Skip to main content
A
Aidan Whitehall
Inspiring
October 21, 2024
Answered

cftrace throws logged exception when Security Sandbox is enabled

  • October 21, 2024
  • 2 replies
  • 676 views

When Security Sandbox is enabled, use of cftrace causes an exception to be logged to exception.log even though the sandbox grants Read & Write permissions the to {cf.instance.root}/logs/* directory whilst using jdk-11.0.24.

 

I'm assuming RollingFileManagerFactory needs some additional permission to roll cftrace.log over into cftrace.%i.log.

 

Does anyone know what additional sandbox permission needs to be granted to allow this? Thank you!

 

 

Error logged to {cf.instance.root}/logs/exception.log:

 

"Error","ajp-nio-127.0.0.1-8020-exec-10","10/21/24","12:44:08","{cf.application.name}","ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@44e1248d] unable to create manager for [{cf.instance.root}\logs\cftrace.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@187a67d1[pattern={cf.instance.root}\logs\cftrace.%i.log, append=true, bufferedIO=true, bufferSize=8192, policy=SizeBasedTriggeringPolicy(size=5120000), strategy=DefaultRolloverStrategy(min=1, max=10, useMax=false), advertiseURI=null, layout="%p{WARN=Warning, DEBUG=Debug, ERROR=Error, TRACE=Trace, INFO=Information, FATAL=Fatal}","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n, filePermissions=null, fileOwner=null]]"
java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@44e1248d] unable to create manager for [{cf.instance.root}\logs\cftrace.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@187a67d1[pattern={cf.instance.root}\logs\cftrace.%i.log, append=true, bufferedIO=true, bufferSize=8192, policy=SizeBasedTriggeringPolicy(size=5120000), strategy=DefaultRolloverStrategy(min=1, max=10, useMax=false), advertiseURI=null, layout="%p{WARN=Warning, DEBUG=Debug, ERROR=Error, TRACE=Trace, INFO=Information, FATAL=Fatal}","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n, filePermissions=null, fileOwner=null]]

This topic has been closed for replies.
Correct answer Aidan Whitehall

Hi Priyank

 

Thanks for the offer of help. I'm trying to do some debugging, and am adding CFTRACE lines (there were none previously) so it can be left in production code.

 

As mentioned in the reply to BKBK, it's now working after adding two permission sets. Without both, some form of exception is logged or cftrace.log isn't written to. I'd assumed /logs/* included the directory itself, but perhaps not.

 

Regards

 

Aidan

2 replies

Priyank Shrivastava.
Community Manager
Priyank Shrivastava.Community Manager
Community Manager
October 22, 2024

@Aidan Whitehall  Was it working before? Or this is the first time you are trying. I will run a quick test and let you know.

Thanks, Priyank Shrivastava
A
Aidan WhitehallAuthorCorrect answer
Inspiring
October 22, 2024

Hi Priyank

 

Thanks for the offer of help. I'm trying to do some debugging, and am adding CFTRACE lines (there were none previously) so it can be left in production code.

 

As mentioned in the reply to BKBK, it's now working after adding two permission sets. Without both, some form of exception is logged or cftrace.log isn't written to. I'd assumed /logs/* included the directory itself, but perhaps not.

 

Regards

 

Aidan

BKBK
Community Expert
BKBKCommunity Expert
Community Expert
October 22, 2024

Hi Aidan,

 

Thanks for the update and for sharing your experience. Your discovery of this cftrace quirk will certainly help fellow developers.

 

Regards,

 

BKBK

    BKBK
    Community Expert
    BKBKCommunity Expert
    Community Expert
    October 21, 2024

    Hmm, I am surprised that you get the exception, given that the sandbox has granted Read & Write permissions to the directory {cf.instance.root}/logs/. Did you also enable Debugging in the ColdFusion Administrator? 

    A
    Aidan WhitehallAuthor
    Inspiring
    October 22, 2024

    Yes, if by that you mean Enable Request Debugging Output.

     

    By trial and error, it appears that two permission sets are required for this to work:

     

    • {cf.instance.root}/logs/*   has    Read,Write
    • {cf.instance.root}/logs/     has    Read,Write

     

    I'd assumed that {cf.instance.root}/logs/* included files and the directory iteself, but perhaps not. Certainly without it, a read permission error is being written to exception.log.

     

    With both permissions sets above, cftrace output appears in the page and is logged to cftrace.log when Security Sandbox is enabled.

     

    It may be that Delete is required for the files to be rolled over into an archive, but am unsure on that as yet.

     

    Thanks for your assistance, BKBK!

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices