log4j

Log4j is a Java-based logging framework originally created by Ceki Gülcü and later maintained by the Apache Software Foundation as part of the Apache Logging project. It provides a configurable API for emitting log messages from Java applications and supports multiple levels, formats, and destinations. Log4j 2, the current generation, was designed to improve performance and reliability over the original log4j 1.x line and introduces features such as asynchronous loggers, plugins, and a flexible configuration system.

Architecture: It consists of two main modules: log4j-api and log4j-core. The API defines the public logging interfaces; the core implements the actual logging and appender management. The framework can be used directly or via the SLF4J or Apache Commons Logging bridges.

Features: hierarchical loggers, level-based filtering, a variety of appenders (Console, File, RollingFile, Socket, JDBC, etc.), layouts for formatting, filters, markers, and support for configuration in XML, JSON, YAML, or properties. Log4j 2 also offers asynchronous logging and a modular plugin system to extend functionality.

Security and maintenance: The project operates under the Apache License 2.0. Log4j 2.x remains the actively maintained line, while log4j 1.x is obsolete and not recommended for current use. In 2021 a critical remote code execution vulnerability known as Log4Shell (CVE-2021-44228) was disclosed affecting many 2.x deployments. Mitigations included upgrading to patched 2.x releases and removing the JndiLookup class or disabling JNDI lookups.

Impact and adoption: Log4j is widely used in Java software ecosystems and can be integrated with the SLF4J façade or used directly. It sits within a broader logging ecosystem that includes alternatives such as Logback and java.util.logging.