The log4j software was donated to the Apache Software foundation by QOS.CH in the year 2000, over 20 years ago. We maintained the log4j 1.x framework from 2000 until 2006. In the meantime, we founded the Apache Logging top-level project and served as its first PMC chair.

In 2006, we founded the SLF4J and logback projects and continue to maintain them until this day. Cumulatively, the artifacts of these two projects are downloaded over 4 billion times per year. Given the sheer volume of users, maintaining the SLF4J and logback projects can be rather time consuming.

In 2022, we started the reload4j project with the goal of fixing critical security issues in log4j 1.x.

We wish to continue providing the most reliable, fast and flexible logging framework for Java developers. We thank our current sponsors who help us with our mission and welcome the support of new sponsors.

Prevalence of logging frameworks

Regarding the log4shell vulnerability, the prevalence of various java logging libraries puts things into perspective. Here are the relevant figures as found in mvnrepository site on 2021-12-17.

Notwithstanding its 48% prevalence overall (in the implementation category), no attacks have been reported against logback that we are aware of.