Orbeon Forms
Search…
Logging
Introduction
- Internally, the Orbeon Forms web application uses the SLF4J API, which allows using various Java logging implementations such as Log4j or logback.
Version of Log4j
Due to late 2021 security vulnerabilities with Log4j, and even though Orbeon Forms was not directly affected by those vulnerabilities, Orbeon Forms switched from Log4j 1.x to the latest Log4j 2.x version in order to respond faster to future vulnerabilities should they arise. See the following blog posts:
The following versions of Orbeon Forms use Log4j 2.x:
- 2021.1 CE and PE and newer
- 2020.1.6 PE and newer
- 2019.2.4 PE and newer
- 2019.1.2 PE and newer
- 2018.2.5 PE and newer
- 2018.1.4 PE and newer
Log4j configuration
Log4j 2.x uses different configuration files than Log4j 1.x. However, Orbeon Forms provides backward compatibility support for the older Log4j 1.x configuration file. This means that in most cases, you do not have to update your configuration file immediately if you are upgrading from an older version of Orbeon Forms.
Here is the location and names of the configuration files:
Log4j version
Location and Name
Log4j 1.x
WEB-INF/resources/config/log4j.xmlLog4j 2.x
WEB-INF/resources/config/log4j2.xmlVersions of Orbeon Forms that support Log4j 2.x no longer ship with a
log4j.xml configuration file, but ship with a log4j2.xml configuration file.- If you have pre-existing
log4j.xmlconfiguration file, for example because you are upgrading from an older version, you can still use that configuration file, which will take precedence over the newlog4j2.xmlfile. However we do recommend that you consider moving to alog4j2.xmlconfiguration file. - If you do not yet have an existing
log4j.xmlfile, we recommend that you update thelog4j2.xmlconfiguration file that ships with Orbeon Forms and that you do not create alog4j.xml.
WARNING: With version of Orbeon Forms that use Log4j 2.x, and whether you are using
log4j.xml or log4j2.xml, you must make sure that you do not have duplicate log file names in the configuration, even if some of them are unused, or Log4j 2.x will complain about that and ignore the configuration. Log4j 1.x did not use to consider this an error, but Log4j 2.x does.WARNING: If you are creating or updating a
log4j2.xml file, you cannot simply copy the contents of an existing log4j.xml to log4j2.xml as the two formats are incompatible! Instead, start with the log4j2.xml provided, and visit the Log4j 2 configuration online to understand and make changes.How Orbeon Forms initializes logging
First, when the Orbeon Forms web application starts, it attempts to initialize a minimal, predefined Log4j configuration:
- Appender:
<Console> - Level:
info - Pattern:
"%date{ISO8601} %-5level %logger{1} - %message%n"
Second, once Orbeon Forms is able to read
log4j.xml or log4j2.xml, it reconfigures Log4j with the specified configuration.You can disable Orbeon Forms's Log4j initialization in
WEB-INF/web.xml with:1
<context-param>
2
<param-name>oxf.initialize-logging</param-name>
3
<param-value>false</param-value>
4
</context-param>
Copied!
Doing so is necessary if you want to configure Log4j with your own configuration files, or if you want to remove Log4j and use a different SLF4J backend.
Selecting a specific file path
By default, logging information is output to a file path relative to the directory where you start your application server. This is usually not what you want, as that makes it hard to know where the log file is.
Log4j 2.x (
WEB-INF/resources/config/log4j2.xml):1
<File
2
name="SingleFileAppender"
3
fileName="../logs/orbeon.log"
4
append="false">
5
<PatternLayout pattern="%date{ISO8601} %-5level %logger{1} - %message%n"/>
6
</File>
Copied!
Log4j 1.x (
WEB-INF/resources/config/log4j.xml):1
<appender name="SingleFileAppender" class="org.apache.log4j.FileAppender">
2
<param name="File" value="../logs/orbeon.log"/>
3
<param name="Append" value="false" />
4
<param name="Encoding" value="UTF-8"/>
5
<layout class="org.apache.log4j.PatternLayout">
6
<param name="ConversionPattern" value="%d{ISO8601} %-5p %c{1} %x - %m%n"/>
7
</layout>
8
</appender>
Copied!
