IBM webMethods Hybrid Integration

IBM webMethods Hybrid Integration

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.



#Automation


#Applicationintegration
#webMethods
#Integration
 View Only
  • 1.  Packages NOT RECOMMENDED: WxLog Framework

    Posted 04/30/26 06:00 AM
    Edited by Gerardo Lisboa 04/30/26 06:09 AM

    Hello,

    Having noticed the following blog The Evolution of WxLog: Enhanced with ECS for Modern Log Management (2026-04-28) I'm hereby alerting any unaware reader _not_ to use it.

    My comment in the blog:

    Not recommending.

    As I stated in the issue GitHub repository issue #1 the inclusion of jar files of undisclosed origin, with similar or equal functionality of built-in services, is a red flag for unmanageable code and a security risk.

    This seems to be just another project (even if long lived) which only duplicates existing services, with a potential detrimental impact in performance.



    And, besides that, another maintenance cost, as now the system administration must keep tracking the jar files for vulnerabilities and compatibilities.


    Please prove me wrong.

    Until then, I would not recommend adding this code in any customer, except in secure and isolated testing laboratories.

    This is not a problem only with this particular project, I've already witnessed systems whose performance is severely hampered by extra logging requirements, of no technical or business use, duplicating or bypassing entirely the built-in logging capabilities of the platform.

    Please be careful with your server.



    ------------------------------
    Gerardo Lisboa
    CEO
    INFO-CARE consulting
    Lisbon
    ------------------------------



  • 2.  RE: Packages NOT RECOMMENDED: WxLog Framework

    Posted 04/30/26 08:16 AM

    As the author of the original WxLog package (which is not open-source to the best of my knowledge) it seems an ill-advised idea to publish an incompatible package under the same name.

    It comes with the risk of at least confusing customers and potentially even causing production issues.

    Now to the criticism of shipping duplicate jars. That is indeed a bad idea, if the jars are truly duplicates. On the other hand there is the aspect of versions. Given that at least historically Integration Server has often lagged behind with updating external jars (like Log4j2 or various Apache Commons libraries) it may indeed be the safer way to ship your own stuff and activate the package class loader for that package.

    But I agree that shipping jars in the `./code/jars/static/` dir is something to be very careful with, given that those classes end up in the global server class loader.

    Lastly, I am "surprised" by this claim on GitHub:

    The WxLog framework has been serving as a reliable logging utility for webMethods Integration Server for several years. In its latest iteration, the framework has been significantly enhanced to meet modern observability requirements by incorporating Elastic Common Schema (ECS) compliance.

    It is indeed correct that a package under the name WxLog has been used in production by several high-profile customers for more than 10 years (again, I am the author of this).

    But it has nothing to do with this project on GitHub. The latter is obviously a fresh implementation, that even has auto-generated comments in catch blocks. Together with the fact that the code repo (as of this writing) only contains 5 commits makes me weary about its maturity.

    As much as I try to not go negative in forums and social media, I make an exception here and join @Gerardo Lisboa in his verdict: This package is not production ready.

    It may well serve as a code sample, although in this case I would be selfish enough to recommend my own (https://github.com/JahnTech/webmethods-is-log4jdemo).



    ------------------------------
    All the best,
    Christoph
    ------------------------------



  • 3.  RE: Packages NOT RECOMMENDED: WxLog Framework

    Posted 04/30/26 09:34 AM

    Thank you @Christoph Jahn for your advice.

    As for the example you brought forward, Log4j Demo for Integration Server, it has the precise approach I was telling: don't bundle jars duplicate of the already provided in webMethods, access the existing classes in the platform in the normal Java way.

    Best regards



    ------------------------------
    Gerardo Lisboa
    CEO
    INFO-CARE consulting
    Lisbon
    ------------------------------



  • 4.  RE: Packages NOT RECOMMENDED: WxLog Framework

    Posted 04/30/26 10:53 AM
    Hi Christoph,
    This is the same package that was already in place; it was likely updated over time to include the latest JAR files. The most recent version added here is simply an extension to support ECS. Regarding the included JARs, I will look into and address that separately.


    ------------------------------
    Natarajan Ramachandran
    ------------------------------



  • 5.  RE: Packages NOT RECOMMENDED: WxLog Framework

    Posted 04/30/26 10:44 AM
    Hi Gerardo Lisboa,
     
    Thank you for taking the time to review the WxLog Framework and for raising these important concerns,
     
    I will try to address each point,
     
    1. Regarding JAR Files of "Undisclosed Origin"
        
        log4j* -- part of Apache log4j2, widely adopted and actively maintained with regular security updates
        
        disruptor* -- high-performance library, as per my knowledge, it is used by major financial institutions for low-latency
        
        ecs* -- part of elastic
     
      All are regularly scanned for vulnerabilities
     
    2. Regarding "Similar or Equal Functionality of Built-in Services"
     
       Server.log - Basic operational logging, not designed for application-level structured logging
       audit logging - heavyweight
       
       no native support for JSON logging, ECS, MDC etc.
     
    3. Regarding Performance Impact
     
       async logging via LMAX disruptor -- non-blocking, sub microsecond latency
       lazy evauation - log messages constructed only if level is enabled
     
     
    4. Regarding the maintenance,  
        
       this is a legitimate operational concern, it should be addressed, I have seen the issue you raised in GitHub, will definitely fix this.


    ------------------------------
    Natarajan Ramachandran
    ------------------------------



  • 6.  RE: Packages NOT RECOMMENDED: WxLog Framework

    Posted 04/30/26 10:48 AM
    I have been using WxLog for many years, and the recent update is simply an extension integrating ECS. From a performance standpoint, I have personally not encountered any issues so far.


    ------------------------------
    Natarajan Ramachandran
    ------------------------------