Win a copy of Beginning Java 17 Fundamentals: Object-Oriented Programming in Java 17 this week in the Java in General forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Tim Cooke
  • Campbell Ritchie
  • Ron McLeod
  • Liutauras Vilda
  • Jeanne Boyarsky
Sheriffs:
  • Junilu Lacar
  • Rob Spoor
  • Paul Clapham
Saloon Keepers:
  • Tim Holloway
  • Tim Moores
  • Jesse Silverman
  • Stephan van Hulst
  • Carey Brown
Bartenders:
  • Al Hobbs
  • Piet Souris
  • Frits Walraven

log4j LogManager Class Not Found

 
Ranch Hand
Posts: 2131
2
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I have upgraded the log4j-1.2.17.jar to log4j-api-2.16.0.jar and  log4j-core-2.16.0.jar in my application to fix security issues and now I am getting these errors.
Am I missing a dependency file maybe?

[1/6/22 10:32:25:445 CST] 0000011a SystemErr     R com.ibm.websphere.servlet.error.ServletErrorReport: java.lang.NoClassDefFoundError: org.apache.log4j.LogManager
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1325)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:779)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:478)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.servlet.ServletWrapperImpl.handleRequest(ServletWrapperImpl.java:178)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.filter.WebAppFilterChain.invokeTarget(WebAppFilterChain.java:136)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:97)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.FAIWebApp._application._qms.QMSFilterImproved.doFilter(QMSFilterImproved.java:75)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:195)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:91)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:960)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1064)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleRequest(CacheServletWrapper.java:87)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:914)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1662)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:200)
[1/6/22 10:32:25:446 CST] 0000011a SystemErr     R at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:459)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:526)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:312)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.ws.http.channel.inbound.impl.HttpICLReadCallback.complete(HttpICLReadCallback.java:88)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1864)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R Caused by: java.lang.NoClassDefFoundError: org.apache.log4j.LogManager
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at org.slf4j.impl.Log4jLoggerFactory.<init>(Log4jLoggerFactory.java:66)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at org.slf4j.impl.StaticLoggerBinder.<init>(StaticLoggerBinder.java:72)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at org.slf4j.impl.StaticLoggerBinder.<clinit>(StaticLoggerBinder.java:45)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at org.slf4j.LoggerFactory.getSingleton(LoggerFactory.java:229)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at org.slf4j.LoggerFactory.bind(LoggerFactory.java:119)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at org.slf4j.LoggerFactory.performInitialization(LoggerFactory.java:110)
[1/6/22 10:32:25:447 CST] 0000011a SystemErr     R at org.slf4j.LoggerFactory.getILoggerFactory(LoggerFactory.java:274)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:247)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:260)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.io.font.FontRegisterProvider.<clinit>(FontRegisterProvider.java:65)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.io.font.FontProgramFactory.<clinit>(FontProgramFactory.java:61)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.kernel.font.PdfFontFactory.createFont(PdfFontFactory.java:215)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.kernel.font.PdfFontFactory.createFont(PdfFontFactory.java:201)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.kernel.font.PdfFontFactory.createFont(PdfFontFactory.java:143)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.kernel.font.PdfFontFactory.createFont(PdfFontFactory.java:92)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.RootElement.getDefaultProperty(RootElement.java:180)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.AbstractRenderer.getProperty(AbstractRenderer.java:289)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.AbstractRenderer.getProperty(AbstractRenderer.java:282)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.AbstractRenderer.getProperty(AbstractRenderer.java:282)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.AbstractRenderer.getProperty(AbstractRenderer.java:282)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.AbstractRenderer.getProperty(AbstractRenderer.java:282)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.TextRenderer.resolveFonts(TextRenderer.java:1045)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.LineRenderer.resolveChildrenFonts(LineRenderer.java:706)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.LineRenderer.layout(LineRenderer.java:94)
