java.lang.NoClassDefFoundError: org/apache/logging/log4j/core/LogEvent

[MarkBensch]

QAF Version

QAF 3.0, 3.1.0

Library

Log4j

Description

We would request that you update the log4j version to 2.18.0 or 2.18 compatible.
We updated our project with log4j 2.18.0 and we are experiencing a runtime error in the DatabaseUtil.java.
This change was for the remediation of log4j vulnerability for all versions below 2.17

Steps To Reproduce

We have tried with the log4j included from QAF and upgrading in place and with an excluding log4j from QAF:
version 2.17.2 project seems to be executing fine. It is just on the next version of log4j 2.18 it is not functioning properly and give the error.
Caused by: java.lang.NoClassDefFoundError: org/apache/logging/log4j/core/LogEvent
15:38:09 at com.qmetry.qaf.automation.util.DatabaseUtil.(DatabaseUtil.java:55)

option one: in place overwrite through dependecies.

1. update pom.xml
`		<dependency>
			<groupId>org.apache.logging.log4j</groupId>
		<artifactId>log4j-1.2-api</artifactId>
		<version>${log4j.version}</version>
		<scope>compile</scope>
	</dependency>
	<dependency>
		<groupId>org.apache.logging.log4j</groupId>
		<artifactId>log4j-api</artifactId>
		<version>${log4j.version}</version>
		<scope>compile</scope>
	</dependency>
	<dependency>
		<groupId>org.apache.logging.log4j</groupId>
		<artifactId>log4j-core</artifactId>
		<version>${log4j.version}</version>
		<scope>runtime</scope>
	</dependency> `

option two: exclude from QAF first.

1. update pom.xml
`<dependency>
		<groupId>com.qmetry</groupId>
		<artifactId>qaf</artifactId>
		<version>${qaf.version}</version>
		<exclusions>
			<exclusion>
				<groupId>log4j</groupId>
				<artifactId>log4j</artifactId>
			</exclusion>
		</exclusions>
	</dependency> `

Expected behavior

no error from database utility

Actual behavior

error from database utility
Caused by: java.lang.NoClassDefFoundError: org/apache/logging/log4j/core/LogEvent 15:38:09 at com.qmetry.qaf.automation.util.DatabaseUtil.<clinit>(DatabaseUtil.java:55)

Is the issue reproducible on runner?

• QAS
• Maven
• Gradle
• Ant
• Eclipse

[cjayswal]

Make sure that you are using latest version of QAF. Latest qaf (including database utils) version doesn't uses log4j. One of the way to check which version of qaf used is environment information in dashboard. It should work with any version of log4j or any other logging framework.

[MarkBensch]

Thank you for the response. We will make our changes and verify.