Skip to content

[RORDEV-1872] Reproduce issue using log4j2 config provided by customer #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mgoworko wants to merge 2 commits into from
Closed

[RORDEV-1872] Reproduce issue using log4j2 config provided by customer #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7cff1e3
Use log4j2 config provided by customer
mgoworko Nov 27, 2025
3ec8539
disable ROR ACL logging in the main log file
coutoPL Dec 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
186 changes: 120 additions & 66 deletions ror-demo-cluster/conf/es/log4j2.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,71 +15,125 @@
# along with ReadonlyREST. If not, see http://www.gnu.org/licenses/
#
#
status=error
# log actionPost execution errors for easier debugging
logger.action.name=org.elasticsearch.action
logger.action.level=info
appender.console.type=Console
appender.console.name=console
appender.console.layout.type=PatternLayout
appender.console.layout.pattern=[%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
appender.rolling.type=RollingFile
appender.rolling.name=rolling
appender.rolling.fileName=${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}.log
appender.rolling.layout.type=PatternLayout
appender.rolling.layout.pattern=[%d{ISO8601}][%-5p][%-25c{1.}] %marker%.10000m%n
appender.rolling.filePattern=${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}.log
appender.rolling.policies.type=Policies
appender.rolling.policies.time.type=TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval=1
appender.rolling.policies.time.modulate=true
rootLogger.level=info
rootLogger.appenderRef.console.ref=console
rootLogger.appenderRef.rolling.ref=rolling
appender.deprecation_rolling.type=RollingFile
appender.deprecation_rolling.name=deprecation_rolling
appender.deprecation_rolling.fileName=${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.log
appender.deprecation_rolling.layout.type=PatternLayout
appender.deprecation_rolling.layout.pattern=[%d{ISO8601}][%-5p][%-25c{1.}] %marker%.10000m%n
appender.deprecation_rolling.filePattern=${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation-%i.log.gz
appender.deprecation_rolling.policies.type=Policies
appender.deprecation_rolling.policies.size.type=SizeBasedTriggeringPolicy
appender.deprecation_rolling.policies.size.size=1GB
appender.deprecation_rolling.strategy.type=DefaultRolloverStrategy
appender.deprecation_rolling.strategy.max=4
status = error

# log action execution errors for easier debugging
logger.action.name = org.elasticsearch.action
logger.action.level = debug

appender.console.type = Console
appender.console.name = console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker%m%n

appender.readonlyrest_audit_rolling.type = RollingFile
appender.readonlyrest_audit_rolling.name = readonlyrest_audit_rolling
appender.readonlyrest_audit_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}readonlyrest_audit.log
appender.readonlyrest_audit_rolling.layout.type = PatternLayout
appender.readonlyrest_audit_rolling.layout.pattern = [%d{ISO8601}] %m%n
appender.readonlyrest_audit_rolling.filePattern = readonlyrest_audit-%i.log.gz
appender.readonlyrest_audit_rolling.policies.type = Policies
appender.readonlyrest_audit_rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.readonlyrest_audit_rolling.policies.size.size = 1GB
appender.readonlyrest_audit_rolling.strategy.type = DefaultRolloverStrategy
appender.readonlyrest_audit_rolling.strategy.max = 4

# Logger name, required, must be the same as the one defined in `readonlyrest.yml` audit configuration.
# If a custom logger name is not defined there, then the default logger name is "readonlyrest_audit"
logger.readonlyrest_audit.name = readonlyrest_audit
logger.readonlyrest_audit.appenderRef.readonlyrest_audit_rolling.ref = readonlyrest_audit_rolling
# set to false to use only desired appenders
logger.readonlyrest_audit.additivity = false

appender.rolling.type = RollingFile
appender.rolling.name = rolling
appender.rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}.log
appender.rolling.layout.type = PatternLayout
appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker%.-10000m%n
appender.rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}-%i.log.gz
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.rolling.policies.size.size = 1024MB