[1/6/22 10:32:25:448 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.ParagraphRenderer.layout(ParagraphRenderer.java:171)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.BlockRenderer.layout(BlockRenderer.java:145)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.itextpdf.layout.renderer.RootRenderer.addChild(RootRenderer.java:222)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.itextpdf.layout.RootElement.add(RootElement.java:108)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.itextpdf.layout.Document.add(Document.java:143)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.itextpdf.layout.Document.add(Document.java:68)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.itextpdf.layout.RootElement.showTextAligned(RootElement.java:359)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.FAIWebApp._application._datarepository._Engineering.DrawingDataRespository.AppendHistoricalWatermark(DrawingDataRespository.java:394)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.FAIWebApp._application._datarepository._Engineering.DrawingDataRespository.historicalfilelist(DrawingDataRespository.java:337)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.FAIWebApp._application._datarepository._Engineering.DrawingDataRespository.drawingNumberFilePathList(DrawingDataRespository.java:269)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.FAIWebApp._application._datarepository._Engineering.DrawingDataRespository.drawingNumberV7List(DrawingDataRespository.java:207)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.FAIWebApp._application._datarepository._Engineering.DrawingDataRespository.drawingNumberV7(DrawingDataRespository.java:138)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.FAIWebApp._drawings.controllers.DrawingNumberControllerServlet.doPost(DrawingNumberControllerServlet.java:130)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at javax.servlet.http.HttpServlet.service(HttpServlet.java:595)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at javax.servlet.http.HttpServlet.service(HttpServlet.java:668)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1230)
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R ... 26 more
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R Caused by: java.lang.ClassNotFoundException: org.apache.log4j.LogManager
[1/6/22 10:32:25:449 CST] 0000011a SystemErr     R at java.net.URLClassLoader.findClass(URLClassLoader.java:602)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at com.ibm.ws.bootstrap.ExtClassLoader.findClass(ExtClassLoader.java:214)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at java.lang.ClassLoader.loadClassHelper(ClassLoader.java:786)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at java.lang.ClassLoader.loadClass(ClassLoader.java:764)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at com.ibm.ws.bootstrap.ExtClassLoader.loadClass(ExtClassLoader.java:120)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at java.lang.ClassLoader.loadClass(ClassLoader.java:741)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at com.ibm.ws.classloader.ProtectionClassLoader.loadClass(ProtectionClassLoader.java:62)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at com.ibm.ws.classloader.ProtectionClassLoader.loadClass(ProtectionClassLoader.java:58)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at com.ibm.ws.classloader.CompoundClassLoader.loadClass(CompoundClassLoader.java:584)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at java.lang.ClassLoader.loadClass(ClassLoader.java:741)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at com.ibm.ws.classloader.CompoundClassLoader.loadClass(CompoundClassLoader.java:584)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R at java.lang.ClassLoader.loadClass(ClassLoader.java:741)
[1/6/22 10:32:25:450 CST] 0000011a SystemErr     R ... 66 more
 
