[
https://issues.apache.org/jira/browse/LOG4J2-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17500664#comment-17500664
]
Radim Tlusty commented on LOG4J2-3423:
--------------------------------------
It's rather a weird design of the {{{}URLConnection{}}}.
The story begins in Tomcat, where is (by default) disabled caching of
{{{}URLConnection{}}}s
([https://github.com/apache/tomcat/blob/9.0.x/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java#L340]).
However, this setting is right as it prevents even bigger problems.
When the {{URLConnection}} caching is disabled, then it's necessary to manually
close the JAR file, which is opened inside of the {{{}JarURLConnection{}}}.
Example is e.g. here -
[https://stackoverflow.com/questions/36517604/closing-a-jarurlconnection|https://stackoverflow.com/questions/36517604/closing-a-jarurlconnection.]
Similar problems were detected and some workarounds have been made also in
Spring framework -
[https://github.com/spring-projects/spring-framework/issues/10961]
However, when I first tried to change to code so, that the JAR file is properly
closed (as in the examples/issues above), it still didn't work on my test in
Tomcat (~ the JAR file containing the Log4j configuration couldn't be deleted
after undeployment). Therefore I've opted for the solution to use the
{{URL.openConnection()}} method, which was used up to Log4j version 2.13.3.
I've tested it on Tomcat 8 and 9, Java 1.8.0_291 and 11.0.6 - both failing
before and working after the change.
> JAR file containing Log4j configuration isn't closed
> ----------------------------------------------------
>
> Key: LOG4J2-3423
> URL: https://issues.apache.org/jira/browse/LOG4J2-3423
> Project: Log4j 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 2.14.0
> Environment: Windows
> Reporter: Radim Tlusty
> Priority: Major
>
> If the Log4j configuration file is inside of a JAR file, then the JAR file
> (which is backed by the {{JarURLConnection}} retrieved from
> {{{}URL.openConnection{}}}) isn't closed.
> This causes problems on Tomcat running on Windows during undeploying of an
> application, because the opened JAR file can't be deleted.
> The problem was introduced during implementation of LOG4J2-2901 (version
> 2.14.0), where the {{URL.openStream}} was replaced by {{URL.openConnection}}
> in the class {{{}org.apache.logging.log4j.core.config.ConfigurationSource{}}}.
> The proposed solution (https://github.com/apache/logging-log4j2/pull/780) is
> to use the {{URL.openConnection}} only when needed (~ configuration URL has
> HTTPS protocol), otherwise similar code as in previous versions (<= 2.13.3)
> would be used.
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
