You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@karaf.apache.org by Ephemeris Lappis <ep...@gmail.com> on 2025/10/01 10:35:13 UTC
Karaf shell / "log:log" command
Hello.
We need to use the Karaf's shell "log" command to trace actions during some
deployment opérations..
We've seen that the thread name using the "log:log" command is the command
itself, producing very big lines in the log file.
Example :
admin@root()> log:log --level WARNING "A very very long text..."
12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long
text..."] A very very long text...
The thread name is "pipe-log:log --level WARNING "A very very long text...""
In reality, messages may be actually bigger, since we want to trace very
detailed information about the current deployments.
Is there any way to avoid this ?
Thanks in advance for your help.
Regards.
Re: Karaf shell / "log:log" command
Posted by Matt Pavlovich <ma...@apache.org>.
Agreed, some sort of postProcessInterceptor/marshallingInteceptor would make sense.. detect any fields that have ’secret’ annotation and mask them out using the same mask character that is used for the console (also set via annotation).
Matt
> On Oct 2, 2025, at 11:43 PM, Jean-Baptiste Onofré <jb...@nanthrax.net> wrote:
>
> I think that’s in the pax logging handling that we should improve that. Because it could be also a concern to include the whole log event message in the thread name.
>
> About the display of sensitive information like password in the console, it’s not a log:log issue (or even a karaf console issue). I would consider as a felix gogo thing. That said, we can certainly find workaround in Karaf shell console for that (using interceptor with pattern detection for instance).
>
> Regards
> JB
>
> Le mer. 1 oct. 2025 à 15:23, Matt Pavlovich <mattrpav@apache.org <ma...@apache.org>> a écrit :
>> Your logging configuration must be using a pattern that includes the thread name in the log output. You can remove that macro, or configure a separate log appender for the packages you want to filter and give that a different logging pattern without the thread macro.
>>
>> -Matt
>>
>> > On Oct 1, 2025, at 5:35 AM, Ephemeris Lappis <ephemeris.lappis@gmail.com <ma...@gmail.com>> wrote:
>> >
>> > Hello.
>> >
>> > We need to use the Karaf's shell "log" command to trace actions during some deployment opérations..
>> >
>> > We've seen that the thread name using the "log:log" command is the command itself, producing very big lines in the log file.
>> >
>> > Example :
>> > admin@root()> log:log --level WARNING "A very very long text..."
>> > 12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long text..."] A very very long text...
>> >
>> > The thread name is "pipe-log:log --level WARNING "A very very long text...""
>> >
>> > In reality, messages may be actually bigger, since we want to trace very detailed information about the current deployments.
>> >
>> > Is there any way to avoid this ?
>> >
>> > Thanks in advance for your help.
>> >
>> > Regards.
>>
Re: Karaf shell / "log:log" command
Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
I think that’s in the pax logging handling that we should improve that.
Because it could be also a concern to include the whole log event message
in the thread name.
About the display of sensitive information like password in the console,
it’s not a log:log issue (or even a karaf console issue). I would consider
as a felix gogo thing. That said, we can certainly find workaround in Karaf
shell console for that (using interceptor with pattern detection for
instance).
Regards
JB
Le mer. 1 oct. 2025 à 15:23, Matt Pavlovich <ma...@apache.org> a écrit :
> Your logging configuration must be using a pattern that includes the
> thread name in the log output. You can remove that macro, or configure a
> separate log appender for the packages you want to filter and give that a
> different logging pattern without the thread macro.
>
> -Matt
>
> > On Oct 1, 2025, at 5:35 AM, Ephemeris Lappis <ep...@gmail.com>
> wrote:
> >
> > Hello.
> >
> > We need to use the Karaf's shell "log" command to trace actions during
> some deployment opérations..
> >
> > We've seen that the thread name using the "log:log" command is the
> command itself, producing very big lines in the log file.
> >
> > Example :
> > admin@root()> log:log --level WARNING "A very very long text..."
> > 12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long
> text..."] A very very long text...
> >
> > The thread name is "pipe-log:log --level WARNING "A very very long
> text...""
> >
> > In reality, messages may be actually bigger, since we want to trace very
> detailed information about the current deployments.
> >
> > Is there any way to avoid this ?
> >
> > Thanks in advance for your help.
> >
> > Regards.