You can change this by modifying the
fileName (Log4j 2.x) or File (Log4j 1.x) parameter and set an absolute file path to the log file.Log4j 2.x (
WEB-INF/resources/config/log4j2.xml):1
<File
2
name="SingleFileAppender"
3
fileName="/path/to/logs/orbeon.log"
4
append="false">
5
<PatternLayout pattern="%date{ISO8601} %-5level %logger{1} - %message%n"/>
6
</File>
Copied!
Log4j 1.x (
WEB-INF/resources/config/log4j.xml):1
<appender name="SingleFileAppender" class="org.apache.log4j.FileAppender">
2
<param name="File" value="/path/to/logs/orbeon.log"/>
3
<param name="Append" value="false" />
4
<param name="Encoding" value="UTF-8"/>
5
<layout class="org.apache.log4j.PatternLayout">
6
<param name="ConversionPattern" value="%d{ISO8601} %-5p %c{1} %x - %m%n"/>
7
</layout>
8
</appender>
Copied!
Note that on Windows, you must use forward slashes.
Log4j 2.x (
WEB-INF/resources/config/log4j2.xml):1
<File
2
name="SingleFileAppender"
3
fileName="C:/My Path/To/Logs/orbeon.log"
4
append="false">
5
<PatternLayout pattern="%date{ISO8601} %-5level %logger{1} - %message%n"/>
6
</File>
Copied!
Log4j 1.x (
WEB-INF/resources/config/log4j.xml):1
<appender name="SingleFileAppender" class="org.apache.log4j.FileAppender">
2
<param name="File" value="C:/My Path/To/Logs/orbeon.log"/>
3
<param name="Append" value="false" />
4
<param name="Encoding" value="UTF-8"/>
5
<layout class="org.apache.log4j.PatternLayout">
6
<param name="ConversionPattern" value="%d{ISO8601} %-5p %c{1} %x - %m%n"/>
7
</layout>
8
</appender>
Copied!
The benefit of changing this configuration is that you know exactly where the file is stored. This can be really handy when trying to troubleshoot issues.
Reducing the amount of logging
By default, Orbeon Forms logs quite a lot of information at the
info level. In case this is too much, you can set the level to warning or even error. Similarly, for debugging, you can set the level to the more verbose debug.Log4j 2.x (
WEB-INF/resources/config/log4j2.xml):1
<File
2
name="SingleFileAppender"
3
fileName="/path/to/logs/orbeon.log"
4
append="false">
5
<PatternLayout pattern="%date{ISO8601} %-5level %logger{1} - %message%n"/>
6
<ThresholdFilter level="error"/>
7
</File>
Copied!
Log4j 1.x (
WEB-INF/resources/config/log4j.xml):1
<appender name="SingleFileAppender" class="org.apache.log4j.FileAppender">
2
<param name="File" value="/path/to/logs/orbeon.log"/>
3
<param name="Append" value="false" />
4
<param name="Encoding" value="UTF-8"/>
5
<layout class="org.apache.log4j.PatternLayout">
6
<param name="ConversionPattern" value="%d{ISO8601} %-5p %c{1} %x - %m%n"/>
7
</layout>
8
<filter class="org.apache.log4j.varia.LevelRangeFilter">
9
<param name="LevelMin" value="error"/>
10
</filter>
11
</appender>
Copied!
Logging HTTP headers
[SINCE Orbeon Forms 2022.1]
You can set the following property to ask Orbeon Forms to add all HTTP headers to the Log4j Thread Context.
1
<property
2
as="xs:boolean"
3
name="oxf.log4j.thread-context.http-headers"
4
value="true"/>
Copied!
When this property is set, you can then log specific headers using the
%X{} syntax in Log4j pattern, prefixing the header name in lower case by orbeon-incoming-http-header-. For instance, adding the following to your pattern will log the value of the Host header.1
%X{orbeon-incoming-http-header-host}
Copied!
Client-side logging
As more work is getting done on the client (web browser), Orbeon Forms has added logging abilities there as well. In general, Orbeon Forms doesn't log much except in case of error, and then it logs to the JavaScript console, which is usually not consulted by the end-user.
See also
- Blog posts:
Last modified 2mo ago