn metodu
Şöyle yaparız.

InterruptedException e = ...;
logger.warn("Sleep interrupted", e);