#appender.rolling.strategy.max = 50
#appender.rolling.strategy.type = DefaultRolloverStrategy
#appender.rolling.strategy.action.type = Delete
#appender.rolling.strategy.action.basepath = ${sys:es.logs.base_path}
#appender.rolling.strategy.action.condition.type = IfLastModified
#appender.rolling.strategy.action.condition.age = 7D
#appender.rolling.strategy.action.PathConditions.type = IfFileName
#appender.rolling.strategy.action.PathConditions.glob = ${sys:es.logs.cluster_name}-*

rootLogger.level = info
rootLogger.appenderRef.console.ref = console
rootLogger.appenderRef.rolling.ref = rolling

appender.deprecation_rolling.type = RollingFile
appender.deprecation_rolling.name = deprecation_rolling
appender.deprecation_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.log
appender.deprecation_rolling.layout.type = PatternLayout
appender.deprecation_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker%.-10000m%n
appender.deprecation_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation-%i.log.gz
appender.deprecation_rolling.policies.type = Policies
appender.deprecation_rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.deprecation_rolling.policies.size.size = 1GB
appender.deprecation_rolling.strategy.type = DefaultRolloverStrategy
appender.deprecation_rolling.strategy.max = 4
logger.deprecation.name = org.elasticsearch.deprecation
logger.deprecation.level = deprecation
logger.deprecation.appenderRef.header_warning.ref = header_warning
logger.deprecation.appenderRef.deprecation_rolling.ref=deprecation_rolling
logger.deprecation.additivity=false
appender.index_search_slowlog_rolling.type=RollingFile
appender.index_search_slowlog_rolling.name=index_search_slowlog_rolling
appender.index_search_slowlog_rolling.fileName=${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog.log
appender.index_search_slowlog_rolling.layout.type=PatternLayout
appender.index_search_slowlog_rolling.layout.pattern=[%d{ISO8601}][%-5p][%-25c] %marker%.10000m%n
appender.index_search_slowlog_rolling.filePattern=${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog-%d{yyyy-MM-dd}.log
appender.index_search_slowlog_rolling.policies.type=Policies
appender.index_search_slowlog_rolling.policies.time.type=TimeBasedTriggeringPolicy
appender.index_search_slowlog_rolling.policies.time.interval=1
appender.index_search_slowlog_rolling.policies.time.modulate=true
logger.index_search_slowlog_rolling.name=index.search.slowlog
logger.index_search_slowlog_rolling.level=trace
logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref=index_search_slowlog_rolling
logger.index_search_slowlog_rolling.additivity=false
appender.index_indexing_slowlog_rolling.type=RollingFile
appender.index_indexing_slowlog_rolling.name=index_indexing_slowlog_rolling
appender.index_indexing_slowlog_rolling.fileName=${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_indexing_slowlog.log
appender.index_indexing_slowlog_rolling.layout.type=PatternLayout
appender.index_indexing_slowlog_rolling.layout.pattern=[%d{ISO8601}][%-5p][%-25c] %marker%.10000m%n
appender.index_indexing_slowlog_rolling.filePattern=${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_indexing_slowlog-%d{yyyy-MM-dd}.log
appender.index_indexing_slowlog_rolling.policies.type=Policies
appender.index_indexing_slowlog_rolling.policies.time.type=TimeBasedTriggeringPolicy
appender.index_indexing_slowlog_rolling.policies.time.interval=1
appender.index_indexing_slowlog_rolling.policies.time.modulate=true
logger.index_indexing_slowlog.name=index.indexing.slowlog.index
logger.index_indexing_slowlog.level=trace
logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref=index_indexing_slowlog_rolling
logger.index_indexing_slowlog.additivity=false
logger.deprecation.level = warn
logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling
logger.deprecation.additivity = false

appender.index_search_slowlog_rolling.type = RollingFile
appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling
appender.index_search_slowlog_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog.log
appender.index_search_slowlog_rolling.layout.type = PatternLayout
appender.index_search_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] [%node_name]%marker%.-10000m%n
appender.index_search_slowlog_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog-%d{yyyy-MM-dd}.log.gz
appender.index_search_slowlog_rolling.policies.type = Policies
appender.index_search_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.index_search_slowlog_rolling.policies.time.interval = 1
appender.index_search_slowlog_rolling.policies.time.modulate = true

logger.index_search_slowlog_rolling.name = index.search.slowlog
logger.index_search_slowlog_rolling.level = trace
logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling
logger.index_search_slowlog_rolling.additivity = false

appender.index_indexing_slowlog_rolling.type = RollingFile
appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling
appender.index_indexing_slowlog_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_indexing_slowlog.log
appender.index_indexing_slowlog_rolling.layout.type = PatternLayout
appender.index_indexing_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] [%node_name]%marker%.-10000m%n
appender.index_indexing_slowlog_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_indexing_slowlog-%d{yyyy-MM-dd}.log.gz
appender.index_indexing_slowlog_rolling.policies.type = Policies
appender.index_indexing_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.index_indexing_slowlog_rolling.policies.time.interval = 1
appender.index_indexing_slowlog_rolling.policies.time.modulate = true

logger.index_indexing_slowlog.name = index.indexing.slowlog.index
logger.index_indexing_slowlog.level = trace
logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling
logger.index_indexing_slowlog.additivity = false

#appender.rolling.strategy.max = 50
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.action.type = Delete
appender.rolling.strategy.action.basepath = ${sys:es.logs.base_path}
appender.rolling.strategy.action.PathConditions.type = IfFileName
appender.rolling.strategy.action.PathConditions.glob = ${sys:es.logs.cluster_name}*

appender.rolling.strategy.action.condition.type = IfFileName
appender.rolling.strategy.action.condition.glob = ${sys:es.logs.cluster_name}*
#delete old logs after 7 days or when exceeding 39.5 GB
appender.rolling.strategy.action.condition.nested_condition.type = IfAny
appender.rolling.strategy.action.condition.nested_condition.fileSize.type = IfAccumulatedFileSize
appender.rolling.strategy.action.condition.nested_condition.fileSize.exceeds = 39.5GB
appender.rolling.strategy.action.condition.nested_condition.lastMod.type = IfLastModified
appender.rolling.strategy.action.condition.nested_condition.lastMod.age = 7D
Comment on lines +122 to +136
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

log4j2 Delete action RollingFileAppender PathConditions condition syntax

💡 Result:

Summary of Delete action PathCondition syntax for RollingFileAppender (log4j2)

  • Delete element: placed inside a RolloverStrategy (DefaultRolloverStrategy, DirectWriteRolloverStrategy, etc.). Key attrs: basePath, maxDepth, followLinks, testMode. [1][5]

  • Basic PathConditions:

    • IfFileName: filters by file name; supports attributes glob="pattern" or regex="pattern". Example: . [1][5]
    • IfLastModified: filters by modification age; use ISO-8601 period or shorthand (examples in docs show "60d" or "P60D"/"P15D" notation). Example: or . [1][3][5]
    • IfAccumulatedFileSize / IfAny / IfAll / IfNot: composite and size-based conditions are available; nested conditions are evaluated only if the outer condition accepts the file. [1][5]

  • Combining conditions:

    • Multiple non-nested conditions: all must accept the file (logical AND).
    • Use composite wrappers: (AND), (OR), (NOT) to combine conditions explicitly. Nested PathConditions inside these elements are evaluated per the composite logic. [1][5]

  • ScriptCondition: you can supply a ScriptCondition (Groovy, JavaScript, etc.) that returns the list/boolean to select files; when present, PathCondition elements are ignored. Useful for more complex rules (including deleting empty directories). [1][2][3]

  • Test mode and safety:

    • testMode="true" on Delete prints actions to status logger instead of deleting — use to validate rules. Also be careful: Delete can remove any file under basePath. [1]

  • Example (XML):

    (This deletes archived files matching the glob older than 60 days.) [1][5]

References
[1] Apache Log4j 2 Appenders — Delete action docs (examples & param list).
[2] Apache Log4j 2 Rolling-file manual (Delete, ScriptCondition examples).
[3] HowToDoInJava Log4j2 RollingFileAppender — Delete examples.