>
>
Re: Karaf shell / "log:log" command
Posted by Ephemeris Lappis <ep...@gmail.com>.
Hello again.
I have had a look at the lines that have an unsuitable thread name, and I
can't identify a unique logger. Lines from commands "log:log" have a logger
"core", but other commands have multiple loggers, and I don't see any way
to configure a pattern without the thread name for all these lines.
Any suggestions .?
Thanks again.
Regards.
Le mer. 1 oct. 2025 à 15:44, Matt Pavlovich <ma...@apache.org> a écrit :
> Your logging configuration must be using a pattern that includes the
> thread name in the log output. You can remove that macro, or configure a
> separate log appender for the packages you want to filter and give that a
> different logging pattern without the thread macro.
>
> -Matt
>
> > On Oct 1, 2025, at 5:35 AM, Ephemeris Lappis <ep...@gmail.com>
> wrote:
> >
> > Hello.
> >
> > We need to use the Karaf's shell "log" command to trace actions during
> some deployment opérations..
> >
> > We've seen that the thread name using the "log:log" command is the
> command itself, producing very big lines in the log file.
> >
> > Example :
> > admin@root()> log:log --level WARNING "A very very long text..."
> > 12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long
> text..."] A very very long text...
> >
> > The thread name is "pipe-log:log --level WARNING "A very very long
> text...""
> >
> > In reality, messages may be actually bigger, since we want to trace very
> detailed information about the current deployments.
> >
> > Is there any way to avoid this ?
> >
> > Thanks in advance for your help.
> >
> > Regards.
>
>
Re: Karaf shell / "log:log" command
Posted by Jérémie <je...@gmail.com>.
Hello,
I already did it here :
https://issues.apache.org/jira/browse/KARAF-7256?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel
Regards
mie., 1 oct. 2025, 21:51 Matt Pavlovich <ma...@apache.org> a scris:
> Hi Jérémie-
>
> That should be filed as an issue— please open a ticket and we can detect
> command line options that are marked as ‘masked’ and log them using ‘****’
> instead of clear text.
>
> Open ticket here:
> https://github.com/apache/karaf/issues
>
> Thanks,
> Matt Pavlovich
>
> On Oct 1, 2025, at 11:13 AM, Jérémie <je...@gmail.com> wrote:
>
> Hello,
>
> In the same type, there is also a "vulnerability" tagged by our sec team
> internally: if you execute a command with a password as a parameter, this
> password will be present in the logs, even if the parameter is declared as
> "masked". Because it is set unfiltered as the thread name of the command.
>
> Regards,
> Jérémie
>
> mie., 1 oct. 2025, 16:10 Ephemeris Lappis <ep...@gmail.com> a
> scris:
>
>> Hello.!
>>
>> The current default appender is right for all our logs, except for shell
>> commands that are used by our dev-ops tools and generate very long (and
>> very useless) thread names".
>> How can we filter these commands that have no package, thus no explicit
>> appender ?
>>
>> Another very strange shell behavior :
>>
>> executing the command :
>> x="json = {\"a\":1, \"b\":2}"
>> .
>> produces a repeated "json = " pattern, it seems that the "{...,..." is
>> interpreted as a repeated action pattern. I've found no explanation in the
>> shell manual.
>>
>> json = "a":1 json = "b":2
>>
>> Is there a way to disable this command expansion : our dev-ops jobs fail
>> because of that :(
>>
>> Thanks.
>>
>> Regards.
>>
>>
>> Le mer. 1 oct. 2025 à 15:44, Matt Pavlovich <ma...@apache.org> a
>> écrit :
>>
>>> Your logging configuration must be using a pattern that includes the
>>> thread name in the log output. You can remove that macro, or configure a
>>> separate log appender for the packages you want to filter and give that a
>>> different logging pattern without the thread macro.
>>>
>>> -Matt
>>>
>>> > On Oct 1, 2025, at 5:35 AM, Ephemeris Lappis <
>>> ephemeris.lappis@gmail.com> wrote:
>>> >
>>> > Hello.
>>> >
>>> > We need to use the Karaf's shell "log" command to trace actions during
>>> some deployment opérations..
>>> >
>>> > We've seen that the thread name using the "log:log" command is the
>>> command itself, producing very big lines in the log file.
>>> >
>>> > Example :
>>> > admin@root()> log:log --level WARNING "A very very long text..."
