B4J Question [SOLVED] Log4j Error message reported within run_debug.bat

[Ralph Parkhurst]

I have a B4J app running under Windows which provides an "internal" MQTT broker, based on the jMqttBroker2 library v2.02 here:

My software performs well (and has done so for many months). But today, when I executed run_debug.bat in a CMD window, I encountered an unexpected error:

log4j:ERROR setFile(null,true) call failed.
java.io.FileNotFoundException: moquette_messages.log (Access is denied)
        at java.base/java.io.FileOutputStream.open0(Native Method)
        at java.base/java.io.FileOutputStream.open(Unknown Source)
        at java.base/java.io.FileOutputStream.<init>(Unknown Source)
        at java.base/java.io.FileOutputStream.<init>(Unknown Source)
        at b4j/org.apache.log4j.FileAppender.setFile(Unknown Source)
        at b4j/org.apache.log4j.RollingFileAppender.setFile(Unknown Source)
        at b4j/org.apache.log4j.FileAppender.activateOptions(Unknown Source)
        at b4j/org.apache.log4j.config.PropertySetter.activate(Unknown Source)
        at b4j/org.apache.log4j.config.PropertySetter.setProperties(Unknown Source)
        at b4j/org.apache.log4j.config.PropertySetter.setProperties(Unknown Source)
        at b4j/org.apache.log4j.PropertyConfigurator.parseAppender(Unknown Source)
        at b4j/org.apache.log4j.PropertyConfigurator.parseCategory(Unknown Source)
        at b4j/org.apache.log4j.PropertyConfigurator.parseCatsAndRenderers(Unknown Source)
        at b4j/org.apache.log4j.PropertyConfigurator.doConfigure(Unknown Source)
        at b4j/org.apache.log4j.PropertyConfigurator.doConfigure(Unknown Source)
        at b4j/org.apache.log4j.helpers.OptionConverter.selectAndConfigure(Unknown Source)
        at b4j/org.apache.log4j.LogManager.<clinit>(Unknown Source)
        at b4j/org.slf4j.impl.Log4jLoggerFactory.getLogger(Unknown Source)
        at b4j/org.slf4j.LoggerFactory.getLogger(Unknown Source)
        at b4j/org.slf4j.LoggerFactory.getLogger(Unknown Source)
        at b4j/io.moquette.broker.Server.<clinit>(Unknown Source)
        at b4j/anywheresoftware.b4j.objects.MqttBroker.Initialize(Unknown Source)
        at b4j/EWS.console.mqttbrokermodule._mqttbroker_start(Unknown Source)
        at b4j/EWS.console.main$ResumableSub_AppStart.resume(Unknown Source)
        at b4j/anywheresoftware.b4a.BA.checkAndRunWaitForEvent(Unknown Source)
        at b4j/anywheresoftware.b4a.BA.raiseEvent2(Unknown Source)
        at b4j/anywheresoftware.b4a.keywords.Common.CallSub4(Unknown Source)
        at b4j/anywheresoftware.b4a.keywords.Common.access$0(Unknown Source)
        at b4j/anywheresoftware.b4a.keywords.Common$CallSubDelayedHelper.run(Unknown Source)
        at javafx.graphics/com.sun.javafx.application.PlatformImpl.lambda$runLater$10(Unknown Source)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at javafx.graphics/com.sun.javafx.application.PlatformImpl.lambda$runLater$11(Unknown Source)
        at javafx.graphics/com.sun.glass.ui.InvokeLaterDispatcher$Future.run(Unknown Source)
        at javafx.graphics/com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
        at javafx.graphics/com.sun.glass.ui.win.WinApplication.lambda$runLoop$3(Unknown Source)
        at java.base/java.lang.Thread.run(Unknown Source)

This error does not appear to cause any issue, and my app is running absolutely perfectly. However I saw mention of Apache's log4j which I know has been the subject of a reported exploit a few years ago here.

Do I have cause for concern?

 

[Erel]

The embedded log4j library version is 1.x. The security report is related to version 2.x.

 

[Ralph Parkhurst]

The embedded log4j library version is 1.x. The security report is related to version 2.x.

Thanks Erel for your speedy clarification. I'll consider it "safe to ignore".