Description
As of present, Apache Kafka is using log4j 1.x and planning to migrate into log4j 2.x. Dislike Kafka Streams, it calls log4j's API directly, making it hard for the users to replace the logging framework - also making Kafka vulnerable to log4j's security vulnerabilities.
Apache Kafka (with Connect) is calling log4j's API directly to support the dynamic logger level change feature; SLF4j does not support this feature yet, but they are planning to support this in the near future.
Supporting the pluggable logging framework by using SLF4j as a facade will allow the users to change the actual logging framework, reducing security problems freely.
Attachments
Issue Links
- Dependent
-
KAFKA-9366 Upgrade log4j to log4j2
-
- In Progress
-
-
KAFKA-12399 Deprecate Log4J Appender KIP-719
-
- In Progress
-