Log4j2 Architecture & Configuration

#What Is Log4j2?

Log4j2 is Apache's second-generation logging framework — a complete rewrite built to fix the limitations of Log4j 1.x.

#Log4j2 Architecture

Each component has one responsibility.

#Component 1 — Logger

The logger generates log events. Through SLF4J:

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class EmployeeService {
    private static final Logger logger = LoggerFactory.getLogger(EmployeeService.class);
}

Or with Log4j2's own API:

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

private static final Logger logger = LogManager.getLogger(EmployeeService.class);

Every class generally has its own logger (EmployeeController, EmployeeService, EmployeeRepository…). Never use one global logger for the whole application — you'd lose the ability to control levels per class or package.

#The Logger Hierarchy

Logger names form a hierarchy based on the package, separated by dots:

A child logger inherits its level and appenders from its nearest configured ancestor, unless it's explicitly configured. So setting com.example.service to DEBUG affects com.example.service.impl too.

The Root Logger

The root logger is the parent of all loggers and provides the default configuration:

<Root level="INFO">
    <AppenderRef ref="Console"/>
</Root>

Levels in Action

With the root level at INFO:

With <Root level="WARN">:

logger.info("Information");
logger.warn("Warning");
logger.error("Error");

Warning
Error

INFO isn't printed.

#The Configuration File

Log4j2 automatically looks for log4j2.xml, log4j2.json, log4j2.yaml or log4j2.properties on the classpath. Most projects use log4j2.xml in src/main/resources:

A Basic log4j2.xml

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN">
    <Appenders>
        <Console name="Console" target="SYSTEM_OUT">
            <PatternLayout pattern="%d %p %c %m%n"/>
        </Console>
    </Appenders>

    <Loggers>
        <Root level="INFO">
            <AppenderRef ref="Console"/>
        </Root>
    </Loggers>
</Configuration>

status="WARN" controls Log4j2's own internal messages — set it to DEBUG when your configuration doesn't seem to load.

#Appenders

An appender decides where logs go: Console, File, RollingFile, database (JDBC), Socket, SMTP, Kafka and more.

Console Appender

<Console name="Console" target="SYSTEM_OUT">
    <PatternLayout pattern="%d %p %c %m%n"/>
</Console>

2026-07-23 10:15:02,118 INFO com.example.EmployeeService Employee Saved

File Appender

<File name="File" fileName="logs/application.log">
    <PatternLayout pattern="%d %p %m%n"/>
</File>

Writes to logs/application.log — a file that grows forever.

Rolling File Appender

The most common choice in production. A single application.log can reach 40 GB and become impossible to open or ship. A rolling appender starts a new file on a schedule or size limit:

<RollingFile name="Rolling"
             fileName="logs/application.log"
             filePattern="logs/application-%d{yyyy-MM-dd}-%i.log.gz">
    <PatternLayout pattern="%d %p %c{1} %m%n"/>
    <Policies>
        <TimeBasedTriggeringPolicy/>                 <!-- new file every day -->
        <SizeBasedTriggeringPolicy size="100 MB"/>   <!-- …or when a file reaches 100 MB -->
    </Policies>
    <DefaultRolloverStrategy max="20">
        <Delete basePath="logs" maxDepth="1">
            <IfFileName glob="application-*.log.gz"/>
            <IfLastModified age="30d"/>             <!-- keep 30 days of logs -->
        </Delete>
    </DefaultRolloverStrategy>
</RollingFile>

application.log                  ← current file
application-2026-07-21-1.log.gz
application-2026-07-22-1.log.gz
application-2026-07-23-1.log.gz
application-2026-07-23-2.log.gz  ← second file the same day (size limit reached)

#PatternLayout

PatternLayout controls how each log line looks:

<PatternLayout pattern="%d %p %c %m%n"/>

A Production Pattern

%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %-5level %c{1} - %m%n

2026-07-23 11:02:12.125 [main] INFO  EmployeeService - Employee Saved

#Multiple Appenders

A logger can write to several destinations at once:

<Root level="INFO">
    <AppenderRef ref="Console"/>
    <AppenderRef ref="Rolling"/>
</Root>

Logs go to both the console and the rolling file.

Per-Package Levels and Additivity

<Loggers>
    <Logger name="com.example.payment" level="DEBUG" additivity="false">
        <AppenderRef ref="PaymentFile"/>
    </Logger>
    <Logger name="org.hibernate.SQL" level="DEBUG"/>
    <Root level="INFO">
        <AppenderRef ref="Console"/>
    </Root>
</Loggers>

• com.example.payment logs at DEBUG to its own file.
• By default a logger's events also flow up to its parents' appenders (additivity). additivity="false" stops payment logs being written to the console too — and prevents duplicate lines when a logger and its parent share an appender.

#Key Takeaways

• Log4j2 is a faster, actively maintained rewrite of Log4j 1.x.
• Logger names form a hierarchy; children inherit from the nearest configured ancestor, ultimately the root logger.
• log4j2.xml defines appenders (where), layouts (how) and loggers (which level, which appenders).
• RollingFile appenders need triggering policies and a retention policy.
• %d %p %c %m%n = date, level, logger, message, new line; avoid costly location patterns.