Migrate Apache log4j with Logback

[evrentan]

Migrate Apache log4j with Logback becasue of log4j vulnerability issue.

[Erkanerkisi]

Does spring use logback as default logging implementation, doesnt it? commons-vfs2 dependency module has log4j (v.1.2.17) but security vulnerabilities has been involved with version 2 if i am not mistaken.

[evrentan]

Does spring use logback as default logging implementation, doesnt it? commons-vfs2 dependency module has log4j (v.1.2.17) but security vulnerabilities has been involved with version 2 if i am not mistaken.

Yes, spring uses logback as default when you configure the required logback configuration files. It is an successor of log4j but with some improvements for performance and native slf4j support. You can check https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot for the detail info.

[Erkanerkisi]

as I understand it, it is enough to create logback.xml file for this issue, right?

[evrentan]

as I understand it, it is enough to create logback.xml file for this issue, right?

yes, and i am planning to put this into spring cloud config server.