Cannot get log4j2 to work correctly..

[Mike London]

Something is off. Trying to get log4j 2 to work gives me class not found errors.

Why?

I have added the new log4j2 dependencies in my pom.xml:

       <dependency>            <groupId>org.apache.logging.log4j</groupId>            <artifactId>log4j-api</artifactId>            <version>2.16.0</version>        </dependency>        <dependency>            <groupId>org.apache.logging.log4j</groupId>            <artifactId>log4j-core</artifactId>            <version>2.16.0</version>        </dependency>

In my project, I have the compiled logic:

   // enable logging.
    private static final Logger LOGGER = LogManager.getLogger(<class_name>.class.getName());

In the IDE there the two expected import statements (both compile):

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

In the Tomcat lib folder, but the JAR files above are present.

Yet, when I deploy this application (it used to work with log4j 1.x), I now get:

Caused by: java.lang.NoClassDefFoundError: Lorg/slf4j/Logger; at java.base/java.lang.Class.getDeclaredFields0(Native Method) at java.base/java.lang.Class.privateGetDeclaredFields(Class.java:3061) at java.base/java.lang.Class.getDeclaredFields(Class.java:2248) at org.apache.catalina.util.Introspection.getDeclaredFields(Introspection.java:110) at org.apache.catalina.startup.WebAnnotationSet.loadFieldsAnnotation(WebAnnotationSet.java:269) at org.apache.catalina.startup.WebAnnotationSet.loadApplicationFilterAnnotations(WebAnnotationSet.java:109) at org.apache.catalina.startup.WebAnnotationSet.loadApplicationAnnotations(WebAnnotationSet.java:68) at org.apache.catalina.startup.ContextConfig.applicationAnnotationsConfig(ContextConfig.java:332) at org.apache.catalina.startup.ContextConfig.configureStart(ContextConfig.java:988) at org.apache.catalina.startup.ContextConfig.lifecycleEvent(ContextConfig.java:303) at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:123) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5082) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) ... 38 more Caused by: java.lang.ClassNotFoundException: org.slf4j.Logger at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1365) at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1188)

Do I still need some other import to get log4j2 to work?

Thanks in advance,

-- mmike

[Tim Holloway]

Yike! Did you trigger the mobile device view somehow? I'm getting everything scrunched up in the middle of the window.

FIRST: Log4j 2.1.6 is CURSED. If you want to avoid the vulnerabilty issues, go to 2.2 or higher.

Secondly, you're missing SLF4J, not Log4J. SLF4j is a logging integrator that allows components using different logging systems to unify the logs under one system.

Here's what I'm using on my recipe webapp currently under development (and coming along very nicely!)

        <!-- ======= -->
        <!-- Logging -->
        <!-- ======= -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.2</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.2</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-slf4j-impl</artifactId>
            <version>2.2</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>jul-to-slf4j</artifactId>
            <version>${slf4j-version}</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <scope>compile</scope>
            <version>${slf4j-version}</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>log4j-over-slf4j</artifactId>
            <version>${slf4j-version}</version>
        </dependency>

This allows both JULI and Log4J to log via Log4J control.

[Mike London]

Thanks Tim! That was it (missing slf4j).

Appreciate your help as always!  

- mike

[Eduardo Bueno]

Tim Holloway wrote:
FIRST: Log4j 2.1.6 is CURSED. If you want to avoid the vulnerabilty issues, go to 2.2 or higher.

Are you sure? Aren't you mixing up versions?
AFAIK Log4j 2.2 version is vulnerable to the 0-day exploit and you should be using 2.16.0.

Source: https://logging.apache.org/log4j/2.x/security.html

[Tim Holloway]

I may have been dyslexic, but originally I read the issue as being with Log4J 2.1 releases.

Regardless, you are correct that all Log4j2 version 2 and higher up to and including 2.15 are vulnerable, although 2.15 has reduced weakness and is covered under a different CVE.

2.16.0 removes the fatal feature altogether, although it does so thoroughly that it may break some applications, so testing is advised.