How to do logging in java using log4j api, best practices and tips

We talk about logging in general and the different levels used in java and then we talk about the log4j logging API and how to set it up for writing files, logging to console, or doing a custom setup. We also talk about different frameworks and best practices.

Github repository

Unlock unlimited opportunities with 50% off your first month of Coursera Plus

Join the channel to get access to more perks:

Or visit my blog at:

Outro music: Sanaas Scylla

#log4j #java #appender

[DanielPersson]

Message from the Log4j team.

"""
CVE-2021-44228
The Log4j team has been made aware of a security vulnerability, CVE-2021-44228, that has been addressed in Log4j 2.15.0.

Log4j’s JNDI support has not restricted what names could be resolved. Some protocols are unsafe or can allow remote code execution. Log4j now limits the protocols by default to only java, ldap, and ldaps and limits the ldap protocols to only accessing Java primitive objects by default served on the local host.

One vector that allowed exposure to this vulnerability was Log4j’s allowance of Lookups to appear in log messages. As of Log4j 2.15.0 this feature is now disabled by default. While an option has been provided to enable Lookups in this fashion, users are strongly discouraged from enabling it.

For those who cannot upgrade to 2.15.0, in releases >=2.10, this vulnerability can be mitigated by setting either the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true. For releases from 2.0-beta9 to 2.10.0, the mitigation is to remove the JndiLookup class from the classpath: zip -q -d log4j-core-*.jar
"""

[alansep]

I'm grateful for finding your content! That was really well explained! Thank you!

[scoop]

another classic vid from my boy daniel I have no idea why I'm subbed to you but you're a real one

[jiovannirosario]

I haven’t used log4j before so I was curious to learn a little about it in the wake of the security vulnerability that was announced today. Thanks.

[iamtheskywalker]

thanks very nice explained for only a 17 min video, it would be nice if you make a video on java fractals image in a near future, recursion is a very popular topic.

[alexandersmirnov]

i love your videos
Deep topic discovery

[harshamadhushan]

hi,

I have a small question. in this video you have configured the properties in the code level. So do we need to configure this in every class that we use logging or is there any specific place to add this configuration coding and use it everywhere without configuring it in every class. this video gives me lot of information.
Thank you

[aaronperl]

At my workplace we're using the Logback logging library, which I believe is built on top of Log4j. It was chosen before I started there, so I don't know the reasons behind why it was chosen instead of just plain Log4j.

I updated my IntelliJ templates to add the logger definition to each new class I create, and include the Logback dependencies in the pom.xml for new projects, which I find helps save me time trying to remember the exact syntax every time.

One problem we have is that there is a logback.xml config file to set up all the appenders, formats, filters, and default logging level ... but no one really understands how to configure it properly, so I think our logging strategy is sorely lacking.

We also don't have a strategy to change the default logging level (for example, to temporarily enable TRACE level to debug an issue in production), without editing the file and building a new package... which is far from ideal :)

[chaitutom]

Hi sir how to solve to seralize method using level in version2 in log4j using logevent

[pattyboi]

The import import org.apache.log4j.*; is red for me, I assume there is another step you did not include? Any links to tutorials explaining this, I can't find one anywhere?

[ryanlee]

When this video was made…we thought the Covid was the worst thing

[PointFear]

Oh my
Im glad that he knows about the log4j vulnerability