# CVE-2021-44228 - Logstahs - ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath **URL:** \ **Category:** Logstash\ **Created:** [December 14, 2021, 12:35pm UTC](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798 "2021-12-14T12:35:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![prajyodh](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@prajyodh](https://discuss.elastic.co/u/prajyodh)\ **Post date:** [December 14, 2021, 12:35pm UTC](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798/1 "2021-12-14T12:35:20Z")
Hi I was checking on impact of CVE-2021-44228 on ELK stack and came across the link > [@Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476): > > Subject: Apache Log4j2 Vulnerability - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 - ESA-2021-31 ​​Note - We will update this announcement with new details as they emerge from our analysis. Please check back periodically. Update Log Dec 16, 2021 - 04:20 UTC - Update Summary: ECK 1.9 released which automatically adds the JVM option to impacted Elasticsearch clusters managed by ECK. Dec 17, 2021 - 23:50 UTC - Update latest release of APM Java Agent to 1.28.2. Statement of pl… When i tried the solution mentioned for logstash to remove the JNDI Class `zip -q -d /logstash-core/lib/jars/log4j-core-2.13.3.jar org/apache/logging/log4j/core/lookup/JndiLookup.class` I took Back up of existing jar. Copied log4j-core-2.13.3.jar to my home , tried above command in my home directory and copied back the updated jar back to lib/jars/. When I start logstash now i see the below Error in logs. I reverted back to the old existing jar and still the error continues. Any inputs are appreciated. ```auto 021/12/14 06:28:27 - logstash started. warning: --1.9 ignored ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath. Using SimpleLogger to log to the console... NameError: missing class name (`org.apache.logging.log4j.core.LoggerContext') method_missing at org/jruby/javasupport/JavaPackage.java:252
at /opt/app/logstash/logstash-core/lib/logstash/api/modules/logging.rb:18 require at org/jruby/RubyKernel.java:974 require at /opt/app/logstash/vendor/bundle/jruby/2.5.0/gems/polyglot-0.3.5/lib/polyglot.rb:65
at /opt/app/logstash/logstash-core/lib/logstash/api/rack_app.rb:25 require at org/jruby/RubyKernel.java:974 require at /opt/app/logstash/vendor/bundle/jruby/2.5.0/gems/polyglot-0.3.5/lib/polyglot.rb:65
at /opt/app/logstash/logstash-core/lib/logstash/webserver.rb:18 require at org/jruby/RubyKernel.java:974 require at /opt/app/logstash/vendor/bundle/jruby/2.5.0/gems/polyglot-0.3.5/lib/polyglot.rb:65
at /opt/app/logstash/logstash-core/lib/logstash/agent.rb:23 require at org/jruby/RubyKernel.java:974
at /opt/app/logstash/logstash-core/lib/logstash/runner.rb:44 require at org/jruby/RubyKernel.java:974
at /opt/app/logstash/lib/bootstrap/environment.rb:87 ``` ---
**Author:** ![sandeepkanabar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandeepkanabar/32/79399_2.png) [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Post date:** [December 14, 2021, 6:17pm UTC](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798/2 "2021-12-14T18:17:04Z")
Make sure you change the `ownership` of the file to `logstash:logstash` or whatever it was before you made the changes. ---
**Author:** ![prajyodh](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@prajyodh](https://discuss.elastic.co/u/prajyodh)\ **Post date:** [December 15, 2021, 9:44am UTC](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798/3 "2021-12-15T09:44:21Z")
The ownership is the same `logstash:logstash` (before and after changes) ---
**Author:** ![sandeepkanabar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandeepkanabar/32/79399_2.png) [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Post date:** [December 21, 2021, 6:41am UTC](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798/4 "2021-12-21T06:41:37Z")
Elastic has come out with a removal tool and an excellent article on Logstash - [Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation](https://discuss.elastic.co/t/logstash-5-0-0-6-8-20-and-7-0-0-7-16-0-log4j-cve-2021-44228-cve-2021-45046-remediation/292343) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 18, 2022, 6:42am UTC](https://discuss.elastic.co/t/cve-2021-44228-logstahs-error-statuslogger-log4j2-could-not-find-a-logging-implementation-please-add-log4j-core-to-the-classpath/291798/5 "2022-01-18T06:42:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.