Everything about Log4j

🧭 Start here: a 6-step reading path

1. Read the overview: Log4jA 5-minute orientation
2. Skim a recent paper: From Logging Configuration to Code Execution: A Systematization of Log4j 2 File-Write Primitives in HTTP-Exposed JMXInfluential work since 2022
3. Pick up a classic book: The Complete Log4j ManualThe most-reprinted book on the subject
4. Read the landmark paper: The Log4j Incident: A Comprehensive Measurement Study of a Critical VulnerabilityCited 29 times
5. Go sideways: Java logging frameworkA closely related topic
6. Go sideways: Log4ShellA closely related topic

🏆 Landmark papers (most cited)

• The Log4j Incident: A Comprehensive Measurement Study of a Critical Vulnerability

  Raphael Hiesgen, Marcin Nawrocki, Thomas C. Schmidt · 2024 · IEEE Transactions on Network and Service Management · 29 citations

• Application of Log4j in E-Commerce Services

  Wen Zhi Liu, Qiu Yan Tao, Qin He · 2014 · Applied Mechanics and Materials · 4 citations

• Remote Code Execution via Log4J MBeans: Case Study of Apache ActiveMQ (CVE-2022-41678)

  Alexandru Răzvan Căciulescu, Matei Bădănoiu, Răzvan Rughiniș · 2025 · Computers · 3 citations

• APACHE LOG4J SHELL VULNERABILITY ANALYSIS

  Dept. of Intelligent Information Systems and Technology MIPT Moscow, Russia, Amit Kumar Jaiswal · 2022 · International Journal of Engineering Applied Sciences and Technology · 2 citations

• Simulation, Investigation and Response Towards Log4J Vulnerability (Log4Shell)

  Seif Elsallamy, Julia Juremi · 2022 · Journal of Applied Technology and Innovation · 0 citations

• Le Centre pour la Cybersécurité Belgique prévoit des problèmes majeurs pour les entreprises et les organisations qui ne prennent pas de mesures contre la vulnérabilité de Log4j

  Miguel De Bruycker · 2022 · DPO news · 0 citations

• The challenges of Log4j – and how to solve them

  Tom McVey · 2022 · Network Security · 0 citations

• Open Source Security: Managing Risk in the Wake of Log4j Vulnerability

  Sreejith Sreekandan Nair, Govindarajan Lakshmikanthan · 2021 · International Journal of Emerging Trends in Computer Science and Information Technology · 0 citations

🆕 Influential since 2022

• From Logging Configuration to Code Execution: A Systematization of Log4j 2 File-Write Primitives in HTTP-Exposed JMX

  Alexandru Răzvan Căciulescu, Matei Bădănoiu, Răzvan Rughiniș · 2026 · Computers · 0 citations

📚 Books worth reading

• The Complete Log4j ManualCeki Gulcu · 2003
• 📕Log4jJ. Steven Perry · 2009

Ranked by number of editions on Open Library, a rough measure of how lasting a book is.

🔗 Related topics

• Java logging framework A Java logging framework is a computer data logging package for the Java platform. This article covers general purpose logging frameworks. Logging refers…
• Log4Shell Log4Shell (CVE-2021-44228) is a vulnerability reported in November 2021 in Log4j, a popular Java logging framework, involving arbitrary code execution…
• SLF4J Simple Logging Facade for Java (SLF4J) provides a Java logging API by means of a simple facade pattern. The underlying logging backend is determined at…
• Spring Framework The Spring Framework is an application framework and inversion of control container for the Java platform. The framework's core features can be used by…
• Apache Commons Logging Apache Commons Logging (previously known as Jakarta Commons Logging or JCL) is a Java-based logging utility and a programming model for logging and for…
• Apache Wicket Apache Wicket, commonly referred to as Wicket, is a component-based web application framework for the Java programming language conceptually similar to…
• Apache Click Apache Click is a page and component oriented web application framework for the Java language and is built on top of the Java Servlet API. It is a free…
• Apache Tapestry Apache Tapestry is an open-source component-oriented[clarification needed] Java web application framework conceptually similar to JavaServer Faces and…