From source:
go install github.com/juergenhoetzel/log4j2go/cmd/log4j2go@latestCI build Binaries for Windows, Linux and Darwin: Releases · juergenhoetzel/log4j2go · GitHub.
Recursively scan filesystem
log4j2go ~/ghq/github.com2021/12/18 15:45:17 Found log4j-core-2.12.2 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/false-hits/log4j-core-2.12.2.jar"
2021/12/18 15:45:17 Found log4j-core-2.16.0 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/false-hits/log4j-core-2.16.0.jar"
2021/12/18 15:45:17 Found log4j-core-2.0-beta2 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/old-hits/log4j-core-2.0-beta2.jar"
2021/12/18 15:45:17 Found log4j-core-2.0-beta9 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/log4j-core-2.0-beta9.jar"
2021/12/18 15:45:17 Found log4j-core-2.10.0 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/log4j-core-2.10.0.jar"
2021/12/18 15:45:17 Found log4j-core-2.15.0 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/log4j-core-2.15.0.jar"
2021/12/18 15:45:17 Found log4j-core-2.9.1 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/log4j-core-2.9.1.jar"
2021/12/18 15:45:17 Found log4j-core-2.14.1 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/shaded/clt-1.0-SNAPSHOT.jar"
2021/12/18 15:45:17 Found log4j-core-2.10.0 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.ear!/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.ear!WEB-INF/lib/log4j-core-2.10.0.jar"
2021/12/18 15:45:17 Found log4j-core-2.10.0 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.jar!/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.jar!WEB-INF/lib/log4j-core-2.10.0.jar"
2021/12/18 15:45:18 Found log4j-core-2.10.0 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.war!/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.war!WEB-INF/lib/log4j-core-2.10.0.jar"
2021/12/18 15:45:18 Found log4j-core-2.5 in "/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/uber/infinispan-embedded-query-8.2.12.Final.jar"
Recursively scan root filesystem but don’t descent in mountpoints
log4j2go -samefs /Log4j-Detector
time java -jar ~/ghq/github.com/mergebase/log4j-detector/target/log4j-detector-2021.12.17.jar ~/ghq/github.com/
real 0m14,160s
user 0m12,335s
sys 0m4,395s
Log4j2go
time log4j2go ~/ghq/github.com/
real 0m2,844s
user 0m2,738s
sys 0m3,553s
log4j2go recursively scans the filesystem for ear, war and
jar files. It first checks for log4j-core/pom.xml metadata to
get the version number.
If there is no log4j-core/pom.xml file it compares the ZIP
content for well-known Log4J2 filenames (org/apache/logging/log4j/core prefix) which
content matches the hashes from the Maven Central artefacts. Each
file is also scanned recursively if it contains jar files.