>>> > 12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long
>>> text..."] A very very long text...
>>> >
>>> > The thread name is "pipe-log:log --level WARNING "A very very long
>>> text...""
>>> >
>>> > In reality, messages may be actually bigger, since we want to trace
>>> very detailed information about the current deployments.
>>> >
>>> > Is there any way to avoid this ?
>>> >
>>> > Thanks in advance for your help.
>>> >
>>> > Regards.
>>>
>>>
>
Re: Karaf shell / "log:log" command
Posted by Matt Pavlovich <ma...@apache.org>.
Hi Jérémie-
That should be filed as an issue— please open a ticket and we can detect command line options that are marked as ‘masked’ and log them using ‘****’ instead of clear text.
Open ticket here:
https://github.com/apache/karaf/issues
Thanks,
Matt Pavlovich
> On Oct 1, 2025, at 11:13 AM, Jérémie <je...@gmail.com> wrote:
>
> Hello,
>
> In the same type, there is also a "vulnerability" tagged by our sec team internally: if you execute a command with a password as a parameter, this password will be present in the logs, even if the parameter is declared as "masked". Because it is set unfiltered as the thread name of the command.
>
> Regards,
> Jérémie
>
> mie., 1 oct. 2025, 16:10 Ephemeris Lappis <ephemeris.lappis@gmail.com <ma...@gmail.com>> a scris:
>> Hello.!
>>
>> The current default appender is right for all our logs, except for shell commands that are used by our dev-ops tools and generate very long (and very useless) thread names".
>> How can we filter these commands that have no package, thus no explicit appender ?
>>
>> Another very strange shell behavior :
>>
>> executing the command :
>> x="json = {\"a\":1, \"b\":2}"
>> .
>> produces a repeated "json = " pattern, it seems that the "{...,..." is interpreted as a repeated action pattern. I've found no explanation in the shell manual.
>>
>> json = "a":1 json = "b":2
>>
>> Is there a way to disable this command expansion : our dev-ops jobs fail because of that :(
>>
>> Thanks.
>>
>> Regards.
>>
>>
>> Le mer. 1 oct. 2025 à 15:44, Matt Pavlovich <mattrpav@apache.org <ma...@apache.org>> a écrit :
>>> Your logging configuration must be using a pattern that includes the thread name in the log output. You can remove that macro, or configure a separate log appender for the packages you want to filter and give that a different logging pattern without the thread macro.
>>>
>>> -Matt
>>>
>>> > On Oct 1, 2025, at 5:35 AM, Ephemeris Lappis <ephemeris.lappis@gmail.com <ma...@gmail.com>> wrote:
>>> >
>>> > Hello.
>>> >
>>> > We need to use the Karaf's shell "log" command to trace actions during some deployment opérations..
>>> >
>>> > We've seen that the thread name using the "log:log" command is the command itself, producing very big lines in the log file.
>>> >
>>> > Example :
>>> > admin@root()> log:log --level WARNING "A very very long text..."
>>> > 12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long text..."] A very very long text...
>>> >
>>> > The thread name is "pipe-log:log --level WARNING "A very very long text...""
>>> >
>>> > In reality, messages may be actually bigger, since we want to trace very detailed information about the current deployments.
>>> >
>>> > Is there any way to avoid this ?
>>> >
>>> > Thanks in advance for your help.
>>> >
>>> > Regards.
>>>
Re: Karaf shell / "log:log" command
Posted by Jérémie <je...@gmail.com>.
Hello,
In the same type, there is also a "vulnerability" tagged by our sec team
internally: if you execute a command with a password as a parameter, this
password will be present in the logs, even if the parameter is declared as
"masked". Because it is set unfiltered as the thread name of the command.
Regards,
Jérémie
mie., 1 oct. 2025, 16:10 Ephemeris Lappis <ep...@gmail.com> a
scris:
> Hello.!
>
> The current default appender is right for all our logs, except for shell
> commands that are used by our dev-ops tools and generate very long (and
> very useless) thread names".
> How can we filter these commands that have no package, thus no explicit
> appender ?
>
> Another very strange shell behavior :
>
> executing the command :
> x="json = {\"a\":1, \"b\":2}"
> .
> produces a repeated "json = " pattern, it seems that the "{...,..." is
> interpreted as a repeated action pattern. I've found no explanation in the
> shell manual.
