A brief note on Log4perl
Tags: perl, logging, log4j, security
Published: 2021-12-14 15:46:42

---
title: A brief note on Log4perl
published: true
date: 2021-12-14 15:00:00 UTC
tags: Perl,logging,Log4j,security
canonical_url: https://phoenixtrap.com/2021/12/14/a-brief-note-on-log4perl/
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/68xd6hcyb47xnxo5xiib.jpeg
---

The Java world had an… interesting weekend when security researchers revealed on December 9 a [vulnerability](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) in the popular [Apache Log4j 2](https://logging.apache.org/log4j/2.x/) software library for recording and debugging events. Systems as diverse as [Amazon Web Services](https://aws.amazon.com/security/security-bulletins/AWS-2021-006/), [Apple iCloud](https://www.macworld.com/article/559108/icloud-patch-log4shell-exploit.html), and the [Minecraft video game](https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition) could be exploited to run arbitrary code on a server merely by sending a specially-crafted string of text. Information technology professionals have been scrambling ever since the initial disclosure to patch, upgrade, reconfigure, or otherwise protect affected servers. [It’s bad](https://log4shell.com/), and past unpatched vulnerabilities [like this](https://arstechnica.com/information-technology/2017/09/massive-equifax-breach-caused-by-failure-to-patch-two-month-old-bug/) have been responsible for the exposure of millions of people’s sensitive data.

Many Perl applications use the similarly-named and ‑designed [Log::Log4perl](https://metacpan.org/pod/Log::Log4perl) library, and the good news is that as far as I can tell the latter doesn’t suffer from the type of vulnerability described above. **This doesn’t mean poorly-written or ‑configured Perl-based systems are immune to all exploits, just this particular one.** You should be safe to continue using Log4perl unless someone has deliberately configured it otherwise, and in fact, [my work](https://www.hostgator.com/) uses it extensively.

You might be surprised to read me suggesting a logging framework after [writing multiple articles espousing the Perl step debugger](https://phoenixtrap.com/tag/debugging/) as an alternative. Log4perl developer Mike Schilli’s [2002 introduction to the package for Perl.com](https://www.perl.com/pub/2002/09/11/log4perl.html) came down on the opposite side of the argument. It can seem like one of those programmer religious issues like [tabs vs. spaces](https://thenewstack.io/spaces-vs-tabs-a-20-year-debate-and-now-this-what-the-hell-is-wrong-with-go/), [vim vs. Emacs](https://en.wikipedia.org/wiki/Editor_war), or [Linux](https://docs.microsoft.com/en-us/windows/wsl/) vs. [Windows](https://www.winehq.org/). (For the record, the correct answers are [spaces](https://metacpan.org/pod/Perl::Critic::Policy::CodeLayout::ProhibitHardTabs), [BBEdit](https://www.barebones.com/products/bbedit/), and [macOS](https://www.apple.com/macos/). 😉)

But in this case, you can and should have the best of both worlds—logging at different [levels](https://metacpan.org/pod/Log::Log4perl#Log-Levels) to appropriate [destinations](https://metacpan.org/pod/Log::Log4perl#Appenders) while still dropping into the [interactive debugger](https://perldoc.perl.org/perldebug) when you need to do something trickier like examine program state or tweak a data structure on the fly. I use both techniques and only emphasize the advocacy of step debugging because it’s understood less.