Thanks for the code and information, even though it's a dispiriting
answer. If I have to write a new file, it'll likely take me most of a
year, if I'm even able to do it at all. It looks like the only feasible
way to remediate this code is either to remove logging altogether or maybe
see if running in bridge mode indefinitely will work.
Thanks again!
Joel
On Fri, Aug 12, 2022 at 8:01 PM Stephen Johns <mr.stephen.jo...@gmail.com>
wrote:
> Actually created new logger from scratch through code:
>
> Here is relevant code
>
> where pLogFilename is something like "MyServer.log"
>
>
>
> public static void initialize(String pLogFilename, String
> pConfigurationFilename) throws IOException {
> // Make sure the filename has the proper date format and is escaped
> to
> // allow passing through a SimpleDateFormat
> String _strPrefix = "";
> String _strSuffix = "";
> int i = pLogFilename.lastIndexOf('.');
> if (i >= 0) {
> _strPrefix = pLogFilename.substring(0, i);
> _strSuffix = pLogFilename.substring(i);
> } else {
> _strPrefix = pLogFilename;
> }
>
> pLogFilename = "'" + _strPrefix + "'yyyyMMdd";
> if (_strSuffix.length() > 0)
> pLogFilename += "'" + _strSuffix + "'";
>
> createLogger(pConfigurationFilename, _strPrefix, "yyyyMMdd",
> _strSuffix);
> }
>
>
> public static void createLogger(String pConfigFilename,
> String plogFilenamePrefix,
> String pLogFilenameDateFormat,
> String pLogFileNameSuffix) throws
> IOException {
> SimpleDateFormat _sdf = new
> SimpleDateFormat(pLogFilenameDateFormat);
> String _filename = plogFilenamePrefix + _sdf.format(new Date()) +
> pLogFileNameSuffix;
> createLogger(pConfigFilename, _filename,
> plogFilenamePrefix + "%d{" + pLogFilenameDateFormat + "}" +
> pLogFileNameSuffix);
> }
>
>
> /**
> * @param pConfigurationFilename
> * @param pLogFilename
> * @param pLogFilenamePattern
> * @throws IOException
> */
> public static void createLogger(String pConfigurationFilename,
> String pLogFilename,
> String pLogFilenamePattern) throws
> IOException {
>
> FileInputStream fileInputStream = new
> FileInputStream(pConfigurationFilename);
> ConfigurationSource configurationSource = new
> ConfigurationSource(fileInputStream);
>
> ConfigurationBuilder<BuiltConfiguration> configurationBuilder =
> ConfigurationBuilderFactory.newConfigurationBuilder();
> configurationBuilder.setConfigurationSource(configurationSource);
>
> AppenderComponentBuilder log4jFileAppenderBuilder =
> configurationBuilder.
> newAppender("DailyRollingFileAppender", "RollingFile");
> log4jFileAppenderBuilder.addAttribute("filename", pLogFilename);
> log4jFileAppenderBuilder.addAttribute("filePattern",
> pLogFilenamePattern);
>
> // set up roll-over
> ComponentBuilder triggeringPolicy =
> configurationBuilder.newComponent("Policies")
>
>
> .addComponent(configurationBuilder.newComponent("TimeBasedTriggeringPolicy").addAttribute("interval",
> "1"));
> log4jFileAppenderBuilder.addComponent(triggeringPolicy);
>
> // Configure the PatternLayout
> LayoutComponentBuilder layoutComponentBuilder =
> configurationBuilder.newLayout("PatternLayout").addAttribute("pattern",
> "%d{ABSOLUTE} %-5p %m%n");
> log4jFileAppenderBuilder.add(layoutComponentBuilder);
>
> // Add it back into configuration
> configurationBuilder.add(log4jFileAppenderBuilder);
>
> // Set up root
> RootLoggerComponentBuilder rootLogger =
> configurationBuilder.newRootLogger().
>
> add(configurationBuilder.newAppenderRef("DailyRollingFileAppender"));
> configurationBuilder.add(rootLogger);
>
> // Actually use it
> Configurator.reconfigure(configurationBuilder.build());
> //System.out.println("\n*******************************************
> LOG CONFIG ************************");
> // this is for debug - will print out what was created
> configurationBuilder.writeXmlConfiguration(System.out);
>
> }
>
>
> On Fri, Aug 12, 2022 at 6:18 PM Gary Gregory <garydgreg...@gmail.com>
> wrote:
>
> > Joel,
> >
> > Is it possible to use Log4j 2's much richer feature set as is? Perhaps
> you
> > could explain what is it your old appender does that requires custom
> code.
> >
> > Gary
> >
> > On Fri, Aug 12, 2022, 15:35 Joel Griffith <jgrif...@nd.edu> wrote:
> >
> > > I have a Java application containing a package written to use Log4j v1.
> > I
> > > am struggling to update this package to use Log4j v2 to remediate its
> > > security vulnerabilities.
> > >
> > > The package contains a custom Appender that subclasses Log4j v1's
> > > FileAppender. I am stumped at how to convert this file to Log4j v2.
> In
> > > Log4j v2, the FileAppender class is 'final' and cannot be subclassed,
> so
> > I
> > > cannot create a new version of the custom Appender that mirrors the
> > first.
> > > More importantly, perhaps, is that the Log4j v2 FileAppender is a
> Plugin
> > > and completely different in structure from the Log4j v1 FileAppender.
> > >
> > > I found this page that ostensibly explains how to extend Log4j:
> > > https://logging.apache.org/log4j/2.x/manual/extending.html#Appenders
> > > but it contains no information about actually extending Appenders or
> > > procedures for accomplishing an equivalent goal.
> > >
> > > Is there any reasonable way of converting this custom Appender from
> Log4j
> > > v1 to v2?
> > >
> > > Thanks,
> > > Joel
> > >
> >
>
>
> --
> ☮
>
