[ZOOKEEPER-2342] Migrate to Log4J 2.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Won't Do
• Assignee: Chris Nauroth
• Reporter: Chris Nauroth
• Created: 10/Dec/15 00:59
• Updated: 12/May/22 09:23
• Resolved: 09/Feb/22 19:10

Description

ZOOKEEPER-1371 removed our source code dependency on Log4J. It appears that this also removed the Log4J SLF4J binding jar from the runtime classpath. Without any SLF4J binding jar available on the runtime classpath, it is impossible to write logs.

This JIRA investigated migration to Log4J 2 as a possible path towards resolving the bug introduced by ZOOKEEPER-1371. At this point, we know this is not feasible short-term. This JIRA remains open to track long-term migration to Log4J 2.

Issue Links

• blocks: ZOOKEEPER-3737 Unable to eliminate log4j1 transitive dependency
• fixes: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer
• is broken by: ZOOKEEPER-1371 Remove dependency on log4j in the source code.
• is depended upon by: LOG4J2-1514 Help Apache Zookeeper project to upgrade from Log4j 1.x to 2.x
• is duplicated by: ZOOKEEPER-2659 Use log4j2 as a logging framework as log4j 1.X is now deprecated
• is related to: SPARK-6305 Add support for log4j 2.x to Spark
• is related to: OAK-9024 oak-solr-osgi imports org.slf4j.impl
• is related to: HADOOP-12956 Inevitable Log4j2 migration via slf4j
• is related to: ZOOKEEPER-4455 Move to https://reload4j.qos.ch/ (remove log4j1)
• is superceded by: ZOOKEEPER-4427 Migrate to Logback
• relates to: ZOOKEEPER-2393 Revert run-time dependency on log4j and slf4j-log4j12
• relates to: LOG4J2-63 Support configuration from version 1.x log4j.properties
• relates to: ZOOKEEPER-4423 Upgrade Log4j to 2.15.0 - CVE-2021-44228
• relates to: ZOOKEEPER-3817 owasp failing due to CVE-2020-9488