Skip to main content
Aidan Whitehall
Inspiring
Oct 21, 2024 12:06 PM UTC
Answered

cftrace throws logged exception when Security Sandbox is enabled

When Security Sandbox is enabled, use of cftrace causes an exception to be logged to exception.log even though the sandbox grants Read & Write permissions the to {cf.instance.root}/logs/* directory whilst using jdk-11.0.24.

 

I'm assuming RollingFileManagerFactory needs some additional permission to roll cftrace.log over into cftrace.%i.log.

 

Does anyone know what additional sandbox permission needs to be granted to allow this? Thank you!

 

 

Error logged to {cf.instance.root}/logs/exception.log:

 

"Error","ajp-nio-127.0.0.1-8020-exec-10","10/21/24","12:44:08","{cf.application.name}","ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@44e1248d] unable to create manager for [{cf.instance.root}\logs\cftrace.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@187a67d1[pattern={cf.instance.root}\logs\cftrace.%i.log, append=true, bufferedIO=true, bufferSize=8192, policy=SizeBasedTriggeringPolicy(size=5120000), strategy=DefaultRolloverStrategy(min=1, max=10, useMax=false), advertiseURI=null, layout="%p{WARN=Warning, DEBUG=Debug, ERROR=Error, TRACE=Trace, INFO=Information, FATAL=Fatal}","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n, filePermissions=null, fileOwner=null]]"
java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@44e1248d] unable to create manager for [{cf.instance.root}\logs\cftrace.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@187a67d1[pattern={cf.instance.root}\logs\cftrace.%i.log, append=true, bufferedIO=true, bufferSize=8192, policy=SizeBasedTriggeringPolicy(size=5120000), strategy=DefaultRolloverStrategy(min=1, max=10, useMax=false), advertiseURI=null, layout="%p{WARN=Warning, DEBUG=Debug, ERROR=Error, TRACE=Trace, INFO=Information, FATAL=Fatal}","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n, filePermissions=null, fileOwner=null]]

This topic is closed to new replies. Start a new post to keep the conversation going.
Aidan WhitehallCorrect answer
Inspiring
Oct 22, 2024 2:59 PM UTC

Hi Priyank

 

Thanks for the offer of help. I'm trying to do some debugging, and am adding CFTRACE lines (there were none previously) so it can be left in production code.

 

As mentioned in the reply to BKBK, it's now working after adding two permission sets. Without both, some form of exception is logged or cftrace.log isn't written to. I'd assumed /logs/* included the directory itself, but perhaps not.

 

Regards

 

Aidan

View reply

5 replies

Priyank Shrivastava.
Priyank Shrivastava.
Inspiring
Oct 22, 2024 1:13 PM UTC

@Aidan Whitehall  Was it working before? Or this is the first time you are trying. I will run a quick test and let you know.

Translate
Thanks, Priyank Shrivastava
Aidan WhitehallAuthorCorrect answer
Inspiring
Oct 22, 2024 2:59 PM UTC

Hi Priyank

 

Thanks for the offer of help. I'm trying to do some debugging, and am adding CFTRACE lines (there were none previously) so it can be left in production code.

 

As mentioned in the reply to BKBK, it's now working after adding two permission sets. Without both, some form of exception is logged or cftrace.log isn't written to. I'd assumed /logs/* included the directory itself, but perhaps not.

 

Regards

 

Aidan

Translate
BKBK
Community Expert
BKBKCommunity Expert
Community Expert
Oct 22, 2024 3:50 PM UTC

Hi Aidan,

 

Thanks for the update and for sharing your experience. Your discovery of this cftrace quirk will certainly help fellow developers.

 

Regards,

 

BKBK

Translate
    BKBK
    Community Expert
    BKBKCommunity Expert
    Community Expert
    Oct 21, 2024 6:48 PM UTC

    Hmm, I am surprised that you get the exception, given that the sandbox has granted Read & Write permissions to the directory {cf.instance.root}/logs/. Did you also enable Debugging in the ColdFusion Administrator? 

    Translate
    Aidan WhitehallAuthor
    Inspiring
    Oct 22, 2024 2:34 PM UTC

    Yes, if by that you mean Enable Request Debugging Output.

     

    By trial and error, it appears that two permission sets are required for this to work:

     

    • {cf.instance.root}/logs/*   has    Read,Write
    • {cf.instance.root}/logs/     has    Read,Write

     

    I'd assumed that {cf.instance.root}/logs/* included files and the directory iteself, but perhaps not. Certainly without it, a read permission error is being written to exception.log.

     

    With both permissions sets above, cftrace output appears in the page and is logged to cftrace.log when Security Sandbox is enabled.

     

    It may be that Delete is required for the files to be rolled over into an archive, but am unsure on that as yet.

     

    Thanks for your assistance, BKBK!

    Translate
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices