DBILITY

apache log4j2 log4jdbc configuration summary 본문

java/spring

apache log4j2 log4jdbc configuration summary

DBILITY 2022. 7. 4. 18:39
반응형

log4j 보안취약점 때문에 버전을 바꿔달래서 해봤다.

급하니 참고용으로 적어 두고 수정하자.

pom요약부분

<properties>
	<org.slf4j-version>1.7.36</org.slf4j-version>
	<log4j-version>2.18.0</log4j-version>
</properties>

<!-- Logging -->
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>slf4j-api</artifactId>
    <version>${org.slf4j-version}</version>
</dependency>
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>jcl-over-slf4j</artifactId>
    <version>${org.slf4j-version}</version>
    <scope>runtime</scope>
</dependency>

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-api</artifactId>
    <version>${log4j-version}</version>
</dependency>
<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>${log4j-version}</version>
</dependency>
<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-slf4j-impl</artifactId>
    <version>${log4j-version}</version>
</dependency>
<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j</artifactId>
    <version>${log4j-version}</version>
    <type>pom</type>
    <exclusions>
        <exclusion>
            <groupId>javax.mail</groupId>
            <artifactId>mail</artifactId>
        </exclusion>
        <exclusion>
            <groupId>javax.jms</groupId>
            <artifactId>jms</artifactId>
        </exclusion>
        <exclusion>
            <groupId>com.sun.jdmk</groupId>
            <artifactId>jmxtools</artifactId>
        </exclusion>
        <exclusion>
            <groupId>com.sun.jmx</groupId>
            <artifactId>jmxri</artifactId>
        </exclusion>
    </exclusions>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>org.bgee.log4jdbc-log4j2</groupId>
    <artifactId>log4jdbc-log4j2-jdbc4.1</artifactId>
    <version>1.16</version>
    <exclusions>
        <exclusion>
            <groupId>slf4j-api</groupId>
            <artifactId>org.slf4j.api</artifactId>
        </exclusion>
    </exclusions>
</dependency>
<dependency>
    <groupId>com.microsoft.sqlserver</groupId>
    <artifactId>sqljdbc4</artifactId>
    <version>4.0</version>
</dependency>
<dependency>
    <groupId>net.sourceforge.jtds</groupId>
    <artifactId>jtds</artifactId>
    <version>1.3.1</version>
</dependency>

log4j2.xml

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN">
    <!-- Define custom levels before using them for filtering below. -->

    <Appenders>
        <Console name="console" target="SYSTEM_OUT">
            <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L - %m%n"/>
        </Console>
      <!--<RollingFile name="file" fileName="${catalina.home}/logs/ipsi.log" filePattern="${catalina.home}/logs/ipsi.log.%d{yyyy-MM-dd-HH-mm-ss}">
       <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L - %m%n" />
       <Policies>
        &lt;!&ndash; interval(default 1)이므로 1초 간격으로 rolling 수행 &ndash;&gt;
        <TimeBasedTriggeringPolicy />
       </Policies>
      </RollingFile>-->
    </Appenders>
    <Loggers>

        <Logger name="com.dbility" level="INFO" additivity="false">
            <AppenderRef ref="console"/>
            <!-- <AppenderRef ref="file" /> -->
        </Logger>

        <!-- 3rdparty Loggers -->
        <Logger name="org.springframework" level="OFF" additivity="false">
            <AppenderRef ref="console"/>
            <!-- <AppenderRef ref="file" /> -->
        </Logger>
        <Logger name="org.springframework.web.servlet.DispatcherServlet" level="DEBUG" additivity="false">
            <AppenderRef ref="console"/>
            <!-- <AppenderRef ref="file" /> -->
        </Logger>

        <Logger
                name="org.springframework.context.support.ReloadableResourceBundleMessageSource"
                level="OFF" additivity="false">
            <AppenderRef ref="console"/>
        </Logger>

        <Logger name="org.hotswap" level="OFF" additivity="false">
        </Logger>

        <Logger name="jdbc.connection" level="OFF" additivity="false">
            <AppenderRef ref="console"/>
        </Logger>

        <Logger name="jdbc.sqlonly" level="INFO" additivity="false">
            <AppenderRef ref="console"/>
            <!-- <AppenderRef ref="file" /> -->
        </Logger>

        <Logger name="jdbc.sqltiming" level="OFF" additivity="false">
            <AppenderRef ref="console"/>
        </Logger>

        <Logger name="jdbc.audit" level="OFF" additivity="false">
            <AppenderRef ref="console"/>
        </Logger>

        <Logger name="jdbc.resultset" level="OFF" additivity="false">
            <AppenderRef ref="console"/>
        </Logger>

        <Logger name="jdbc.resultsettable" level="OFF" additivity="false">
            <AppenderRef ref="console"/>
        </Logger>

        <Root level="ERROR">
            <AppenderRef ref="console"/>
        </Root>

    </Loggers>

</Configuration>

sql Logging을 위해 dataSource 연결 속성을 정의하고

driverClass = net.sf.log4jdbc.sql.jdbcapi.DriverSpy;
url = jdbc:log4jdbc:sqlserver://localhost:1433;DatabaseName=TEST // sqljdbc
#url = jdbc:log4jdbc:jtds:sqlserver://localhost:1433;DatabaseName=TEST // jtds

src/main/resources경로에 log4jdbc.log4j2.properties를 작성한다.

log4jdbc.spylogdelegator.name=net.sf.log4jdbc.log.slf4j.Slf4jSpyLogDelegator
log4jdbc.dump.sql.maxlinelength=0

 

교체가 제대로 되었는지 dependancy를 확인해야 한다.

반응형
Comments