Thanks @GangWar , we run patch for log4j provided at https://github.com/cloudera/cloudera-scripts-for-log4j However, how can we verify our env is out from log4j risk? is there some java classes we should verify inside? Per what we see: 1. log4shell-backup directory is empty 2. log4j V1 jars are not removed e.g. [root@host cloudera-scripts-for-log4j]# cat output_run_log4j_patcher.hVIY8n Using tmp directory '/tmp' Removing JNDI from jar files Running on '/opt/cloudera' Backing up files to '/opt/cloudera/log4shell-backup' Completed removing JNDI from jar files Completed removing JNDI from nar files Removing JNDI from tar.gz files Found an HDFS namenode on this host, removing JNDI from HDFS tar.gz files for platform='common' Keytab file is not found or is empty: /var/run/cloudera-scm-agent/process/153-hdfs-NAMENODE/hdfs.keytab. Considering this as a non-secure cluster deployment. Tar ball is not available in /user/tez/*. tez is not installed. Keytab file is not found or is empty: /var/run/cloudera-scm-agent/process/153-hdfs-NAMENODE/hdfs.keytab. Considering this as a non-secure cluster deployment. Tar ball is not available in /user/yarn/mapreduce/mr-framework/. mr is not installed. [root@host cloudera-scripts-for-log4j]# ll /opt/cloudera/log4shell-backup total 0 [root@host cloudera-scripts-for-log4j]# ll /opt/cloudera/parcels/CDH-5.11.0-1.cdh5.11.0.p0.34/jars/log4j* -rwxr-xr-x 1 root root 481535 Apr 6 2017 /opt/cloudera/parcels/CDH-5.11.0-1.cdh5.11.0.p0.34/jars/log4j-1.2.16.jar -rw-r--r-- 1 root root 489884 Apr 6 2017 /opt/cloudera/parcels/CDH-5.11.0-1.cdh5.11.0.p0.34/jars/log4j-1.2.17.jar [root@host cloudera-scripts-for-log4j]# ll /usr/share/cmf/common_jars/log4j* -rw-r--r-- 1 root root 481535 Apr 12 2017 /usr/share/cmf/common_jars/log4j-1.2.16.jar -rw-r--r-- 1 root root 489884 Mar 30 2017 /usr/share/cmf/common_jars/log4j-1.2.17.jar Thanks
... View more
