That would help but it isn't enough. You can still load classes from your class path, and then those would make the calls instead. And log4j does have valid rea

That would help but it isn't enough. You can still load classes from your class path, and then those would make the calls instead. And log4j does have valid reasons to read/write to files, naturally. But yes, I think a major issue here is a logging library packaging its own meta language that can trigger side effects.