🌐 Web query:

log4j2 properties format Delete action configuration DefaultRolloverStrategy nested_condition

💡 Result:

Yes — you can configure the Delete action (inside DefaultRolloverStrategy) with nested PathConditions in log4j2.properties. Use the action.type = Delete, then express the outer condition(s) and any nested conditions with the nested_condition namespace (indexed where needed). Example:

  • Simple: delete files matching a glob and older than 30 days
    appender.rolling.strategy.type = DefaultRolloverStrategy
    appender.rolling.strategy.action.type = Delete
    appender.rolling.strategy.action.basePath = ${baseDir}
    appender.rolling.strategy.action.maxDepth = 2
    appender.rolling.strategy.action.condition.type = IfFileName
    appender.rolling.strategy.action.condition.glob = /app-.log.gz
    appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
    appender.rolling.strategy.action.condition.nested_condition.age = 30D

  • Example using an inner IfAny (logical OR) with two inner conditions (IfAccumulatedFileSize OR IfLastModified):
    appender.rolling.strategy.type = DefaultRolloverStrategy
    appender.rolling.strategy.action.type = Delete
    appender.rolling.strategy.action.basePath = ${baseDir}
    appender.rolling.strategy.action.maxDepth = 2
    appender.rolling.strategy.action.condition.type = IfFileName
    appender.rolling.strategy.action.condition.glob = /app-.log.gz
    appender.rolling.strategy.action.condition.nested_condition.type = IfAny
    appender.rolling.strategy.action.condition.nested_condition.0.type = IfAccumulatedFileSize
    appender.rolling.strategy.action.condition.nested_condition.0.exceeds = 100GB
    appender.rolling.strategy.action.condition.nested_condition.1.type = IfLastModified
    appender.rolling.strategy.action.condition.nested_condition.1.age = 30D

Notes:

  • Outer condition (e.g., IfFileName) is evaluated first; nestedConditions are evaluated only for files accepted by the outer condition. Nested conditions can themselves be compound (IfAny / IfAll) or specific path/accumulated conditions. See Log4j2 docs for condition parameter names and semantics. [1][2][3]

Sources:
[1] Apache Log4j2 RollingFile/Delete examples and XML/Properties guidance. [2] Log4j2 manual: nestedConditions documentation. [3] Community examples showing properties-format nested_condition indexing (StackOverflow).

Remove the non-standard PathConditions configuration at lines 126–127.

Lines 126–127 define appender.rolling.strategy.action.PathConditions.type and .glob, which are not valid log4j2 properties-format keys for the Delete action. The correct structure uses appender.rolling.strategy.action.condition (lines 129–136), which already defines the file-matching logic. Delete the redundant lines 126–127; the nested condition structure at lines 129–136 is correct and properly chains the glob pattern match with the IfAny composite condition for size and age checks.

🤖 Prompt for AI Agents 
In ror-demo-cluster/conf/es/log4j2.properties around lines 122 to 136, remove
the two non-standard properties
appender.rolling.strategy.action.PathConditions.type and
appender.rolling.strategy.action.PathConditions.glob (lines 126–127) because
they are not valid for the Delete action; the correct file-matching is already
defined by appender.rolling.strategy.action.condition and its nested condition
block (lines 129–136), so delete the redundant PathConditions lines and keep the
existing condition/nested_condition structure intact.


logger.ror.name=tech.beshu.ror.accesscontrol.blocks.rules.elasticsearch.indices
logger.ror.level=info
logger.ror.name=tech.beshu.ror.accesscontrol.logging
logger.ror.level=off
4 changes: 3 additions & 1 deletion ror-demo-cluster/conf/es/readonlyrest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@ readonlyrest:

audit:
enabled: true
outputs: [index]
outputs:
- type: index
- type: log

access_control_rules:

Expand Down
2 changes: 1 addition & 1 deletion utils/extract_license_edition.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/env sh
#!/usr/bin/env bash
# Extract 'license.edition' from a ROR_ACTIVATION_KEY
# Usage: extract_license_edition.sh <rorActivationLicense>
set -eu
Expand Down