>
> json = "a":1 json = "b":2
>
> Is there a way to disable this command expansion : our dev-ops jobs fail
> because of that :(
>
> Thanks.
>
> Regards.
>
>
> Le mer. 1 oct. 2025 à 15:44, Matt Pavlovich <ma...@apache.org> a
> écrit :
>
>> Your logging configuration must be using a pattern that includes the
>> thread name in the log output. You can remove that macro, or configure a
>> separate log appender for the packages you want to filter and give that a
>> different logging pattern without the thread macro.
>>
>> -Matt
>>
>> > On Oct 1, 2025, at 5:35 AM, Ephemeris Lappis <
>> ephemeris.lappis@gmail.com> wrote:
>> >
>> > Hello.
>> >
>> > We need to use the Karaf's shell "log" command to trace actions during
>> some deployment opérations..
>> >
>> > We've seen that the thread name using the "log:log" command is the
>> command itself, producing very big lines in the log file.
>> >
>> > Example :
>> > admin@root()> log:log --level WARNING "A very very long text..."
>> > 12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long
>> text..."] A very very long text...
>> >
>> > The thread name is "pipe-log:log --level WARNING "A very very long
>> text...""
>> >
>> > In reality, messages may be actually bigger, since we want to trace
>> very detailed information about the current deployments.
>> >
>> > Is there any way to avoid this ?
>> >
>> > Thanks in advance for your help.
>> >
>> > Regards.
>>
>>
Re: Karaf shell / "log:log" command
Posted by Ephemeris Lappis <ep...@gmail.com>.
Hello.!
The current default appender is right for all our logs, except for shell
commands that are used by our dev-ops tools and generate very long (and
very useless) thread names".
How can we filter these commands that have no package, thus no explicit
appender ?
Another very strange shell behavior :
executing the command :
x="json = {\"a\":1, \"b\":2}"
.
produces a repeated "json = " pattern, it seems that the "{...,..." is
interpreted as a repeated action pattern. I've found no explanation in the
shell manual.
json = "a":1 json = "b":2
Is there a way to disable this command expansion : our dev-ops jobs fail
because of that :(
Thanks.
Regards.
Le mer. 1 oct. 2025 à 15:44, Matt Pavlovich <ma...@apache.org> a écrit :
> Your logging configuration must be using a pattern that includes the
> thread name in the log output. You can remove that macro, or configure a
> separate log appender for the packages you want to filter and give that a
> different logging pattern without the thread macro.
>
> -Matt
>
> > On Oct 1, 2025, at 5:35 AM, Ephemeris Lappis <ep...@gmail.com>
> wrote:
> >
> > Hello.
> >
> > We need to use the Karaf's shell "log" command to trace actions during
> some deployment opérations..
> >
> > We've seen that the thread name using the "log:log" command is the
> command itself, producing very big lines in the log file.
> >
> > Example :
> > admin@root()> log:log --level WARNING "A very very long text..."
> > 12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long
> text..."] A very very long text...
> >
> > The thread name is "pipe-log:log --level WARNING "A very very long
> text...""
> >
> > In reality, messages may be actually bigger, since we want to trace very
> detailed information about the current deployments.
> >
> > Is there any way to avoid this ?
> >
> > Thanks in advance for your help.
> >
> > Regards.
>
>
Re: Karaf shell / "log:log" command
Posted by Matt Pavlovich <ma...@apache.org>.
Your logging configuration must be using a pattern that includes the thread name in the log output. You can remove that macro, or configure a separate log appender for the packages you want to filter and give that a different logging pattern without the thread macro.
-Matt
> On Oct 1, 2025, at 5:35 AM, Ephemeris Lappis <ep...@gmail.com> wrote:
>
> Hello.
>
> We need to use the Karaf's shell "log" command to trace actions during some deployment opérations..
>
> We've seen that the thread name using the "log:log" command is the command itself, producing very big lines in the log file.
>
> Example :
> admin@root()> log:log --level WARNING "A very very long text..."
> 12:29:39.362 WARN [pipe-log:log --level WARNING "A very very long text..."] A very very long text...
>
> The thread name is "pipe-log:log --level WARNING "A very very long text...""
>
> In reality, messages may be actually bigger, since we want to trace very detailed information about the current deployments.
>
> Is there any way to avoid this ?
>
> Thanks in advance for your help.
>
> Regards.