Due to the recent exposure of log4j vulnerabilities our client has serious concerns about it. They asked us to remove or replace all the log4j ver.1 with ver.2 but unfortunately this is not possible for us to make such a big change.We did a workaround and replaced the log4j ver.1 with reload4j and majority of components are working fine this with change.
Unfortunately we have some binaries in our product like (elastic-search/logstash/zookeeper) which are using either the older version of log4j ver.2 (log4j-core-2.11.x < 2.17.1) or still using the log4j ver.1 (log4j-1.2.16).
For these we made the direct change in /lib/ directory and replaced the old jars with latests, this works fine for elastic-search/logstash. But when we did the same with zookeeper by replacing log4j with reload4j we're now facing the following exception when starting the component.
Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/log4j/jmx/HierarchyDynamicMBean
at org.apache.zookeeper.jmx.ManagedUtil.registerLog4jMBeans(ManagedUtil.java:50)
at org.apache.zookeeper.server.ZooKeeperServerMain.initializeAndRun(ZooKeeperServerMain.java:74)
at org.apache.zookeeper.server.ZooKeeperServerMain.main(ZooKeeperServerMain.java:52)
at org.apache.zookeeper.server.quorum.QuorumPeerMain.initializeAndRun(QuorumPeerMain.java:116)
at org.apache.zookeeper.server.quorum.QuorumPeerMain.main(QuorumPeerMain.java:78)
Caused by: java.lang.ClassNotFoundException: org.apache.log4j.jmx.HierarchyDynamicMBean
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 5 mor
Latest stable release is still using log4j-1.2.17.
Can someone please guide the workaround. Thanks in advance
Setting the system property zookeeper.jmx.log4j.disable=true will fix the issue. See also the documentation.