# How is log4j-1.2.17 jar being installed on my system

**URL:** <https://discuss.elastic.co/t/how-is-log4j-1-2-17-jar-being-installed-on-my-system/312971>\
**Category:** Logstash\
**Created:** [August 25, 2022, 11:16pm UTC](https://discuss.elastic.co/t/how-is-log4j-1-2-17-jar-being-installed-on-my-system/312971 "2022-08-25T23:16:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![brilong](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brilong](https://discuss.elastic.co/u/brilong)\
**Post date:** [August 25, 2022, 11:16pm UTC](https://discuss.elastic.co/t/how-is-log4j-1-2-17-jar-being-installed-on-my-system/312971/1 "2022-08-25T23:16:03Z")

</div>

I am not very familiar with logstash but I am trying to determine why the file /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-log4j-3.1.3-java/vendor/jar-dependencies/runtime-jars/log4j-1.2.17.jar exists on my system.

I have the logstash 7.17.6 RPM installed from [elastic.co](http://elastic.co) yum repos. The jar file is not included in the RPM and says the jar does not belong to any package on the system. logstash-plugin list logstash-input-log4j says the plugin is not installed. Tenable scans are showing this log4j-1.2.17.jar as a critical vulnerability and I need to know the proper way to determine if I can remove it without affecting application logging. Thank you for any clues.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 26, 2022, 1:10am UTC](https://discuss.elastic.co/t/how-is-log4j-1-2-17-jar-being-installed-on-my-system/312971/2 "2022-08-26T01:10:16Z")

</div>

```auto
sudo ./logstash-plugin install logstash-input-log4j
sudo ./logstash-plugin uninstall logstash-input-log4j

```

"removes" the input, but leaves all the files for it on the filesystem.

Personally I just fixed this using

```auto
sudo rm -rf /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-log4j-3.1.3-java/

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2022, 1:10am UTC](https://discuss.elastic.co/t/how-is-log4j-1-2-17-jar-being-installed-on-my-system/312971/3 "2022-09-23T01:10:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.