[ZOOKEEPER-4427] Migrate to Logback

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.8.0
• Fix Version/s: 3.8.0
• Component/s: other
• Labels: log4j logback logging pull-request-available
• Assignee: Andor Molnar
• Reporter: Andor Molnar
• Created: 15/Dec/21 11:44
• Updated: 20/Oct/23 08:08
• Resolved: 27/Jan/22 09:06

Description

Due to the recent issues with log4j2 the migration for another logging library has come up again. Although log4j1 is not impacted by the vulnerability, the upgrade to log4j2 was abandoned multiple times in ZK history.

I suggest now to migrate to logback which is also a well-maintained and mature project as well as it's much easier to migrate from log4j1.

Issue Links

• causes: ZOOKEEPER-4763 Logback dependency should be scope provided/test
• is duplicated by: ZOOKEEPER-4451 vulnerable version of log4j (1.2.15/12.16) is being used in Zookeeper
• is duplicated by: ZOOKEEPER-4450 Zookeeper 3.7.0 is using Vulnerable log4j of 1.2.17
• is related to: LEGAL-594 How do projects handle dual-licensed dependencies?
• is related to: LEGAL-595 Correct handling of a dual-licensed dependency
• relates to: ZOOKEEPER-4452 Log4j 1.X CVE-2022-23302/5/7 vulnerabilities
• supercedes: ZOOKEEPER-2342 Migrate to Log4J 2.
• links to: GitHub Pull Request #1793