I'm currently observing that a 3rd party library (namely restfb) is using java.util.logging and I'm seeing those logs end up in STDOUT even though I don't have an SLF4J console appender configured in my logback.xml. I also have the jul-to-slf4j bridge in my classpath. Does the jul-to-slf4j bridge only log to the appenders configured by logback when the bridge is installed or does it also log to stdout?
The SLF4J Bridge allows applications coded to the SLF4J API to use Log4j 2 as the implementation.
SLF4j is a logging facade, it doesn't do logging by itself instead depends on the logging component like LOG4j, Logback or JLogging. SLF4j is an API designed to give generic access to many logging frameworks.
According to Apache, "only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.
You need to call SLF4JBridgeHandler.install()
. You also need to enable all log levels at the root logger (reason in excerpt below) in java.util.logging and remove the default console appender.
This handler will redirect jul logging to SLF4J. However, only logs enabled in j.u.l. will be redirected. For example, if a log statement invoking a j.u.l. logger disabled that statement, by definition, will not reach any SLF4JBridgeHandler instance and cannot be redirected.
The whole process can be accomplished like so
import java.util.logging.Logger; import org.slf4j.bridge.SLF4JBridgeHandler; SLF4JBridgeHandler.removeHandlersForRootLogger(); SLF4JBridgeHandler.install(); Logger.getLogger("").setLevel(Level.FINEST); // Root logger, for example.
You can set the level to something higher than finest for performance reasons, but you won't be able to turn those logs on without enabling them in java.util.logging
first (for the reason mentioned above in the excerpt).
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With