Teaching Logging
When Log4Shell shook the Java world, I didn't believe it at first. Then I realized my team would have to fix it.
It could be a classic vulnerability story: a feature we added, forgot, and someone discovered how to exploit. While I was not working directly on the issue, many people knew me from Log4j. They called and asked how to fix it. I started sharing what I knew on Twitter and tried to respond to as many questions as possible.
I learned two things:
- People often don't know if they have Log4j
- And many don't know what Log4j actually is
Call me naive, but I was surprised. How can you not know if you are using it when you define it in your Maven files?
But reality was more complex. Some software repackaged Log4j or shipped it through Debian packages, making it invisible to a basic search. This was part of a larger problem, one that's now driving the push for SBOMs (Software Bills of Materials): machine-readable documents that clearly show your dependencies.
But there was also something else that made me pause.
People who knew Log4j didn't know how it worked.
I used to assume developers understood the libraries they used. I realized I didn't either. I’ve read through parts of Jackson’s core and Spring code, but never explored MyBatis under the hood. Who really has the time?
Maybe I was expecting too much. Logging isn’t part of most university curricula. Reading the docs takes time and focus. Two things few have when they start working.
Logging is both unimportant and essential. Unimportant because it doesn't add business value. Essential because when it fails, the cost can be immense.
I was lucky to have Walter as a mentor. He took me aside, explained how logging worked, and shared best practices. He also introduced me to open source and kept praising it until I joined myself.
Now I see thousands of Walters around the world doing the same: teaching younger colleagues how to log properly, how a framework actually works, what an exception is (I consider this so closely related to logging).
Without a Walter in your life, nobody teaches you these things. You'd have to figure it out the hard way or end up relying on AI code without truly understanding it.
After Log4shell was fixed, I thought about writing a book that explains the fundamentals of logging. Recently, this idea became real. It is now part of the Manning MEAP program.
Java Logging (Manning)
https://www.manning.com/books/java-logging (Affiliate Link)
This book closes a circle: from my early days of learning to my work as a trainer. I hope it helps others, as my mentor once helped me. Maybe the spirit of passing on knowledge can live on through it.
Tags: open source, mentorship, maintainership, education, Java