Log4j is a widely used logging library for Java applications, enabling developers to record important information about program execution. Following the discovery of the Log4Shell vulnerability (CVE-2021-44228), it has become crucial to ensure that your systems are running a secure version of Log4j. This article provides a step-by-step guide on how to check the Log4j version installed on a Linux system.
Why Check the Log4j Version?
- Security: Older versions of Log4j may contain vulnerabilities like Log4Shell, which can be exploited for remote code execution.
- Compatibility: Certain applications require specific Log4j versions to function correctly.
- Compliance: Staying updated with secure versions ensures compliance with cybersecurity best practices.
Methods to Check Log4j Version in Linux
Below are several reliable methods to identify the Log4j version on your Linux system:
1. Using the find Command
If Log4j is installed on your system, it is typically stored in .jar files. You can use the find command to locate these files and check their versions.
Steps:
1. Open a terminal on your Linux system.
2. Run the following command to locate Log4j .jar files:
find / -name “log4j*.jar” 2>/dev/null
This command searches the entire file system for files matching the pattern log4j*.jar.
3. Once you locate the .jar files, use the following command to inspect them:
jar -tvf /path/to/log4j-core-*.jar | grep “META-INF/MANIFEST.MF”
4. Extract the version details:
unzip -p /path/to/log4j-core-*.jar META-INF/MANIFEST.MF | grep “Implementation-Version”
Output:
The version will be displayed, such as:
Implementation-Version: 2.17.1
2. Using the grep Command
Log4j version information might be logged in configuration or log files. You can use grep to search for version details.
Steps:
1. Search for Log4j references in your configuration files:
grep -r “log4j” /path/to/config/
2. Inspect any output for version information.
3. Alternatively, search your application logs for Log4j details:
grep “log4j” /var/log/*.log
3. Checking Installed Packages
If Log4j was installed via a package manager, you can query the package list to check its version.
For Debian/Ubuntu:
dpkg -l | grep log4j
For Red Hat/CentOS:
rpm -qa | grep log4j
Output:
You will see a list of installed Log4j packages and their respective versions, such as:
- Access Permissions: Use sudo if you encounter permission issues while searching files.
- Environment Variables: Ensure that the JAVA_HOME and classpath are correctly configured if using Java-based methods.
- Outdated Installations: If you find an old version, update immediately to the latest secure release of Log4j.
Conclusion
Checking the Log4j version on a Linux system is a critical step for maintaining application security and compatibility. Whether using the find command, package managers, or Java-based methods, it’s essential to ensure that your system is running a secure version of Log4j. For systems with outdated or vulnerable versions, upgrade to the latest release and apply any necessary patches to safeguard against potential exploits.
