Log4j2/slf4j - Should commons-logging.jar be removed from classpath?

Question

My logging dependencies currently look like this:

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-bom</artifactId>
            <version>2.9.1</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>

<dependencies>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-api</artifactId>
    </dependency>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
    </dependency>
    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>1.7.25</version>
    </dependency>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-slf4j-impl</artifactId>
    </dependency>

I noticed that commons-logging.jar is still in my classpath, for some reason. Should I exclude that or doesn't that cause any issues?

I didn't notice any problems so far, but I'm still wondering if that jar would still cause problems somehow.

Answer 1

There are dependencies that use commons-logging . If it's not present, you'll get NoClassDefFoundErrors when they attempt to log. If there were a possibility to have those not even try to use the dependency, it wouldn't be a problem. However that's not very likely.

However, if they use commons-logging but you're using SLF4J , then there's a problem. They're logging in the wrong place (from your point of view). This is where logging bridges come to work. They implement the public API of different logging frameworks, but redirect the logging to what you're using.

For SLF4J there are several bridges (both ways), so instead of bringing in commons-logging , you bring in jcl-over-slf4j . Libraries will think they're using commons-logging , when they're actually using SLF4J (which then uses an actual logging implementation like Logback).

Easy, huh? ;)

Answer 2

Yes, exclude the commons-logging dependency and add the log4j-jcl bridge instead:

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-jcl</artifactId>
</dependency>

SLF4J API is also redundant because it is already a transitive dependency of the log4j-slf4j-impl binding.