[LOG4J2-3423] JAR file containing Log4j configuration isn't closed

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.14.0
• Fix Version/s: 2.18.0
• Component/s: Core

Environment

Windows

• Assignee: Gary D. Gregory
• Reporter: Radim Tlusty
• Created: 02/Mar/22 11:32
• Updated: 14/Jun/23 06:22
• Resolved: 13/Mar/22 18:02

Description

If the Log4j configuration file is inside of a JAR file, then the JAR file (which is backed by the JarURLConnection retrieved from URL.openConnection) isn't closed.

This causes problems on Tomcat running on Windows during undeploying of an application, because the opened JAR file can't be deleted.

The problem was introduced during implementation of LOG4J2-2901 (version 2.14.0), where the URL.openStream was replaced by URL.openConnection in the class org.apache.logging.log4j.core.config.ConfigurationSource.

The proposed solution (https://github.com/apache/logging-log4j2/pull/780) is to use the URL.openConnection only when needed (~ configuration URL has HTTPS protocol), otherwise similar code as in previous versions (<= 2.13.3) would be used.

 

Issue Links

• is related to: LOG4J2-3663 JAR file containing Log4j configuration isn't closed on Tomcat
• relates to: LOG4J2-2901 Reconfiguration failed during backend server startup
• links to: GitHub Pull Request #780
• links to: GitHub Pull Request #784