Failed to instantiate SLF4J LoggerFactory while upgrading log4j version

Question

I am trying to upgrade the log4j version in kafka and zookeeper docker image from 1.x.x to 2.x.x

Docker commands

RUN rm /zookeeper-3.5.9/lib/log4j-1.2.17.jar

RUN wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.17.0/log4j-core-2.17.0.jar -P /zookeeper-3.5.9/lib/
RUN wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api/2.17.0/log4j-api-2.17.0.jar -P /zookeeper-3.5.9/lib/

RUN rm /opt/kafka_2.12-2.2.1/libs/log4j-1.2.17.jar


RUN wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.17.0/log4j-core-2.17.0.jar -P /opt/kafka_2.12-2.2.1/libs/
RUN wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api/2.17.0/log4j-api-2.17.0.jar -P /opt/kafka_2.12-2.2.1/libs/

This is the error I am getting while initialising the pod

Failed to instantiate SLF4J LoggerFactory Reported exception: java.lang.NoClassDefFoundError: org/apache/log4j/Level

Can someone please guide me on how can I upgrade the log4j version without upgrading the base kafka and zookeeper version?

Answer 1

I assume you are trying to manually patch log4j security issues on your own?

Don't.

Kafka and Zookeeper projects have already done this by moving to reload4j, which is still log4j 1.x compatible. (logback is used in Zookeeper 3.8, actually)

Upgrade to the latest version of each Zookeeper and Kafka (using existing Docker images, even), rather than cherry-pick JAR files that will not work with these projects without further source code changes.

Answer 2

As far as I can tell, neither Kafka nor Zookeeper use Log4j 1.x nor Reload4j directly, but they access it through SLF4J (1.7.x).

You can easily switch SLF4J backends by:

• in Kafka remove the SLF4J-to-Log4j 1.x bridge (slf4j-log4j12) and Log4j 1.x (log4j),
• in Zookeeper remove the SLF4J-to-Reload4J bridge (slf4j-reload4j) and Reload4j (reload4j),
• replace the above mentioned libraries with:
  1. SLF4J 1.7.x to Log4j 2.x API bridge: log4j-slf4j-impl
  2. Log4j 2.x API: log4j-api,
  3. Log4j 2.x Core: log4j-core.

You'll also need to put a configuration file on the classpath, since the configuration syntax changed between 1.x and 2.x.