You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@logging.apache.org by Ralph Goers <ra...@dslextreme.com> on 2019/12/02 16:32:25 UTC
Log4j 2.13.0
I have finished all the work on new features I wanted to add for the next release. The latest feature I added is Log4j 2 will now support Log4j 1 xml and properties file configurations. I have flagged it as experimental - it either requires a system property to explicitly enable auto detecting log4j 1 config files or it requires the log4j.configuration system property to point to a log4j 1 configuration. Not all appenders are supported. For example, the Log4j 1 socket appender serialized the log event using Java serialization. We know that is a security risk and don’t recommend it. The JDBCAppender is Log4j 1 can’t be mapped to Log4j 2’s JdbcAppender and I didn’t want to bring in the actual appender code. But I think the support should be good enough for a lot of use cases.
I will be going through PRs and Jira issues over the next couple of days to see what low hanging fruit there is. I need to do a release sometime this week though as I am planning to use some of these features at work.
Ralph
Re: Log4j 2.13.0
Posted by Matt Sicker <bo...@gmail.com>.
And I’ve still been doing most of my work in the master branch lately, so I
have nothing outstanding to merge for this release.
On Sat, Dec 7, 2019 at 17:07 Carter Kozak <ck...@ckozak.net> wrote:
> Thanks for the heads up and sorry for the delay, it has been a busy week.
> I've merged the contribution, and I'm in the process of adding release
> notes and a regression test now.
>
> -ck
>
> On Sat, Dec 7, 2019, at 02:33, Ralph Goers wrote:
> > Carter,
> >
> > If you are going to fix LOG4J2-2725 you need to do it quickly. I have
> been applying patches this evening and will probably do some more tomorrow
> but may start the release process tomorrow night or Sunday morning.
> >
> > Ralph
> >
> > > On Dec 2, 2019, at 10:16 AM, Ralph Goers <ra...@dslextreme.com>
> wrote:
> > >
> > > If you like it you should really thank Mikael. His initial work on
> this gave me the idea how to do it. I wish he was able to contribute more
> these days.
> > >
> > > Ralph
> > >
> > >> On Dec 2, 2019, at 9:49 AM, Carter Kozak <ck...@ckozak.net> wrote:
> > >>
> > >> Thanks Ralph,
> > >>
> > >> Your work on log4j1 configuration compatibility looks fantastic!
> > >> I'd like to make sure the fix for LOG4J2-2725 goes into this release,
> if the PR author doesn't reply in the next day or so I'll take care of it.
> There are a couple related places I'd like to test for similar types of
> leaks when the asynchronous queue is full.
> > >>
> > >> Best,
> > >> -ck
> > >>
> > >> On Mon, Dec 2, 2019, at 11:32, Ralph Goers wrote:
> > >>> I have finished all the work on new features I wanted to add for the
> next release. The latest feature I added is Log4j 2 will now support Log4j
> 1 xml and properties file configurations. I have flagged it as experimental
> - it either requires a system property to explicitly enable auto detecting
> log4j 1 config files or it requires the log4j.configuration system property
> to point to a log4j 1 configuration. Not all appenders are supported. For
> example, the Log4j 1 socket appender serialized the log event using Java
> serialization. We know that is a security risk and don’t recommend it. The
> JDBCAppender is Log4j 1 can’t be mapped to Log4j 2’s JdbcAppender and I
> didn’t want to bring in the actual appender code. But I think the support
> should be good enough for a lot of use cases.
> > >>>
> > >>> I will be going through PRs and Jira issues over the next couple of
> days to see what low hanging fruit there is. I need to do a release
> sometime this week though as I am planning to use some of these features at
> work.
> > >>>
> > >>> Ralph
> > >>>
> > >>
> > >
> > >
> > >
> >
> >
> >
>
--
Matt Sicker <bo...@gmail.com>
Re: Log4j 2.13.0
Posted by Carter Kozak <ck...@ckozak.net>.
Thanks for the heads up and sorry for the delay, it has been a busy week. I've merged the contribution, and I'm in the process of adding release notes and a regression test now.
-ck
On Sat, Dec 7, 2019, at 02:33, Ralph Goers wrote:
> Carter,
>
> If you are going to fix LOG4J2-2725 you need to do it quickly. I have been applying patches this evening and will probably do some more tomorrow but may start the release process tomorrow night or Sunday morning.
>
> Ralph
>
> > On Dec 2, 2019, at 10:16 AM, Ralph Goers <ra...@dslextreme.com> wrote:
> >
> > If you like it you should really thank Mikael. His initial work on this gave me the idea how to do it. I wish he was able to contribute more these days.
> >
> > Ralph
> >
> >> On Dec 2, 2019, at 9:49 AM, Carter Kozak <ck...@ckozak.net> wrote:
> >>
> >> Thanks Ralph,
> >>
> >> Your work on log4j1 configuration compatibility looks fantastic!
> >> I'd like to make sure the fix for LOG4J2-2725 goes into this release, if the PR author doesn't reply in the next day or so I'll take care of it. There are a couple related places I'd like to test for similar types of leaks when the asynchronous queue is full.
> >>
> >> Best,
> >> -ck
> >>
> >> On Mon, Dec 2, 2019, at 11:32, Ralph Goers wrote:
> >>> I have finished all the work on new features I wanted to add for the next release. The latest feature I added is Log4j 2 will now support Log4j 1 xml and properties file configurations. I have flagged it as experimental - it either requires a system property to explicitly enable auto detecting log4j 1 config files or it requires the log4j.configuration system property to point to a log4j 1 configuration. Not all appenders are supported. For example, the Log4j 1 socket appender serialized the log event using Java serialization. We know that is a security risk and don’t recommend it. The JDBCAppender is Log4j 1 can’t be mapped to Log4j 2’s JdbcAppender and I didn’t want to bring in the actual appender code. But I think the support should be good enough for a lot of use cases.
