You can configure Log4j2 LogEventConverter plugin for masking personal/confidential/SPI data. For example here we are masking credit card number, SSN and CVV of log statements.
Below Log4j2 dependencies you need to add with your application.
Pre-Requisite
Log4j2 Dependency
pom.xml entry
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.6.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.6.1</version>
</dependency>
Log4j2.xml Configuration File
Below is basic console based configuration for masking where packages used for where loggers need to apply and masking plugin annotation as in below program. In PatternLayout used key as spi which is map with plugin which will mask log text and print as message.
<?xml version="1.0" encoding="UTF-8"?>
<configuration xmlns="http://logging.apache.org/log4j/2.0/config"
status="OFF" packages="com.mask.logs">
<Appenders>
<Console name="STDOUT" target="SYSTEM_OUT">
<PatternLayout pattern="%d{yyyyMMdd HH:mm:ss.SSS} [%t] %-5level %logger{36} - %spi%n"/>
</Console>
</Appenders>
<loggers>
<Logger name="org.apache.log4j.xml" level="all" />
<root level="all">
<appender-ref ref="STDOUT" level="TRACE" />
</root>
</loggers>
</configuration>
To know more about log4j2 configuration follow below link:
Log4j2 Java Logging Example Tutorial – XML Configuration, Severity Levels, Formatting and Appenders
Log4j2 Plugin Code for Masking
Created this LogMakingConverter Plug in for masking logs statement
Here masking for Credit card number, CVV and SSN . You can also implement for password and rest depend on your application needs. Here we have used Java regular expression Mater and Pattern apis for maskin and also different character as +++ for CVV,********* for SSN and **************** for credit card by matching number of digits in log lines.
package com.mask.logs;
/**
* Created this LogMakingConverter Plug in for masking logs statement
* Here masking for Credit card number, CVV and SSN .
* You can also implement for password and rest depend on your application needs.
*/
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import org.apache.logging.log4j.core.LogEvent;
import org.apache.logging.log4j.core.config.plugins.Plugin;
import org.apache.logging.log4j.core.pattern.ConverterKeys;
import org.apache.logging.log4j.core.pattern.LogEventPatternConverter;
@Plugin(name="LogMaskingConverter", category = "Converter")
@ConverterKeys({"spi","trscId"})
public class LogMaskingConverter extends LogEventPatternConverter{
private static final String CREDIT_CARD_REGEX = "([0-9]{16})";;
private static final Pattern CREDIT_CARD_PATTERN = Pattern.compile(CREDIT_CARD_REGEX);
private static final String CAREDIT_CARD_REPLACEMENT_REGEX = "XXXXXXXXXXXXXXXX";
private static final String CVV_REGEX = "([0-9]{3})";
private static final Pattern CVV_PATTERN = Pattern.compile(CVV_REGEX);
private static final String CVV_REPLACEMENT_REGEX = "+++";
private static final String SSN_REGEX = "([0-9]{9})";
private static final Pattern SSN_PATTERN = Pattern.compile(SSN_REGEX);
private static final String SSN_REPLACEMENT_REGEX = "*********";
protected LogMaskingConverter(String name, String style) {
super(name, style);
}
public static LogMaskingConverter newInstance(String[] options) {
return new LogMaskingConverter("spi",Thread.currentThread().getName());
}
@Override
public void format(LogEvent event, StringBuilder outputMessage) {
String message = event.getMessage().getFormattedMessage();
String maskedMessage = message;
try {
maskedMessage = mask(message);
} catch (Exception e) {
System.out.println("Failed While Masking");
maskedMessage = message;
}
outputMessage.append(maskedMessage);
}
private String mask(String message) {
Matcher matcher =null;
StringBuffer buffer = new StringBuffer();
matcher = CREDIT_CARD_PATTERN.matcher(message);
maskMatcher(matcher, buffer,CAREDIT_CARD_REPLACEMENT_REGEX);
message=buffer.toString();
buffer.setLength(0);
matcher = SSN_PATTERN.matcher(message);
maskMatcher(matcher, buffer,SSN_REPLACEMENT_REGEX);
message=buffer.toString();
buffer.setLength(0);
matcher = CVV_PATTERN.matcher(message);
maskMatcher(matcher, buffer,CVV_REPLACEMENT_REGEX);
return buffer.toString();
}
private StringBuffer maskMatcher(Matcher matcher, StringBuffer buffer, String maskStr)
{
while (matcher.find()) {
matcher.appendReplacement(buffer,maskStr);
}
matcher.appendTail(buffer);
return buffer;
}
}
Masking Test Program
Below is test program to print some log statements which are converting by Log4j2.
package com.mask.logs;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
public class MaskingTest {
private static final Logger logger = LogManager.getLogger(MaskingTest.class);
public static void myTest(){
logger.info("this is my info message");
logger.debug("This is debug message");
logger.debug("Passed to server::0084USER:17603,IP:0:0:0:0:0:0:0:1,3425,Credit Card 1:1000002367844224,3425,Credit Card2:1000002367844224 , CVV:234,SSN:123456789");
}
public static void main(String[] args) {
myTest();
}
}
Output
Below is mask logs by log4j2 for confidential/personal/spi data.
20180607 11:20:43.558 [main] INFO com.mask.logs.MaskingTest - this is my info message 20180607 11:20:43.559 [main] DEBUG com.mask.logs.MaskingTest - This is debug message 20180607 11:20:43.560 [main] DEBUG com.mask.logs.MaskingTest - Passed to server::+++4USER:+++03,IP:0:0:0:0:0:0:0:1,+++5,Credit Card 1:XXXXXXXXXXXXXXXX,+++5,Credit Card2:XXXXXXXXXXXXXXXX , CVV:+++,SSN: *********
Summary
- Step by step program for masking sensitive information in logs.
- Log4j2 XML Configuration for loggers and appenders for masking.
- LogMaskingConverter Log4j2 plugin for masking log statements.
- Regular expression for Creditcard, SSN and CVV.
- Test program to write logs by java logging api to write in logs file.
More
Below are some more masking ways for different type of data like XML, JSON and printing objects before logging , sending to page or transferring over network.
How to MASK XML Confidential/Personal Data : JAVA
How to Mask JSON Confidential/Personal Information in logs :JAVA
How to mask JAVA Object confidential/personal information in logs while Printing
