I was pretty horrified to learn that log4j makes network calls, was even surprised to hear it parses log strings. Fortunately our log4j was too old and JVM too

I was pretty horrified to learn that log4j makes network calls, was even surprised to hear it parses log strings. Fortunately our log4j was too old and JVM too young to be vulnerable to the first exploit, but it seemed best to rip out log4j and replace it with something simpler anyway. java.util.logging seemed the obvious choice, but the API is different, so would have been a lot of s/debug/fine and so on. In the end, we: - wrote a new class with the same 'api' as the part of log4j that we use - globally replaced 'import org.apache.log4j.Logger' with our new class - fixed any compile errors by adding new methods to our class - wrote a test to make sure it rolled correctly and could handle lots of threads etc. Here's the code if you want to do something similar (don't know how long it will be accessible from there): <https://ideone.com/XKg5M9 https://ideone.com/XKg5M9>