log4j-slf4j-impl cannot be present with log4j-to-slf4j

背景：

在修复logbackThe remote execution vulnerability reports an error

log4j-slf4j-impl cannot be present with log4j-to-slf4j

这个错误的意思是 log4j-slf4j-impl 和 log4j-to-slf4j 这两个包不能同时存在.

那么为什么这两个包不能同时存在呢？我们先来看一下这两个包的定义：

log4j-slf4j-impl
Apache Log4j SLF4J Binding: The Apache Log4j SLF4J API binding to Log4j 2 Core
log4j-to-slf4j
Apache Log4j to SLF4J Adapter: The Apache Log4j binding between Log4j 2 API and SLF4J
从上述定义可以看出,log4j-slf4j-impl 主要是 log4j 对 slf4j 接口的实现,而 log4j-to-slf4j 则是 slf4j 对 log4j 接口的适配.

解决方案

1. The most complicated scheme is：component by component,挨个排查

如果springboot 项目使用log4j2日志框架,imported into the project spring-boot-starter-logging及其引用jar 的地方,All checked out;或者继续使用springboot的logback,

那么就将log4j2 以及其jar的地方,Check through.— Time consuming and potentially dirty to troubleshoot

2. 使用pom全局排除

即将spring-boot-starter-logging All excluded or will be spring-boot-starter-log4j2 All places are excluded.

使用springboot 默认的logback Log output log settings :

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-log4j2</artifactId>
      <exclusions>
        <exclusion>
          <groupId>org.apache.logging.log4j</groupId>
          <artifactId>log4j-slf4j-impl</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.apache.logging.log4j</groupId>
          <artifactId>log4j-jul</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.slf4j</groupId>
          <artifactId>jul-to-slf4j</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <!-- 修复logback远程执行漏洞-->
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-core</artifactId>
      <version>1.2.9</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-classic</artifactId>
      <version>1.2.9</version>
      <scope>compile</scope>
    </dependency>

参考：
log4j-slf4j-impl cannot be present with log4j-to-slf4j