Bug 60164

Summary: Add log4j-web*.jar to tomcat.util.scan.StandardJarScanFilter.jarsToScan
Product: Tomcat 8 Reporter: balusc <balusc>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Severity: normal    
Priority: P2    
Version: 8.5.5   
Target Milestone: ----   
Hardware: PC   
OS: Linux   

Description balusc 2016-09-22 09:59:31 UTC
log4j-web.jar actually contains relevant servlet container configuration information (web-fragment.xml and services/ServletContainerInitializer), yet it is covered by jarsToSkip as log4j*.jar. Please add log4j-web*.jar to jarsToScan override. 

Comment 1 Violeta Georgieva 2016-09-23 12:19:42 UTC

I see that by default we specify to scan log4j-core*.jar.
I checked this jar (the latest version) and I think we can remove it and instead of it add log4j-web*.jar, but I don't know what the status is with these jar files in the older versions of Log4J 2.


Comment 2 Mark Thomas 2016-09-27 19:07:31 UTC
I've checked the 2.0 release and it is consistent with the latest version so the proposed change makes sense.
Comment 3 Mark Thomas 2016-09-27 19:13:41 UTC
This has been fixed in the following branches:
- 9.0.x for 9.0.0.M11 onwards
- 8.5.x for 8.5.6 onwards
- 8.0.x for 8.0.38 onwards