> >>>
> >>> I will be going through PRs and Jira issues over the next couple of days to see what low hanging fruit there is. I need to do a release sometime this week though as I am planning to use some of these features at work.
> >>>
> >>> Ralph
> >>>
> >>
> >
> >
> >
>
>
>
Re: Log4j 2.13.0
Posted by Ralph Goers <ra...@dslextreme.com>.
Carter,
If you are going to fix LOG4J2-2725 you need to do it quickly. I have been applying patches this evening and will probably do some more tomorrow but may start the release process tomorrow night or Sunday morning.
Ralph
> On Dec 2, 2019, at 10:16 AM, Ralph Goers <ra...@dslextreme.com> wrote:
>
> If you like it you should really thank Mikael. His initial work on this gave me the idea how to do it. I wish he was able to contribute more these days.
>
> Ralph
>
>> On Dec 2, 2019, at 9:49 AM, Carter Kozak <ck...@ckozak.net> wrote:
>>
>> Thanks Ralph,
>>
>> Your work on log4j1 configuration compatibility looks fantastic!
>> I'd like to make sure the fix for LOG4J2-2725 goes into this release, if the PR author doesn't reply in the next day or so I'll take care of it. There are a couple related places I'd like to test for similar types of leaks when the asynchronous queue is full.
>>
>> Best,
>> -ck
>>
>> On Mon, Dec 2, 2019, at 11:32, Ralph Goers wrote:
>>> I have finished all the work on new features I wanted to add for the next release. The latest feature I added is Log4j 2 will now support Log4j 1 xml and properties file configurations. I have flagged it as experimental - it either requires a system property to explicitly enable auto detecting log4j 1 config files or it requires the log4j.configuration system property to point to a log4j 1 configuration. Not all appenders are supported. For example, the Log4j 1 socket appender serialized the log event using Java serialization. We know that is a security risk and don’t recommend it. The JDBCAppender is Log4j 1 can’t be mapped to Log4j 2’s JdbcAppender and I didn’t want to bring in the actual appender code. But I think the support should be good enough for a lot of use cases.
>>>
>>> I will be going through PRs and Jira issues over the next couple of days to see what low hanging fruit there is. I need to do a release sometime this week though as I am planning to use some of these features at work.
>>>
>>> Ralph
>>>
>>
>
>
>
Re: Log4j 2.13.0
Posted by Ralph Goers <ra...@dslextreme.com>.
If you like it you should really thank Mikael. His initial work on this gave me the idea how to do it. I wish he was able to contribute more these days.
Ralph
> On Dec 2, 2019, at 9:49 AM, Carter Kozak <ck...@ckozak.net> wrote:
>
> Thanks Ralph,
>
> Your work on log4j1 configuration compatibility looks fantastic!
> I'd like to make sure the fix for LOG4J2-2725 goes into this release, if the PR author doesn't reply in the next day or so I'll take care of it. There are a couple related places I'd like to test for similar types of leaks when the asynchronous queue is full.
>
> Best,
> -ck
>
> On Mon, Dec 2, 2019, at 11:32, Ralph Goers wrote:
>> I have finished all the work on new features I wanted to add for the next release. The latest feature I added is Log4j 2 will now support Log4j 1 xml and properties file configurations. I have flagged it as experimental - it either requires a system property to explicitly enable auto detecting log4j 1 config files or it requires the log4j.configuration system property to point to a log4j 1 configuration. Not all appenders are supported. For example, the Log4j 1 socket appender serialized the log event using Java serialization. We know that is a security risk and don’t recommend it. The JDBCAppender is Log4j 1 can’t be mapped to Log4j 2’s JdbcAppender and I didn’t want to bring in the actual appender code. But I think the support should be good enough for a lot of use cases.
>>
>> I will be going through PRs and Jira issues over the next couple of days to see what low hanging fruit there is. I need to do a release sometime this week though as I am planning to use some of these features at work.
>>
>> Ralph
>>
>
Re: Log4j 2.13.0
Posted by Carter Kozak <ck...@ckozak.net>.
Thanks Ralph,
Your work on log4j1 configuration compatibility looks fantastic!
I'd like to make sure the fix for LOG4J2-2725 goes into this release, if the PR author doesn't reply in the next day or so I'll take care of it. There are a couple related places I'd like to test for similar types of leaks when the asynchronous queue is full.
Best,
-ck
On Mon, Dec 2, 2019, at 11:32, Ralph Goers wrote:
> I have finished all the work on new features I wanted to add for the next release. The latest feature I added is Log4j 2 will now support Log4j 1 xml and properties file configurations. I have flagged it as experimental - it either requires a system property to explicitly enable auto detecting log4j 1 config files or it requires the log4j.configuration system property to point to a log4j 1 configuration. Not all appenders are supported. For example, the Log4j 1 socket appender serialized the log event using Java serialization. We know that is a security risk and don’t recommend it. The JDBCAppender is Log4j 1 can’t be mapped to Log4j 2’s JdbcAppender and I didn’t want to bring in the actual appender code. But I think the support should be good enough for a lot of use cases.
>
> I will be going through PRs and Jira issues over the next couple of days to see what low hanging fruit there is. I need to do a release sometime this week though as I am planning to use some of these features at work.
>
> Ralph
>