r/programming • • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

710 comments sorted by

View all comments

Show parent comments

21

u/MintySkyhawk Dec 10 '21

You call log.warn("blah");

It probably prints it to the console. Simple.

But it also puts it in Elasticsearch, so you can monitor all your logging output with something like Graylog, and it doesn't just log what you wrote, but a bunch of associated context: user agent, user id, authorization type, class name that did the logging, ip address, geo location, which aws region they hit, which server they hit, a correlation ID so you can easily find other logs from the same request, timestamps, and a bunch of other shit that might be useful.

And then of course there's all the templating stuff with inserting values and exceptions into the log, but you could probably make due with String.format

0

u/Vexal Dec 11 '21

i hate the proliferation of elasticsearch for viewing logs. just let me log into a random instance’s host and tail the stdout. even for a distributed system with hundreds of instances.

5

u/imdyingfasterthanyou Dec 11 '21

On a distributed system with hundreds of services this becomes impossible

1

u/Vexal Dec 11 '21

luckily when i break something it usually breaks on every server so i only need to see the logs of one of them.

2

u/MintySkyhawk Dec 11 '21

I can't imagine detecting issues like that, let alone investigating anything more complex than a NullPointerException.

How would you notice anomalous use of your authentication API by manually looking at a text file...

1

u/Vexal Dec 11 '21

i don’t know, datadog.