For Apache Log4j remediation priority it seems the best approach right now is:
1. log4j 2.x through 2.14 - update to 2.16
2. log4j 1.x - update to 2.16
3. log4j 2.15 - update to 2.16
33
219
876
Conversation
Or simply use java.util.logging which is even simpler and lower attack surface. It's more than enough to meet the needs of nearly anyone.
twitter.com/DanielMicay/st
Should reconsider doing complex processing, triggers, etc. via a library instead of a separate isolated process.
Quote Tweet
java.util.logging is easy to use and has everything you would ever need. If you want fancy processing/triggers, you should use rsyslog.
logger.warning("message");
logger.fine(() -> "lazy evaluation: " + parameter);
That high-level API dynamically adds class/method name itself.
Show this thread
Yep, I think Java.until.logging will be my end of year project
2