cli: Replace log4j2 with logback #5510
Conversation
The log4j2 logging framework recently gained some bad publicity for being the root cause for a couple of security issues / CVEs. A permanent solution to the security issues related to Log4j2 is a replacement with the well-known and battle-tested logback framework. The usage of the command-line tools remains unchanged, no additional options are introduced. Adding the capability to pass a pathname to a configuration file is left for future action. Signed-off-by: Rainer Bieniek <[email protected]>
Codecov Report
@@ Coverage Diff @@
## main #5510 +/- ##
============================================
- Coverage 73.19% 72.87% -0.32%
+ Complexity 2085 2081 -4
============================================
Files 268 268
Lines 14131 14131
Branches 2114 2114
============================================
- Hits 10343 10298 -45
- Misses 2704 2755 +51
+ Partials 1084 1078 -6
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
|
@porsche-rbieniek, while waiting for your references about why Logback is the better logging framework, I came across this performance comparison which does not make Logback look all that good compared to Log4j2... |
|
Something that's also worth considering in the choice of our logging implemenation is Graal compatibility. Esp. Log4j2 seems to have issues there, unfortunately 😞 |
|
Superseded by #5673. |
The log4j2 logging framework recently gained some bad publicity for being
the root cause for a couple of security issues / CVEs.
A permanent solution to the security issues related to Log4j2 is a
replacement with the well-known and battle-tested logback framework.
The usage of the command-line tools remains unchanged, no additional
options are introduced. Adding the capability to pass a pathname to a
configuration file is left for future action.
Signed-off-by: Rainer Bieniek [email protected]