splunk-library-javalogging upgrade

splunkuser61 — Thu, 23 Dec 2021 06:48:49 GMT

Currently all our applications are using 1.6.0 version of splunk-library-javalogging. This dependency has the vulnerable log4j2 version and I am trying to upgrade the to the latest version 1.11.3. I downloaded the dependency from splunk website and tried installing using maven. The installation is successful but this version is unable to recognize the appenders we have configured on log4j2.xml. Below are the errors I am seeing when using the latest splunk-library-javalogging dependency.

2021-12-22 14:12:55,484 WrapperListener_start_runner ERROR Error processing element HttpSplunk ([AppenderSet: null]): CLASS_NOT_FOUND

2021-12-22 14:12:55,485 WrapperListener_start_runner ERROR Error processing element HttpSplunk ([AppenderSet: null]): CLASS_NOT_FOUND

2021-12-22 14:12:55,642 WrapperListener_start_runner ERROR No node named SplunkDevAppender in org.apache.logging.log4j.core.appender.AppenderSet@7ac97772

2021-12-22 14:12:55,643 WrapperListener_start_runner ERROR Null object returned for ScriptAppenderSelector in Appenders.

2021-12-22 14:12:55,649 WrapperListener_start_runner ERROR Unable to locate appender "SelectSplunkInstance" for logger config "root"

Log4J2 Configuration:

=============================

<Configuration status="warn" name="splunk-cloudhub" packages="com.splunk.logging,com.mulesoft.ch.logging.appender">

<Properties>

<Property name="target.env">${sys:env}</Property>

<Property name="target.app">${project.name}</Property>

<Property name="dev.splunk.host">{{host}}</Property>

<Property name="dev.splunk.token">{{token}}</Property>

</Properties>

<Appenders>

<ScriptAppenderSelector name="SelectSplunkInstance">

<Script language="JavaScript"><![CDATA[

"${target.env}".search("prd") > -1 ? "SplunkPrdAppender" : "SplunkDevAppender";]]>

</Script>

<AppenderSet>

<HttpSplunk name="SplunkDevAppender"

url="https://${dev.splunk.host}"

token="${dev.splunk.token}"

host=""

index="index1"

source="${target.app}-${target.env}"

sourcetype="application"

messageFormat="json"

middleware=""

send_mode="sequential"

batch_size_bytes="0"

batch_size_count="0"

batch_interval="0"

disableCertificateValidation="true">

<PatternLayout pattern="%m"/>

</HttpSplunk>

<HttpSplunk name="SplunkPrdAppender"

url="https://${prd.splunk.host}"

token="${prd.splunk.token}"

host=""

index="index2"

source="${target.app}-${target.env}"

sourcetype="application"

messageFormat="json"

middleware=""

send_mode="sequential"

batch_size_bytes="0"

batch_size_count="0"

batch_interval="0"

disableCertificateValidation="true">

<PatternLayout pattern="%m"/>

</HttpSplunk>

</AppenderSet>

</ScriptAppenderSelector>

</Appenders>

=============================

Could you please let us know if there are any additional steps that we have to follow to get this to work. Attaching our log4j2 file for your reference.

Re: splunk-library-javalogging upgrade

vmalaviya — Wed, 19 Jan 2022 15:15:14 GMT

As per our analysis, there aren't any breaking changes that cause this error.
but you can try https://github.com/splunk/splunk-library-javalogging/releases/tag/1.6.2-0-2 this patch and see if it fixes the error.

topic splunk-library-javalogging upgrade in Splunk Dev

splunk-library-javalogging upgrade

Re: splunk-library-javalogging upgrade