[Looking for Charlie's main web site?]

Restoring the CF Admin logviewer removed in Oct 2022 CF updates, at your own risk

As of the Oct 2022 CF updates (CF2021 update 5 and CF2018 update 15), Adobe has chosen to remove the CF Admin feature to view, search, download, and delete CF logs, due to asserted (but as-yet undocumented) security concerns.

What if you want it back? In this post, I explain what changed, why, and how to get the functionality back--albeit at your own risk. For more, read on.

(As for these Oct '22 CF updates, there are still other issues beyond the scope of this one discussed here. This is not a post about those other issues. Until I may do one, see the Adobe cf community forum announcement of the updates and cf portal announcement, and discussions that ensued at each.)

Why you may not agree with the removal

While some folks never use the CF Admin's logviewer feature (at "Debugging & Logging">"Log Files"), others DO rely on it, whether because they can't easily access the CF logs another way, or they just prefer this approach over other alternatives.

As for the asserted "security concern", some may retort that the CF admin is by default password-protected and more important accessible only via CF's built-in web server (at its non-standard port, which defaults to 8500), so they may feel that this removal (without any choice) was heavy-handed.

And in many forum threads and other social media, people are asking over and over how to get the log viewing capability back. While it won't interest some at all, and others will think it borders on being irresponsible to recover this functionality, I just can't help wanting to at least share these observations, and the "old" code and how to use it--with due warning of the risk.

How the change was implemented

I've studied the changes as of this update, and determined that Adobe has changed two folders controlling this functionality ("logging" and "logviewer"), and I offer the "old" versions of those here for you.

Curiously, the Oct 2022 updates do NOT backup the old version of the code in these folders, in the update's "backup" folder within the hf-updates directory. Normally, the updates DO otherwise make copies of whatever files/folders they change/remove.

Instead, I captured the version of these folders BEFORE applying the update, and I offer them in this zip below. Note that I offer a version (folder) for each of CF2021 and CF2018, as they do differ and you should use the one appropriate to your CF version.

Recovering the functionality, at your risk

So if you want to regain the previous log viewer, you can replace the "new" folders with these "old" folders, as I discuss below.

Before doing that, note that:

  • You do this at your own risk. Perhaps in time Adobe will make more clear what the security concern is, and it may warrant reverting to their version.
  • Beware that in any next CF update, that would replace these files and folders. CF Updates "lay down" a cumulative replacement of ALL folders and files that were updated in any and all prior CF updates, when doing each update. So if you want to get the log viewing capability back after such an update, you will need to repeat the steps below after each update--at least until Adobe perhaps relents and offers a new, secure way to view the log files.
  • I'm offering things based on how I find them to work in early Nov 2022. Things may change over time. I can't commit to keeping this updated going forward. The information here should suffice for interested folks to follow-up.

How to recover the functionality

As for the steps, do the following for your cfusion instance and/or any other instances you may have (note that ColdFusion Enterprise, Trial, and Developer offer the ability to create multiple instances, which would be shown as a folder with the instance name as a sibling to the cfusion folder):

  1. In your ColdFusion2021 or ColdFusion2018 folder, find the wwwroot\CFIDE\administrator folder within your cfusion or other instance folder(s).
  2. Within that administrator folder, find its logging and logviewer folders.
  3. Copy those two folders to a new location or rename those in the current folder (such as logging_original).
  4. Extract the two folders from the zip, putting them in place where you removed/renamed the existing folders.

(If you prefer to use your own copy of the "older" folders, you certainly can. Just copy them from within the folder in step 1 BEFORE you apply the Oct 2022 updates, 5 for CF2021 and 15 for CF2018.)

Checking the restored functionality

After doing those steps, you're done. There's no need to restart CF.

Simply visit/refresh the "Debugging & Logging>Log Files" page of the CF Admin. You should see now see the few buttons that control the options to "view/search", "download", "delete" buttons that had been removed.

Reverting to the original functionality

If you want to revert back to the original folders (for the sake of security), use the backup you made in my step 3 above.

While you could just rename these "new" folders to something else, an argument could be made that if there are indeed important security concerns with these folders and the "older code" here, it would be wiser to instead remove the folder holding this "older code" that I am offering here, then replace it with those backups I had you make above.

