Java негізіндегі Log4j журналын жазу бағдарламасы

Java based logging software
the Java logging framework

Apache Log4j is a Java based logging utility originally written by Ceki Gülcü. It is part of the Apache Logging Services, a project of the Apache Software Foundation. Log4j is one of several Java logging frameworks. Gülcü has since created SLF4J, Reload4j, and Logback which are alternatives to Log4j. The Apache Log4j team developed Log4j 2 in response to the problems of Log4j 1.2, 1.3, java. util. logging and Logback, addressing issues which appeared in those frameworks. In addition, Log4j 2 offered a plugin architecture which makes it more extensible than its predecessor. Log4j 2 is not backwards compatible with 1. x versions, although an "adapter" is available. On August 5, 2015, the Apache Logging Services Project Management Committee announced that Log4j 1 had reached end of life and that users of Log4j 1 were advised to upgrade to Apache Log4j 2. On January 12, 2022, a forked and renamed log4j version 1.2 was released by Ceki Gülcü as Reload4j version 1.2.18.0 with the aim of fixing the most urgent issues in log4j 1.2.17 that had accumulated since its release in 2013. On December 9, 2021, a zero day vulnerability involving arbitrary code execution in Log4j 2 was published by the Alibaba Cloud Security Team and given the descriptor "Log4Shell". from Log4j 1 are:
Improved reliability. Messages are not lost while reconfiguring the framework like in Log4j 1 or Logback
Extensibility: Log4j 2 supports a plugin system to let users define and configure custom components
Simplified configuration syntax
Support for xml, json, yaml and properties configurations
Improved filters
Property lookup support for values defined in the configuration file, system properties, environment variables, the ThreadContext Map, and data present in the event
Support for multiple APIs: Log4j 2 can be used with applications using the Log4j 2, Log4j 1.2, SLF4J, Commons Logging and java. util. logging (JUL) APIs. Custom log levels
Java 8 style lambda support for "lazy logging"
Markers
Support for user defined Message objects
"Garbage free or low garbage" in common configurations
Improved speed
Improved support for Linux

One of the most recognized features of Log4j 2 is the performance of the "Asynchronous Loggers". Log4j 2 makes use of the LMAX Disruptor. The library reduces the need for kernel locking and increases the logging performance by a factor of 12. For example, in the same environment Log4j 2 can write more than 18,000,000 messages per second, whereas other frameworks like Logback and Log4j 1 just write < 2,000,000 messages per second.

The following table defines the built in log levels and messages in Log4j, in decreasing order of severity. The left column lists the log level designation in Log4j and the right column provides a brief description of each log level. Level Description OFF The highest possible rank and is intended to turn off logging. FATAL Severe errors that cause premature termination. Expect these to be immediately visible on a status console. ERROR Other runtime errors or unexpected conditions. Expect these to be immediately visible on a status console. WARN Use of deprecated APIs, poor use of API, 'almost' errors, other runtime situations that are undesirable or unexpected, but not necessarily "wrong". Expect these to be immediately visible on a status console. INFO Interesting runtime events (startup/shutdown). Expect these to be immediately visible on a console, so be conservative and keep to a minimum. DEBUG Detailed information on the flow through the system. Expect these to be written to logs only. Generally speaking, most lines logged by your application should be written as DEBUG. TRACE Most detailed information. Expect these to be written to logs only. Since version 1.2.12.

Log4j 2 allows users to define their own log levels. A source code generator tool is provided to create Loggers that support custom log levels identically to the built in log levels. Custom log levels can either complement or replace the built in log levels.

log4c – A port for C. Log4C is a C based logging library, released on SourceForge under the LGPL license. For various Unix operating systems the autoconf and automake files are provided. On Windows a Makefile is provided for use with MSVC. Developers may also choose to use their own make system to compile the source, depending on their build engineering requirements. An instance of the log4c library may be configured via three methods: using environment variables, programmatically, or via XML configuration file. log4c has appenders for Files, Streams and memory mapped files. (No Socket Adapter.) Last version is 1.2.4, released in 2013, and the project is no longer actively developed. log4js – A port for JavaScript. Log4js is available under the licence of Apache Software Foundation. One special feature of Log4js is the ability to log the events of the browser remotely on the server. Using Ajax it is possible to send the logging events in several formats (XML, JSON, plain ASCII, etc.) to the server to be evaluated there. The following appenders are implemented for log4js: AjaxAppender, ConsoleAppender, FileAppender, JSConsoleAppender, MetatagAppender, and WindowsEventsAppender. The following Layout classes are provided: BasicLayout, HtmlLayout, JSONLayout, and XMLLayout. Latest version as of 2021 was 2.0 of 18 October 2018.
log4javascript – Another port for JavaScript. log4javascript is a JavaScript logging framework based on the log4j. The latest version as of 2021 was 1.4.13, released on 23 May 2015. JSNLog – A port for JavaScript. Automatically places messages from JavaScript loggers in server side logs using a NET server side component that interfaces with Log4Net, NLog, Elmah or Common. Logging. This to provide an integrated log for client and server side events. Request ids correlate events related to a specific user. Configuration is via a server side web. config file. Supports exception logging including stack traces. as of 2021 the latest version was 3.0.0 and updates were made regularly. Apache Log4net – A port to the Microsoft NET Framework. The initial work was done by Neoworks and was donated to the Apache Software Foundation in February 2004. The framework is similar to the original log4j while taking advantage of new features in the NET runtime. Provides Nested Diagnostic Context (NDC) and Mapped Diagnostic Context (MDC). The latest version as of 2022 was 2.0.15.
log4perl – A Perl port of log4j. Version 1.49 of February 2017 was current as of 2021. Apache log4php – "A versatile logging framework for PHP. Originally a port of Apache log4j to PHP, it has grown to include various PHP specific features." PL SQL Logging Utility is an adaptation of log4j in PL/SQL. Log4db2 is a logging utility for DB2 for LUW that uses SQL instructions with SQL PL code. Apache Log4cxx – A logging framework for C++ patterned after Apache log4j, which uses Apache Portable Runtime for most platform specific code and should be usable on any platform supported by APR. The latest version is 0.13.0, released in 2022. Log4r – A comprehensive and flexible logging library written in Ruby for use in Ruby programs. It was inspired by and provides much of the features of the Apache Log4j project.

A zero day vulnerability involving remote code execution in Log4j 2, given the descriptor "Log4Shell" (CVE 2021 44228), was found and reported to Apache by Alibaba on November 24, 2021, and published in a tweet on December 9, 2021. Affected services include Cloudflare, iCloud, Minecraft: Java Edition, Steam, Tencent QQ, and Twitter. The Apache Software Foundation assigned the maximum CVSS severity rating of 10 to Log4Shell, as millions of servers could be potentially vulnerable to the exploit. and Lunasec's Free Wortley characterized it as "a design failure of catastrophic proportions". In the United States, the director of the Cybersecurity and Infrastructure Security Agency (CISA), Jen Easterly, termed the exploit "critical" and advised vendors to prioritize software updates, and the German agency Federal Office for Information Security (BSI) designated the exploit as being at its highest threat level, calling it an "extremely critical threat situation" (translated). The Canadian Centre for Cyber Security (CCCS) called on organisations to take on immediate action. The feature causing the vulnerability could be disabled with a configuration setting, which had been removed in Log4j version 2.15.0 rc1 (officially released on December 6, 2021, three days before the vulnerability was published), and replaced by various settings restricting remote lookups, thereby mitigating the vulnerability. For additional security, all features using JNDI, on which this vulnerability was based, will be disabled by default, and support for message lookups removed from version 2.16.0 onward.