Saloon Keeper
Posts: 24890
174
Android Eclipse IDE Tomcat Server Redhat Java Linux
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Well, now you need to upgrade to 2.17.1. Or was it .2? Since 2.16.1 didn't completely fix the problem.

I'm not entirely sure but I think that the log4J problem may be with WebSphere itself, based on this:

https://publib.boulder.ibm.com/wasce/V3.0.0/en/configuring-application-specific-logging-with-log4j.html

You may need to upgrade WebSphere.
 
Steve Dyke
Ranch Hand
Posts: 2131
2
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator

Tim Holloway wrote:Well, now you need to upgrade to 2.17.1. Or was it .2? Since 2.16.1 didn't completely fix the problem.



Question, I am still using Java 1.7. Will this jar still work?
 
Tim Holloway
Saloon Keeper
Posts: 24890
174
Android Eclipse IDE Tomcat Server Redhat Java Linux
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
No. Log4j 2.14 and higher require at least Java 8.

Actually, the Log4J support team doesn't support Java 7 at all anymore.
 
Sheriff
Posts: 22586
122
Eclipse IDE Spring VI Editor Chrome Java Windows
  • Likes 1
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator

Steve Dyke wrote:I have upgraded the log4j-1.2.17.jar to log4j-api-2.16.0.jar and  log4j-core-2.16.0.jar in my application to fix security issues and now I am getting these errors.
Am I missing a dependency file maybe?


Log4J 1.x is very, very different from Log4J 2.x. They even have different packages, which means you can run them together (but why would you?). However, it also means you can't replace one with the other. Some part of either your application or your container needs Log4J 1.x (and will not work with Log4J 2).

And here's the thing - that's not that bad. Log4J has been in the news very badly recently, but that was only version 2 (and only log4j-core). Log4J 1 has less severe vulnerabilities. As long as you don't use a dangerous appender like JMSAppender or SMTPAppender, it's quite safe to use.

So my advice: roll back the change and make sure you only use file and console appenders.
 
Tim Holloway
Saloon Keeper
Posts: 24890
174
Android Eclipse IDE Tomcat Server Redhat Java Linux
  • Likes 1
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator

Rob Spoor wrote:
And here's the thing - that's not that bad.... Log4J 1 has less severe vulnerabilities.



Less severe known vulnerabilities. It's almost guaranteed that Bad People hearing about problems in Log4J2 will have been looking at Log4J 1. And the most prominent Log4J 1 CVE has a higher score than all but the worst Log4J 2 CVE's. It allows the potential to download and run unapproved code. So I wouldn't rate it as "quite safe to use".

Antiquity is no protection. Daily I receive attack attempts on my servers for SQL Server, even though the SQL Slammer exploit was fixed nearly 2 decades ago. Hope lies eternal when you're a Bad Guy.

Log4J 1 has been End-of-Life since 2015. The Log4J team is not going to support it if there are problems. It also doesn't run under Java 9 or later releases.
 
Rob Spoor
Sheriff
Posts: 22586
122
Eclipse IDE Spring VI Editor Chrome Java Windows
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator

Tim Holloway wrote:

Rob Spoor wrote:
And here's the thing - that's not that bad.... Log4J 1 has less severe vulnerabilities.



Less severe known vulnerabilities. It's almost guaranteed that Bad People hearing about problems in Log4J2 will have been looking at Log4J 1.


That's true. It remains important to have monitoring tools. At work we use the OWASP dependency checker, and for my private projects I use Snyk.

And the most prominent Log4J 1 CVE has a higher score than all but the worst Log4J 2 CVE's. It allows the potential to download and run unapproved code. So I wouldn't rate it as "quite safe to use".


I said that it's quite safe to use if you don't use any of the dangerous appenders. I found two known CVEs:
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571

  • Both of these need to explicitly be enabled.

    Log4J 1 has been End-of-Life since 2015. The Log4J team is not going to support it if there are problems. It also doesn't run under Java 9 or later releases.


    I agree that it's better to replace it, but in this case that means not updating Log4J itself but everything that uses it.
     
    Tim Holloway
    Saloon Keeper
    Posts: 24890
    174
    Android Eclipse IDE Tomcat Server Redhat Java Linux
    • Mark post as helpful
    • send pies
      Number of slices to send:
      Optional 'thank-you' note:
    • Quote
    • Report post to moderator
    One of the things that Oracle's acquisition has done to Java is affect Java's ability to be "write once/run forever". Java 9 has broken things - more than I had realized, in fact. Java 11 makes them even worse. And Java 9 has already broken Log4j 1. The only reason that Steve's company hasn't come to a screeching halt is that they're still using Java 7.

    Technical debt is a snowball. We're having enough of a struggle just moving the CodeRanch app forwards. The longer you put off the fateful day, the more it costs. Steve's shop is now at the point where I'd recommend a full technical audit followed by an upgrade plan.

    Because the more unsupported products they run, the harder it's going to be to avoid being another set of headlines in the New York Times.
     
    Consider Paul's rocket mass heater.
    reply
      Bookmark Topic Watch Topic
    • New Topic