Re: [James 3.4.0] log files

Hi Tommy,

Thanks for noticing it and raising the issue, it is a concern indeed. We 
forgot to inform you but we started working on it, a PR has been 
proposed for moving to log4j2 : 
https://github.com/linagora/james-project/pull/3214

Please take a look if you have time. Don't hesitate to try or give 
comments as well.

Regards,
Rene.

On 21/03/2020 03:16, Tommy Pham wrote:
> Hi David,
> 
>> Which knob(s) on the logging configuration did you turn on?  Have you tried
>>> org.apache.james.protocols?  I just looked briefly through the codes for
>>> 3.4 and I think this one may help you even though the code doesn't log as
>>> much like springframework at debug level.
>>>
>>
>> Despite using version 3.3.0 myself, but seeing Malcom's assertion that
>> logging setup had changed in 3.4.0, I just used the file he posted with
>> very little change, just one or two flips from INFO to DEBUG.
>>
>> Prior to that my 3.3.0 setup was only writing to the james-server.log and
>> wrapper.log, but now there is additional logging in other log files. What I
>> particularly missed was having some feedback from remote mail exchangers
>> that I sent mail to and that is now satisfied in part at least. So it's now
>> less of a concern.
>>
>> Was interested to read that you said (I think) you had 3.3.0 running on
>> java 11 as that doesn't work for me. I have to run a java webmail client
>> (of james running in java 8) in java 11 (!) to make imaps work. I've think
>> I read somewhere that's a java 8 bug though.
>>
> 
> I wanted to run James on Java/JDK 11 because Java 8 is going away in about
> a year.  I didn't want to spend time setting it up only to get it working
> again later on JDK 11.  Also, IMO, I don't think EOL software should be
> used in production due security risks especially when a viable replacement
> is available.  The only reason that I could think of thus far, from both
> looking at the jars and partly in code, is the log4j (v1) dependency.  If
> you replace the log4j with log4j2 jars and the appropriate configuration
> file, you should be good to use later versions of Java.  This is what I did
> to get James running on Java 11:
> 
>   # ll james-server-app-3.*.0/lib/{*log*,*slf*}
> -rw-r--r--  1 root  wheel   66023 Feb 12  2019
> james-server-app-3.3.0/lib/jboss-logging-3.3.1.Final.jar
> -rw-r--r--  1 root  wheel   16515 Feb 12  2019
> james-server-app-3.3.0/lib/jcl-over-slf4j-1.7.25.jar
> lrwxr-xr-x  1 root  wheel      31 Mar 19 04:10
> james-server-app-3.3.0/lib/log4j-1.2-api-2.13.1.jar@ ->
> ../new/log4j-1.2-api-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      27 Mar 19 04:10
> james-server-app-3.3.0/lib/log4j-api-2.13.1.jar@ ->
> ../new/log4j-api-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      28 Mar 19 04:10
> james-server-app-3.3.0/lib/log4j-core-2.13.1.jar@ ->
> ../new/log4j-core-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      27 Mar 19 04:10
> james-server-app-3.3.0/lib/log4j-jcl-2.13.1.jar@ ->
> ../new/log4j-jcl-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      27 Mar 19 04:10
> james-server-app-3.3.0/lib/log4j-jul-2.13.1.jar@ ->
> ../new/log4j-jul-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      34 Mar 19 04:10
> james-server-app-3.3.0/lib/log4j-slf4j-impl-2.13.1.jar@ ->
> ../new/log4j-slf4j-impl-2.13.1.jar
> -rw-r--r--  1 root  wheel   10890 Feb 12  2019
> james-server-app-3.3.0/lib/metrics-logger-3.3.0.jar
> lrwxr-xr-x  1 root  wheel      27 Mar 18 12:41
> james-server-app-3.3.0/lib/slf4j-api-1.7.30.jar@ ->
> ../new/slf4j-api-1.7.30.jar
> 
> -rw-r--r--  1 root  wheel   61829 Dec  3  2016
> james-server-app-3.4.0/lib/commons-logging-1.2.jar
> -rw-r--r--  1 root  wheel   60201 Jul  5  2019
> james-server-app-3.4.0/lib/jboss-logging-3.4.0.Final.jar
> -rw-r--r--  1 root  wheel   16462 Aug 30  2019
> james-server-app-3.4.0/lib/jcl-over-slf4j-1.7.27.jar
> lrwxr-xr-x  1 root  wheel      31 Mar 19 04:17
> james-server-app-3.4.0/lib/log4j-1.2-api-2.13.1.jar@ ->
> ../new/log4j-1.2-api-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      27 Mar 19 04:17
> james-server-app-3.4.0/lib/log4j-api-2.13.1.jar@ ->
> ../new/log4j-api-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      28 Mar 19 04:17
> james-server-app-3.4.0/lib/log4j-core-2.13.1.jar@ ->
> ../new/log4j-core-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      27 Mar 19 04:17
> james-server-app-3.4.0/lib/log4j-jcl-2.13.1.jar@ ->
> ../new/log4j-jcl-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      27 Mar 19 04:17
> james-server-app-3.4.0/lib/log4j-jul-2.13.1.jar@ ->
> ../new/log4j-jul-2.13.1.jar
> lrwxr-xr-x  1 root  wheel      34 Mar 19 04:17
> james-server-app-3.4.0/lib/log4j-slf4j-impl-2.13.1.jar@ ->
> ../new/log4j-slf4j-impl-2.13.1.jar
> -rw-r--r--  1 root  wheel  471901 Jul  5  2017
> james-server-app-3.4.0/lib/logback-core-1.2.3.jar
> -rw-r--r--  1 root  wheel   10439 Sep  5  2019
> james-server-app-3.4.0/lib/metrics-logger-3.4.0.jar
> lrwxr-xr-x  1 root  wheel      27 Mar 19 04:17
> james-server-app-3.4.0/lib/slf4j-api-1.7.30.jar@ ->
> ../new/slf4j-api-1.7.30.jar
> 
> I've added few extra log4j2 bridges to see as much logging as possible in
> case any of the other dependencies uses other then log4j2 and updated the
> slf4j to most current 1.7.30 instead of 1.7.25 for security.  Here's my
> log4j2 configuration file:
> 
> https://github.com/tommyhp2/ajs/blob/master/src/main/webapp/WEB-INF/classes/log4j2.xml
> 
> Feel free to use and change as needed.  While typing this up and looking at
> the list of jars above, you could also remove the jcl-over-slf4j jar also.
> 
> Regards,
> Tommy
>