Logging in Gradle plugin

[OrangeDog]

Is there any way to get fine control of the logging in a Gradle project?

I'd like to run with --debug so I can investigate an issue, but this enables the org.apache.hc.client5.http.wire logger along with everything else. A routine update has been running for 30 minutes now while it echos everything it downloads (with a verbose UTF-16 hex encoding) to stdout.

I have no way to tell whether it's stuck in a loop or just spending all its time logging.

[chadlwilson]

It's annoying, but unfortunately I don't think there's much we can do here centrally because of Gradle's logging design. It hijacks all SLF4j configuration itself (since it uses slf4j internally with their own binder/implementation) and allows no ways to control it externally.

https://docs.gradle.org/current/userguide/logging.html
gradle/gradle#2408 / gradle/gradle#11212 / gradle/gradle#1010 / gradle/gradle#20414 (and probably other issues)

Suggest you use an inverted grep:

./gradlew dependencyCheckAggregate --debug | grep -v "org.apache"

or a targeted grep

./gradlew dependencyCheckAggregate --debug | grep "org.owasp.dependencycheck"

In all the other entry points we suppress these noisy ones, but there seems no way to do so on Gradle, and I've looked multiple times.

[chadlwilson]

This ticket should probably sit on the Gradle plugin's repo; you'll see I already commented on this specifically at dependency-check/dependency-check-gradle#492

[chadlwilson]

One thing I have been thinking about here is finding a way to more generally change ODC's own logging (where we have control of the code) to allow be able to be redirected to gradle logging, which would give us more control.

It wouldn't fix --debug or library logging, but that way we could

• redirect logging to the main gradle lifecycle output more consistently with the other plugins (where everything INFO tends to be visible to users)
• may allow us to log enough in the main output, or --info to avoid this being a problem.
• use common code to control/redirect logging, rather than the current approach of adapting every implementation to the wrapping tool, which needs to adjust to how slf4j is handled on that platform; and sometimes hack around specific libraries.

If you have any ideas of how that might be done, or other gradle plugins that you have seen which do a good job at this, I'd be keen to hear/take a look. Seems silly to need to introduce a new facade, but maybe no choice given the java logging world within libraries is still mixed up between commons-logging, java.util.logging, SLF4J and other custom facades (Gradle, Apache Lucene).

Maven plugin

Assumes use of SLF4J SimpleLogger impl:

DependencyCheck/maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java

Lines 2732 to 2742 in 734ab4f

	void muteNoisyLoggers() {
	// Mirrors the configuration within cli/src/main/resources/logback.xml
	final List<String> noisyLoggers = List.of(
	"org.apache.lucene",
	"org.apache.commons.jcs3",
	"org.apache.hc"
	);
	for (String loggerName : noisyLoggers) {
	System.setProperty("org.slf4j.simpleLogger.log." + loggerName, "error");
	}
	}

Ant:

Assumes use of SLF4J SimpleLogger impl:

DependencyCheck/ant/src/main/java/org/owasp/dependencycheck/taskdefs/Purge.java

Lines 131 to 141 in 734ab4f

	private void muteNoisyLoggers() {
	// Mirrors the configuration within cli/src/main/resources/logback.xml
	final List<String> noisyLoggers = List.of(
	"org.apache.lucene",
	"org.apache.commons.jcs3",
	"org.apache.hc"
	);
	for (String loggerName : noisyLoggers) {
	System.setProperty("org.slf4j.simpleLogger.log." + loggerName, "error");
	}
	}

CLI:

Assumes use of Logback (which ODC controls):

DependencyCheck/cli/src/main/resources/logback.xml

Lines 13 to 16 in 734ab4f

	<!-- Mirrored by configuration in muteNoisyLoggers() in plugins -->
	<logger name="org.apache.lucene" level="ERROR" />
	<logger name="org.apache.commons.jcs3" level="ERROR" />
	<logger name="org.apache.hc" level="ERROR" />