OWASP-ESAPI logger help needed

Question

In my current project I am using Maven and Spring. I am currently using SLF4J logger for logging services. In place of that I want to use OWASP-ESAPI logger. I don't want to use OWASP-ESAPI security, just the log services. Can anybody please guide me how to use OWASP-ESAPI logger by replacing slf4j logger with minimum efforts ? I tried a lot of google search but nothing helps. I will really appreciate some links to gain knowledge about OWASP-ESAPI logger as well.

Answer 1

Refactoring your code to remove slf4j is a horrific solution, because then you lose the ability to capture JUL, JCL, LOG4J traffic into a common log funnel. The prior response is bad advice.

1. You can enable ESAPI to use JUL Logging, and then, by using JUL over SLF4J, recapture that log traffic and route to other loggers (i.e. log4j or logback). To do so, in ESAPI.properties: ESAPI.Logger=org.owasp.esapi.reference.JavaLogFactory

2. Another option would be to build an SLF4J logger proxy over the ESAPI Logger Interface. I think you lose more functionality than you gain in this case.

Answer 2

The key thing to note is that ESAPI is only build for log4j or commons java.util logging. I'm assuming log4j.

Step 1: Remove the slf4j library from your classpath. If you're using an IDE, this should "christmas-tree" your application and tell you everything you have to change.

Step 2: Add esapi to the classpath

Step 3: Manually convert all of your slf4j logging calls to their new ESAPI counterpart. You'll grab a reference to the esapi logger like this:

Logger logger = ESAPI.getLogger("my.foo.class.Foo");

With the information provided, this is pretty straightforward.

NOTE: Log4j doesn't support some of the formatting calls that slfj supports. This will result in you either manually re-creating the input OR holding off on all those instances until later and then still using slf4j but just using the [MessageFormatter][1] to pass in the log input.