Due to the recent vulnerability found on Log4j, We were tasked to move to version >= 2.16.0. Initially, my project was using <version>1.2.17</version>
After adding the necessary dependency, and making the necessary changes, on initiating a request I get the below error:
Caused by: java.lang.NoClassDefFoundError: Could not initialize class org.apache.logging.log4j.core.LoggerContext
My POM file
<dependencies> <dependency> <groupId>javax</groupId> <artifactId>javaee-api</artifactId> <version>8.0</version> <scope>provided</scope> </dependency> <dependency> <groupId>org.apache.logging.log4j</groupId> <artifactId>log4j-api</artifactId> <version>2.16.0</version> </dependency> <dependency> <groupId>org.apache.logging.log4j</groupId> <artifactId>log4j-core</artifactId> <version>2.16.0</version> </dependency> <dependency> <groupId>com.squareup.okhttp3</groupId> <artifactId>okhttp</artifactId> <version>4.9.1</version> </dependency> <dependency> <groupId>org.apache.httpcomponents</groupId> <artifactId>httpclient</artifactId> <version>4.5.12</version> </dependency> <dependency> <groupId>org.apache.httpcomponents</groupId> <artifactId>httpcore</artifactId> <version>4.4.13</version> <type>jar</type> </dependency> <dependency> <groupId>org.json</groupId> <artifactId>json</artifactId> <version>20190722</version> <type>jar</type> </dependency> <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> <version>5.1.47</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.10.2</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-annotations</artifactId> <version>2.10.2</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-core</artifactId> <version>2.10.2</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.dataformat</groupId> <artifactId>jackson-dataformat-xml</artifactId> <version>2.10.2</version> </dependency> <dependency> <groupId>org.codehaus.sonar</groupId> <artifactId>sonar-plugin-api</artifactId> <version>5.1</version> <scope>provided</scope> </dependency> <dependency> <groupId>javax.validation</groupId> <artifactId>validation-api</artifactId> <version>2.0.0.Final</version> <scope>provided</scope> </dependency> <dependency> <groupId>org.hibernate.validator</groupId> <artifactId>hibernate-validator-annotation-processor</artifactId> <version>6.0.2.Final</version> <scope>provided</scope> </dependency> <dependency> <groupId>com.fasterxml.woodstox</groupId> <artifactId>woodstox-core</artifactId> <version>5.0.2</version> </dependency> <dependency> <groupId>org.apache.velocity</groupId> <artifactId>velocity</artifactId> <version>1.7</version> </dependency> <dependency> <groupId>org.apache.velocity</groupId> <artifactId>velocity-tools</artifactId> <version>2.0</version> </dependency> <dependency> <groupId>org.apache.poi</groupId> <artifactId>poi-ooxml</artifactId> <version>5.0.0</version> </dependency> <!-- Tests Dependencies --> <dependency> <groupId>junit</groupId> <artifactId>junit</artifactId> <version>4.12</version> <scope>test</scope> </dependency> <dependency> <groupId>org.mockito</groupId> <artifactId>mockito-core</artifactId> <version>3.5.13</version> <scope>test</scope> </dependency> <dependency> <groupId>org.glassfish.jersey.core</groupId> <artifactId>jersey-common</artifactId> <version>2.22.2</version> <scope>test</scope> </dependency> <dependency> <groupId>org.hamcrest</groupId> <artifactId>hamcrest-core</artifactId> <version>1.3</version> <scope>test</scope> </dependency> <dependency> <groupId>org.eclipse.microprofile</groupId> <artifactId>microprofile</artifactId> <version>2.0.1</version> <type>pom</type> <scope>provided</scope> </dependency>and my code and Log4J2 initialization
@Stateless
public class SessionKeyService { private static final Logger LOGGER = LogManager.getLogger(SessionKeyService.class); public String getSessionKeyID() { try { String url = properties.getProperty(Global.ENDPOINT_URL); ........ SessionKey sessionKey = new SessionKey(); sessionKey.setStatus(tokenObj.optString("Status")); sessionKey.setMessage(tokenObj.optString("Message")); sessionKey.setKey(tokenObj.optString("SessionKey")); return sessionKey.getKey(); } catch (Exception ex) { LOGGER.error("Error: "+ex); } return null; }Log4j2 XML file
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="info" name="AppName" packages=""> <Appenders> <Console name="LogToConsole" target="SYSTEM_OUT"> <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %-5level %logger{36} - %m%n"/> </Console> <RollingFile name="LogToRollingFile" fileName="/opt/log/app-name.log" filePattern="logs/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz"> <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %-5level %logger{36} - %m%n"/> <Policies> <TimeBasedTriggeringPolicy /> <SizeBasedTriggeringPolicy size="50 MB" /> </Policies> <DefaultRolloverStrategy max="10"/> </RollingFile> </Appenders> <Loggers> <Root level="INFO">
<!-- <AppenderRef ref="syslogAppender" />--> <AppenderRef ref="LogToRollingFile"/> <AppenderRef ref="LogToConsole" /> </Root> </Loggers>
</Configuration>Please, I don't know where the LoggerContext is coming up.
93 Answers
I found out that WildFly (WidlFly version 24) logging is conflicting with the app when trying to deploy.
SOLUTION:I created a jboss-deployment-structure.xml in my /resources/webapp/WEB-INF/ and included the below
<?xml version="1.0" encoding="UTF-8"?>
<jboss-deployment-structure xmlns="urn:jboss:deployment-structure:1.2" xmlns:xsi=""> <deployment> <exclude-subsystems> <subsystem name="logging"/> </exclude-subsystems> </deployment>
</jboss-deployment-structure>We faced this similar issue and found out that two of our project's dependencies were also transitively using log4j-core and log4j-api jars of different/same versions.
So at the run time there could have been a chance of conflict of multiple LoggerContext due to which we saw this error.
We removed the error by excluding that dependency as it was not necessary.And it worked fine for us.
Although we could also exclude directly log4j from the dependency to solve the issue like below.
<dependency> <groupId>GroupId</groupId> <artifactId>ArtifactId</artifactId> <version>version</version> <exclusions> <exclusion> <groupId>org.apache.logging.log4j</groupId> <artifactId>log4j-api</artifactId> </exclusion> <exclusion> <groupId>org.apache.logging.log4j</groupId> <artifactId>log4j-core</artifactId> </exclusion> </exclusions> </dependency> I encountered this error when I upgraded the log4j-core dependency (because earlier versions had a vulnerability) but I forgot to upgrade the log4j-api dependency. Upgrading both to the latest (at time of writing 2.16.0) fixed it for me.
<dependency> <groupId>org.apache.logging.log4j</groupId> <artifactId>log4j-core</artifactId> <version>2.16.0</version>
</dependency>
<dependency> <groupId>org.apache.logging.log4j</groupId> <artifactId>log4j-api</artifactId> <version>2.16.0</version>
</dependency>
