Merge pull request #688 from wazuh/684-log4j

Disable log4j
2021-12-15 15:53:12 +01:00 · 2021-12-15 15:53:12 +01:00 · 2763bb8e0c
commit 2763bb8e0c
parent fd5054cac9 c9dcd763e9
4 changed files with 30 additions and 0 deletions
--- a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml
+++ b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml
@ -63,6 +63,17 @@
  notify: restart elasticsearch
  tags: configure

+- name: Configure disabled log4j.
+  template:
+    src: "templates/disabledlog4j.options.j2"
+    dest: /etc/elasticsearch/jvm.options.d/disabledlog4j.options
+    owner: root
+    group: elasticsearch
+    mode: 2750
+    force: yes
+  notify: restart elasticsearch
+  tags: install
+
 # fix in new PR (ignore_errors)

 - import_tasks: "RMRedHat.yml"
--- a/roles/elastic-stack/ansible-elasticsearch/templates/disabledlog4j.options.j2
+++ b/roles/elastic-stack/ansible-elasticsearch/templates/disabledlog4j.options.j2
@ -0,0 +1,4 @@
+## JVM configuration
+
+## Disable log4j
+-Dlog4j2.formatMsgNoLookups=true
--- a/roles/opendistro/opendistro-elasticsearch/tasks/main.yml
+++ b/roles/opendistro/opendistro-elasticsearch/tasks/main.yml
@ -55,6 +55,17 @@
      notify: restart elasticsearch
      tags: install

+    - name: Configure disabled log4j.
+      template:
+        src: "templates/disabledlog4j.options.j2"
+        dest: /etc/elasticsearch/jvm.options.d/disabledlog4j.options
+        owner: root
+        group: elasticsearch
+        mode: 2750
+        force: yes
+      notify: restart elasticsearch
+      tags: install
+
    - name: Ensure extra time for Elasticsearch to start on reboots
      lineinfile:
        path: /usr/lib/systemd/system/elasticsearch.service
--- a/roles/opendistro/opendistro-elasticsearch/templates/disabledlog4j.options.j2
+++ b/roles/opendistro/opendistro-elasticsearch/templates/disabledlog4j.options.j2
@ -0,0 +1,4 @@
+## JVM configuration
+
+## Disable log4j
+-Dlog4j2.formatMsgNoLookups=true