[Esapi-user] [Esapi-dev] ESAPI.properties Logger.LogFileName=...

Chris chris.dickinson at web.de
Sat Apr 30 13:59:43 EDT 2011

I figured out (one way) how to configure log4j programmatically. I
created my own Log4JLogFactory2 implementation in order to make a minor
change to Log4JLogFactory2.Log4JLogger. I added a static code block that
does the following:

            try {
                String logFileName =
                // CD: hack (log file must already exist for this to work!)
                String logFilePath =
FileAppender(new PatternLayout("%-4r [%t] %-5p %c %x - %m%n"),
            } catch (IOException e) {

Is this possibly the way ESAPI.securityConfiguration().getLogFileName()
was meant to be used? If not, could someone explain a better way to do this?

on 04/20/2011 08:36 PM Chris wrote :
> I realized shortly after sending my last mail that it was sent
> prematurely. Sent at the end of a long, tiring and frustrating day. Sorry.
>     * ESAPI.properties is of course under configuration/esapi/ in the
>       rc11. Sorry about that "pps".
>     * I failed to mention that I was trying to get Logging working via
>       the reference implementations, not trying to write my own quite yet.
>     * (Default)SecurityConfiguration.getLogFileName(): This is the
>       only place where I see the "Logger.LogFileName" variable from
>       ESAPI.properties being used. However, at least in rc4 I am
>       unable to find a single call of this method. So in essence my
>       question is: where does ESAPI intend for me to be calling this
>       method if I'm using log4j (or any other Logger)? How do I (use
>       this method to) tell log4j where the log file is?
> Probably I'm missing something really basic. Any help would be much
> appreciated.
> on 04/20/2011 04:46 PM Chris Dickinson wrote :
>> Hello
>> I want to use ESAPI's Logger to write log messages to a log file. I'm using rc4 of ESAPI 2.0. I Noticed the line in ESAPI.properties:
>>    Logger.LogFileName=ESAPI_logging_file
>> However, the logging only appears in the console, never in a file.
>> What steps need to be taken in order for the logging to be done in the file specified in ESAPI.properties?
>> p.s. I can get log4j to write into a log file via a "FileAppender" entry in log4j.xml, but that would be defeating the purpose of having this line in ESAPI.properties, right?
>> p.p.s. It looks like rc11 works in quite a different way. Is there no longer any ESAPI.properties file? Where can I find documentation for this?
>> ___________________________________________________________
>> WEB.DE DSL Doppel-Flat ab 19,99 €/mtl.! Jetzt mit 
>> gratis Handy-Flat! http://produkte.web.de/go/DSL_Doppel_Flatrate/2
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.owasp.org/pipermail/esapi-user/attachments/20110430/d8335db0/attachment.html 

More information about the Esapi-user mailing list