What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In a 2012 WebLogic Portal incident, a classloader and library refactor caused application logging calls to converge on shared Log4j 1.2.15 objects. Under production concurrency, hundreds of request threads became blocked in Log4j’s synchronized appender path. The reported trigger was not a traffic spike or a logging-level increase; it was the change in how logging libraries were loaded and shared.
What happened in the WebLogic Portal incident?
Pierre Hugues Charbonneau published the case study on September 30, 2012; the page records an update on October 22, 2012. It describes a production WebLogic Portal 10.0 environment running Solaris 10, Oracle/Sun HotSpot JVM 1.5, Apache Log4j 1.2.15, and Oracle 10g. The investigation used Quest Foglight for Java alerts and JVM thread dumps. Charbonneau’s case study is the source for the incident details and figures below.
After a deployment involving content and Java-library changes, the team saw severe performance degradation, a surge in WebLogic threads to as many as 400, and client requests waiting for service. The report says investigators found no increase in traffic. Restarting did not stop the problem from recurring immediately, while rolling back the deployment resolved the observed issue. These are the author’s observations from this particular environment, not independently reproduced measurements or a general WebLogic thread limit.
What did the thread dumps show?
The author reports that 250 stuck threads shared a call path through org.apache.log4j.Category.callAppenders. They were waiting to enter a monitor identified as an org.apache.log4j.spi.RootCategory. The request-processing stacks showed WebLogic threads logging debug information; the path continued through Commons Logging’s Log4J adapter and Beehive/WebLogic page-flow request handling.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
The key diagnostic clue was not simply that Log4j appeared in a stack. It was the same blocked location and named monitor recurring across many threads. Charbonneau’s article reviews the Log4j 1.2.15 implementation of Category.callAppenders, which synchronizes on a Category while checking and appending events. In this incident, that synchronized access was associated with severe contention under concurrent load. The report describes a large group of blocked request threads and degraded service; it does not establish that calling this method inevitably causes a deadlock in every application.
Why did the refactor expose contention?
Charbonneau describes the cause as a “perfect storm”: the deployment changed classloader delegation and, with it, which Log4j objects concurrent calls shared.
- Before the refactor: Log4j libraries remained in the child classloader, with a child-first policy. The author says WebLogic Beehive Log4j calls and web-application logging events were split across separate classloader copies of Log4j.
- After the refactor: Some Log4j libraries were removed from the child classloader and the associated child-first policy was removed. Commons Logging and Log4j delegation moved to the parent classloader.
- Under production concurrency: Calls that had been separated converged on parent-loaded Log4j objects. More concurrent activity therefore reached shared Category instances and their synchronized appender path.
The author attributes the production failure to the interaction of this deployment change, increased concurrency on shared logging objects, and Log4j 1.2.15’s Category synchronization. The report says a traffic increase and a logging-level increase were checked and ruled out as explanations. A library or classloader refactor can thus alter runtime sharing behavior even when the application’s visible logging calls have not changed.
How did the team respond?
The case study reports two immediate mitigations, with operational effects rather than a controlled comparison:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- Roll back the refactor. This restored the arrangement in which Log4j calls were split between parent and child classloaders, and the rollback resolved the observed issue.
- Lower selected appenders from DEBUG to WARNING. This reduced logging activity as an additional mitigation; the case study does not quantify its independent effect.
Charbonneau wrote, “A future upgrade to Apache Log4j 2 (or other logging API’s) will also be explored”. That was a stated future plan, not a confirmed upgrade or a demonstrated fix. In particular, upgrading by itself would not establish that a classloader delegation problem had been corrected.
How to investigate a similar blocked-thread pattern
The following sequence is a practical synthesis of the reported investigation, not a formal checklist prescribed by the author. Capture evidence before making changes where the service impact allows it; comparing repeated dumps is more informative than relying on one snapshot.
- Correlate symptoms with deployments. Compare the start of the slowdown with releases, library changes, classloader policy changes, and configuration updates. Record whether a rollback changes the symptoms.
- Establish operational impact. Check thread counts, request queues or pending client requests, and service performance. Treat a reported count as specific to the affected system, not a platform-wide limit.
- Collect several JVM thread dumps. Look for repeated blocked stacks, the same call site, and the monitor each thread is waiting to enter. If available, identify the lock owner as well as the waiting threads.
- Trace the full call path. Follow logging facade calls, such as Commons Logging, back into the framework and request-handling code. Determine whether many request threads reach the same logger or appender path.
- Inspect classloader and library layout. Compare parent and child delegation policies and where logging libraries are loaded. Check whether a deployment changed the number or identity of Log4j copies and whether calls now share logger objects.
- Test one mitigation at a time. Where operationally safe, compare rollback or a targeted logging-configuration change against the blocked-thread pattern and service impact. Measure whether the repeated wait location changes rather than assuming that a configuration edit fixed the cause.
How does this differ from later Log4j 2 deadlock fixes?
This case concerns Log4j 1.2.15, WebLogic classloader delegation, and contention on shared Category objects. Later Log4j 2 documentation describes distinct asynchronous-logging scenarios. The Apache Log4j release notes list separate fixes involving recursive logging when an asynchronous queue is full and logging from toString methods with AsyncLogger. The Log4j 2.12 AsyncLogger source documentation shows a recursion-depth check that directly invokes an appender in the recursive/full-queue case to prevent deadlock.
Those version-specific mechanisms are not evidence that the same failure occurred in Charbonneau’s WebLogic incident. A separate Dialogic installation guide says its connector was built using Log4j 2 because of a known Log4j version 1 thread-deadlock issue. That vendor-specific rationale is useful context, but it is not a root-cause analysis of this case and does not show that upgrading alone resolves classloader delegation problems.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
