Log4j2 - Unrecognized conversion specifier [xwEx] starting at position 160 in conversion pattern
There is an issue reported that says Spring Boot 1.5 is not compatible with Log4j 2.8. https://github.com/spring-projects/spring-boot/issues/9172
I was getting errors like yours with Spring Boot 1.5 and Log4j 2.8.2, and the errors away when I switched to Log4j 2.7
springboot1 default log4j.xml use pattern: %xwEx is not supported by 2.8+, but we can override the pattern by set environment variable LOG_EXCEPTION_CONVERSION_WORD like: %throwable
@SpringBootApplication
public class Application {
public static void main(String[] args) {
System.setProperty("LOG_EXCEPTION_CONVERSION_WORD", "%throwable");
SpringApplication.run(Application.class, args);
}
}
I think that existing answers are correct but incomplete.
You get that error if both the following conditions occur:
- You are using an old version of spring-boot with a recent version of Log4J2 (not ideal but possible; you are upgrading Log4J2 due to "Log4shell" vulnerability, right?)
- You are using the default logging config file provided by spring-boot (it is
/org/springframework/boot/logging/log4j2/log4j2.xml
inspring-boot-x.x.x.RELEASE.jar
). This is the real problem.
The default config file exists to allow a quick setup of new applications. Unfortunately it is not compatible with Log4J 2.8+.
Probably you want to use your own configuration and, perhaps, you have already prepared your config file but the application hasn't found it.
Possible solutions:
-
Upgrade spring-boot or downgrade Log4J2 (downgrading is not recommended, of course).
-
If you really want to use the default cfg (really?), set this environment variable:
LOG_EXCEPTION_CONVERSION_WORD=%throwable
as suggested by tsingke -
Ensure that your own
log4j2.xml
or, even better,log4j2-spring.xml
is in the classpath or in a path pointed out by thelogging.config
environment variable (see Custom Log Configuration).
I have used solution #3.
Side note: if you upgrade Log4J but continue using spring-boot 1.x you suffer from other vulnerabilities, so it should be just the first step, even if your boss (or your customer) only cares about Log4shell!