This content has been marked as final.
Show 3 replies
-
1. Re: Deployed application steals logging from JBoss. How to p
peterj Dec 3, 2009 11:57 AM (in response to zbiggy)You are going to have to first figure out how that app does logging, only then can you come up with a plan to prevent the log hijacking.
What app is it? Where did you get it from? If you bought it, have you asked the people you bought it from about this issue? -
2. Re: Deployed application steals logging from JBoss. How to p
zbiggy Dec 4, 2009 5:29 AM (in response to zbiggy)I do not know the app - this is only binary code. What I see it deploys its own log4j and use such properties for logging:
log4j.rootCategory=ERROR, CONSOLE,MYLOG log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender log4j.appender.CONSOLE.Threshold=ERROR log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout log4j.appender.CONSOLE.layout.ConversionPattern=%d{dd/MM/yy HH:mm:ss} %5p [%t] (%F:%L) - %m%n log4j.appender.MYLOG=org.apache.log4j.DailyRollingFileAppender log4j.appender.MYLOG.DatePattern='_'yyyyMMdd'.log' log4j.appender.MYLOG.File=server/default/log/mylog.log log4j.appender.MYLOG.Append=true log4j.appender.MYLOG.layout=org.apache.log4j.PatternLayout log4j.appender.MYLOG.layout.ConversionPattern=%d{dd/MM/yy HH:mm:ss} %5p [%t] (%F:%L) - %m%n
JBoss logs must not be affected by any deployed application. If there is no any configuration changes which can protect against such hostile behaviour this is security bug in JBoss. Before I start looking how to file a bug report to JBoss I would like to make sure there is no known protection to JBoss. -
3. Re: Deployed application steals logging from JBoss. How to p
peterj Dec 4, 2009 10:57 AM (in response to zbiggy)I do not know of anything in JBoss AS to prevent this - any code can directly manage log4j.
I still think you need to confront the originator of app about this.