Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Log4J 1.2 PropertyConfigurator -> Log4J2

Tags:

java

log4j2

Currently, our application uses Log4J 1.2 and configures it using either

File file = ...
PropertyConfigurator.configure(file.getAbsolutePath());

or

URL url = ...
PropertyConfigurator.configure(url);

I know that the property file format has changed from 1.2 to 2, but what would be a similar way to configure Log4J 2 using a property file at an arbitrary file or URL?

like image 993
Thomas S. Avatar asked Jan 05 '18 14:01

Thomas S.


People also ask

Is Log4j version 1.2 affected?

JMSAppender, in log4j 1.2 version, is vulnerable to deserialization of untrusted data if the attacker has the 'write' permissions to the log4j configuration.

What is difference between Log4j and Log4j2?

Community support: Log4j 1. x is not actively maintained, whereas Log4j 2 has an active community where questions are answered, features are added and bugs are fixed. Automatically reload its configuration upon modification without losing log events while reconfiguring.

What is Propertyconfigurator in Log4j?

Allows the configuration of log4j from an external file. See doConfigure(String, LoggerRepository) for the expected format. It is sometimes useful to see how log4j is reading configuration files.

Does Log4j 1.2 17 have vulnerability?

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.


2 Answers

You can use PropertiesConfigurationBuilder as follows:

// Custom-loaded properties.
Properties props = ... 
// Beware it should be org.apache.logging.log4j.core.LoggerContext class,
// not the one ins spi package!
// Not sure about the meaning of "false".
LoggerContext context = (LoggerContext)LogManager.getContext(false);
Configuration config = new PropertiesConfigurationBuilder()
            .setConfigurationSource(ConfigurationSource.NULL_SOURCE)
            .setRootProperties(props)
            .setLoggerContext(context)
            .build();
 context.setConfiguration(config);
 Configurator.initialize(config);

It's true that using the core classes looks like a hack but the author himself uses them in his tutotrial: https://logging.apache.org/log4j/log4j-2.3/manual/customconfig.html .

like image 72
Agustí Sánchez Avatar answered Oct 27 '22 19:10

Agustí Sánchez


From Log4J 2's documentation:

// import org.apache.logging.log4j.core.LoggerContext;

LoggerContext context = (org.apache.logging.log4j.core.LoggerContext) LogManager.getContext(false);
File file = new File("path/to/a/different/log4j2.xml");

// this will force a reconfiguration
context.setConfigLocation(file.toURI());

Make sure to refer to org.apache.logging.log4j.core.LoggerContext (defined in the log4j-core artifact, not the log4j-api one) and not to org.apache.logging.log4j.spi.LoggerContext.

like image 30
Olivier Grégoire Avatar answered Oct 27 '22 17:10

Olivier Grégoire