Other CF log viewing mechanisms

Before wrapping up, I should note (as some may want to point out) that there are in fact other ways to view CF logs. Of course, one may be able to remote into (or ssh or map somehow into) the server and access the files in the CF logs folder.

Note also that the original (Eclipse-based) ColdFusion Builder offered a logviewer and TailView features.

As for Adobe's new VS Code-based version of CF Builder, I have not been able to find any such log file viewer in the UI though it's indicated on that extension intro page that it includes one. Perhaps it's coming.

Regardless, the log viewing features in either version of CF Builder would be based on an RDS connection existing and opened to the server, and that's definitely recommended against for production servers, so those may not serve as suitable alternatives to the CF Admin logviewer for many folks.

Conclusion

I was really torn whether to offer these folders, but SO many people are complaining online about needing to be able to view their logs that I felt it was important to show people how easily they could recover this functionality, if they're insistent to do so.

Here again is the zip with the folders (and a readme holding the text of this blog post).

For more content like this from Charlie Arehart: Need more help with problems?
  • If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
  • See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed
Comments
Charlie, great blog post. I have seen/read a lot of the comments on Slack about this and I agree with you. This is a heavy hand on removing with NO EXPLANATION as to why other than 'security issues'.

Anyway, thanks for taking the time and effort to get the folders and write the blog.

Drew Nathanson
After update 5 to my Coldfusion 2021, my FuseGuard program would not work. It complained about log access. Putting 2 and 2 together, I used the old folders you provided, and FuseGuard is working again.

Thank you for this post.
Wow, that's interesting that fuseguard leveraged this also. Thanks, Jeff, and glad to have helped get you in the right direction.

You should definitely report this to Pete. Indeed, I'd not be surprised if he's already got an update for FG that no longer relies on that, and perhaps leverages a new approach.

Oh, and thanks also, Drew, for your previous kind regards. :-)
Thank you for taking the time to provide this solution. I had thought there was a bug causing this issue. After depending on these log files for a variety of purposes over the years it's a pain to have them forcibly removed. At a minimum it seems like we should be able to have the functionality in development environments. More information from Adobe on the security risk specifics would be nice.
# Posted By Chris Simmons | 1/4/23 9:10 AM
Indeed, Chris. And I've asked for more detail but been given none in reply. As such, while I'm still torn about having shared the workaround, we can't know if the problem is dire or not, or when it is or not. :-(
Again, many thanks. I have kind of "ignored" the issue by going and rooting around to find the log files and open them manually. Today though I was in a bind needing to reference logging on a development project over and over and this really helped me out.
# Posted By Chris Simmons | 1/4/23 9:19 AM
Why even have a log section in the CF Admin if you can't view them?
# Posted By Peter | 1/18/23 10:27 AM
Peter, there are a couple of reasons the "log files" page remains in the admin. First, there are still the remaining actions which can be performed against the logs, from the ability to archive any of the listed log files to the ability to enable/disable some of the log files. (I do realize some folks never perform either action, so to them the page may as well not exist.)

Second, the page still a) lists all the files (for those who may not know they exist), and b) shows the size and last update date for each log (which could be of some value in some situations, I suppose).

All that said, clearly I am still of the opinion that there SHOULD be an ability to VIEW the logs. Whatever led them to remove it (still a mystery to me), it seems they should be able to SOLVE it so as to return this functionality.
It is not helpful of Adobe to remove access to the logs from within cf admin. However if they're going to do this they could at least update the UI to tell us the path to the log files so we can navigate there another way.

In case this helps anyone else, on cf 21 they are ColdFusion2021\cfusion\logs

Pretty obvious of course but if your app isn't working and you're in a hurry having this info on the logging page in cf admin could be helpful given the context

HTH
# Posted By Nick Way | 3/17/23 6:06 AM
Good point, Nick. I'd argue the same about the great value if they'd do that also on the Java and jvm page, showing how that info is saved to the jvm.config, and showing its path.

Of course, some might argue that "anyone who administers a cf admin should already know these locations", but it's not true. They could also argue that putting the info here could aid hackers, and I could argue they really DO tend to already know such things! :-)

But I could understand if they're torn about which way to go. I'm not so sure they've really considered it, so again good for you to raise the point. Better if you'd file a feature request, at tracker.adobe.com. :-)
Copyright ©2024 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the html in this page?)

Managed Hosting Services provided by
Managed Dedicated Hosting