DOCSEARCHbyAlgolia
Submit Docs

reload4j

repository·master·Indexed 41 days ago

https://github.com/qos-ch/reload4j

A security-focused fork of Apache log4j 1.2.17 designed as a drop-in replacement to fix vulnerabilities without requiring changes to application source code. Includes the Chainsaw GUI log viewer and ExternallyRolledFileAppender for remote log rotation via TCP sockets.

Tokens
1.1K
Snippets
4
Records
7
Agent score
51%

What's inside reload4j

  1. What is reload4j?

    master

    reload4j is a fork of Apache log4j version 1.2.17 designed to fix pressing security issues. It is intended as a drop-in replacement for log4j 1.2.17.

    To use it, you simply replace log4j.jar with reload4j.jar in your build/classpath. No changes to your Java source code are required.

  2. Replace log4j 1.2.17 with reload4j

    master

    To address vulnerabilities in log4j 1.2.17, perform a drop-in replacement by swapping the library in your dependency management (e.g., Maven or Gradle) or your application classpath:

    1. Remove log4j:log4j:1.2.17 (or your current version).
    2. Add ch.qos.reload4j:reload4j (version 1.2.18.0 or later recommended).

    No modifications to your existing Java source files are necessary.

  3. Use ExternallyRolledFileAppender for remote log rotation

    master

    ExternallyRolledFileAppender is a specialized RollingFileAppender that allows an external process to trigger a log file rollover via a network socket. This is useful for operating system-independent, fast, and reliable log rotation.

    How it works

    1. The appender listens on a specific TCP port.
    2. An external client connects to that port and sends the exact string RollOver.
    3. The appender performs the rollover and sends back an OK acknowledgment.

    Security Warning

    The initiator is not authenticated. Anyone who can reach the specified port can trigger a rollover. In production environments, ensure you have network-level protections (like firewalls) to prevent unauthorized access.

    Configuration

    To use this appender, you must set the Port property in your log configuration to the desired TCP port.

    Protocol Constants

    • Trigger Message: RollOver (must be sent by the client)
    • Acknowledgment Message: OK (sent by the appender upon success)
    # Example Log4j Configuration (Conceptual)
externallyRolledFileAppender.Port = 45678
externallyRolledFileAppender.File = /path/to/your/logfile.log
externallyRolledFileAppender.MaxFileSize = 10MB
externallyRolledFileAppender.DatePattern = "yyyy-MM-dd"

  4. Run the Chainsaw log viewer application

    master

    Chainsaw is a GUI-based log viewer for Log4J. It can load existing log files via the File > Load file... menu or receive live log events via a socket receiver.

    To launch the application, execute the org.apache.log4j.chainsaw.Main class. The application initializes a default Log4J configuration for its own internal logging before launching the GUI.

    java org.apache.log4j.chainsaw.Main

  5. Configure the Chainsaw listening port

    master

    Chainsaw acts as a log viewer that can receive log messages over a network socket. By default, it listens on port 4445. You can change this port by setting the system property chainsaw.port when starting the application.

    If the provided value for chainsaw.port is not a valid integer, the application will display an error message and exit.

    # Example: Running Chainsaw on a custom port (e.g., 5555)
java -Dchainsaw.port=5555 -cp your-classpath org.apache.log4j.chainsaw.Main

  6. Configure the Port for ExternallyRolledFileAppender

    master

    The Port property defines the TCP port that the ExternallyRolledFileAppender will listen on for rollover signals. If the port is set to 0, the appender will not start the listening thread.

    In a programmatic setup, use setPort(int port). In a configuration file, use the Port key.

    // Programmatic configuration
ExternallyRolledFileAppender appender = new ExternallyRolledFileAppender();
appender.setPort(45678);
appender.activateOptions();

  7. ExternallyRolledFileAppender API Reference

    master

    ExternallyRolledFileAppender extends RollingFileAppender and provides the following methods for managing the external rollover listener:

    MethodDescription
    setPort(int port)Sets the TCP port for listening to external rollover messages.
    getPort()Returns the currently configured port.
    activateOptions()Starts the background thread that listens on the specified port. This method calls the superclass activateOptions() first.