Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Tom, 1. > I think you mean tools-log4j.properties there, right? Thanks for reading carefully. Yes, you are right. It was an error. 2. > Can the log4j-appender log a warning about its own deprecation? That's a good suggestion. I hadn't thought of this part - adding a WARNing message to the

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Dongjin, Many thanks for the KIP. I have just a couple of minor points. 1. In the Proposed Changes section there is the sentence "For backward compatibility, these tools will use the log4j configuration file (tools-log4j2.properties) by default.", I think you mean tools-log4j.properties

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi all, I just filed the issue based on the discussion here: KAFKA-13604: Add pluggable logging framework support ( https://issues.apache.org/jira/browse/KAFKA-13604) Thanks for posing a great issue, Viktor and Haruki! Best, Dongjin On Thu, Jan 20, 2022 at 2:54 AM Viktor Somogyi-Vass wrote:

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi folks, >a) I think this makes sense. But I think this shouldn't block this KIP, it can be done after moving to log4j2. Absolutely. >However, this limitation may change in the future - slf4j will support dynamic logging levels in 2.0: This would be awesome, let's keep an eye on this. >Kafka

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

On Wed, Jan 12, 2022, at 02:37, Viktor Somogyi-Vass wrote: > Hi Dongjin, > > We're also looking into this matter as our stack was also affected by all > the log4j hell and users increasingly pushing us to upgrade to log4j2 or > logback because of the existing vulnerabilities in log4j1. > Regarding

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Mickael and Viktor, Recently, I also had research on pluggable logging dependencies. As far as I experienced in KIP-653, the issues related to the logging dependency are organized into like the following: 1. Append the desired logging messages. 2. Testing the logging messages. (especially

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Viktor, a) I think this makes sense. But I think this shouldn't block this KIP, it can be done after moving to log4j2. b) Yes, tests dependencies are for tests only and shouldn't prevent us from making other changes. c) This is what the KIP is now proposing Thanks, Mickael On Wed, Jan 12,

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Dongjin, We're also looking into this matter as our stack was also affected by all the log4j hell and users increasingly pushing us to upgrade to log4j2 or logback because of the existing vulnerabilities in log4j1. Regarding the points raised by Haruki: a) In my opinion the best would be to

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Thanks for the clarification. About 2, I wan't aware of those concerns. Let me check them first. Thanks, 2021年12月23日(木) 13:37 Dongjin Lee : > Hi Haruki, > > > Thanks for organizing the issue. > > > If the community prefers logback, I will gladly change the dependency and > update the PR.

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Haruki, Thanks for organizing the issue. If the community prefers logback, I will gladly change the dependency and update the PR. However, it has the following issues: 1. The log4j2 vulnerabilities seem mostly fixed, and KIP-653 + KIP-719 are not released yet. So, using log4j2 (whose

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi, Dongjin, Sorry for interrupting the discussion. And thank you for your hard work about KIP-653, KIP-719. I understand that KIP-653 is already accepted so log4j2 is the choice of the Kafka community though, I'm now feeling that logback is a better choice here. Reasons: - even after

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Mickael, > In the meantime, you may want to bump the VOTE thread too. Sure, I just reset the voting thread with a brief context. Thanks, Dongjin On Tue, Dec 21, 2021 at 2:13 AM Mickael Maison wrote: > Thanks Dongjin! > > I'll take a look soon. > In the meantime, you may want to bump the

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Thanks Dongjin! I'll take a look soon. In the meantime, you may want to bump the VOTE thread too. Best, Mickael On Sat, Dec 18, 2021 at 10:00 AM Dongjin Lee wrote: > > Hi Mickael, > > Finally, I did it! As you can see at the PR > , KIP-719 now uses

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Mickael, Finally, I did it! As you can see at the PR , KIP-719 now uses log4j2's Kafka appender, and log4j-appender is not used by the other modules anymore. You can see how it will work with KIP-653 at this preview

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Mickael, > Can we do step 3 without breaking any compatibility? If so then that sounds like a good idea. As far as I know, the answer is yes; I am now updating my PR, so I will notify you as soon as I complete the work. Best, Dongjin On Wed, Dec 15, 2021 at 2:00 AM Mickael Maison wrote: >

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Dongjin, Sorry for the late reply. Can we do step 3 without breaking any compatibility? If so then that sounds like a good idea. Thanks, Mickael On Tue, Nov 23, 2021 at 2:08 PM Dongjin Lee wrote: > > Hi Mickael, > > I also thought over the issue thoroughly and would like to propose a

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Mickael, I also thought over the issue thoroughly and would like to propose a minor change to your proposal: 1. Deprecate log4j-appender now 2. Document how to migrate into logging-log4j2 3. (Changed) Replace the log4j-appender (in turn log4j 1.x) dependencies in tools, trogdor, and shell and

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Dongjin, Thanks for the clarifications. I wonder if a simpler course of action could be: - Deprecate log4j-appender now - Document how to use logging-log4j2 - Remove log4j-appender and all the log4j dependencies in Kafka 4.0 This delays KIP-653 till Kafka 4.0 but (so far) Kafka is not

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Mickael, I greatly appreciate you for reading the proposal so carefully! I wrote it quite a while ago and rechecked it today. > Is the KIP proposing to replace the existing log4-appender or simply add a new one for log4j2? Reading the KIP and with its current title, it's not entirely

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Hi Dongjin, Thanks for working on the update to log4j2, it's definitively something we should complete. I have a couple of comments: 1) Is the KIP proposing to replace the existing log4-appender or simply add a new one for log4j2? Reading the KIP and with its current title, it's not entirely

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Continuing to use log4j would leave several known security vulnerabilities in Apache Kafka, including https://nvd.nist.gov/vuln/detail/CVE-2019-17571. The Apache log4j team will not fix this vulnerability and is urging an upgrade to log4j2. See https://logging.apache.org/log4j/1.2/ for

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

CC'd the +1ers of KIP-653 with detailed context: When I submitted and got the approval of KIP-653: Upgrade log4j to log4j2 , I thought the log4j2-appender should not be the scope of the work. But it was wrong.

Re: [DISCUSS] KIP-719: Add Log4J2 Appender

Bumping up the discussion thread. Recently, I updated the document of KIP-653: Upgrade log4j to log4j2 (accepted) and KIP-719: Add Log4J2 Appender

[DISCUSS] KIP-719: Add Log4J2 Appender

Hi Kafka dev, I would like to start the discussion of KIP-719: Add Log4J2 Appender. https://cwiki.apache.org/confluence/display/KAFKA/KIP-719%3A+Add+Log4J2+Appender All kinds of feedbacks are greatly appreciated! Best, Dongjin -- *Dongjin Lee* *A hitchhiker in the mathematical world.*