No divider between base file name and timestamp in the name of rotated access log

[zhangjiangqige]

Describe the bug

Hello, currently with the following access log configuration

quarkus.http.access-log.enabled=true
quarkus.http.access-log.log-to-file=true
quarkus.http.access-log.base-file-name=access

when rotation of the access log happens, rotated log files would have a name like access2025-01-31.log

Expected behavior

Rotated files have name like access.2025-01-31.log

Actual behavior

Rotated files have name like access2025-01-31.log

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @dmlloyd (logging)

[Pankraz76]

this seems to be the field.

quarkus/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/AccessLogConfig.java

Line 45 in 4e66327

String baseFileName();

where to find the implementation? @geoand

adding workaround on caller method seems not to be sustainable:

quarkus/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/VertxHttpRecorder.java

Line 498 in 4e66327

receiver = new DefaultAccessLogReceiver(executor, outputDir, accessLog.baseFileName(), accessLog.logSuffix(),

[dmlloyd]

Why would you not make the base name be access.? Oh I see, the other parts of the config prepend a dot, but not this one.

[zhangjiangqige]

I did try using access. as base name and that made the original log file named access..log, even though the rotated file name is indeed access.2025-01-31.log but I think access..log is more miserable 😢

[Pankraz76]

Issue Summary and Feedback

Submitted a fix, but the issue was closed as unresolvable without first addressing significant technical debt. The affected class contains far more than 50% dead or incorrect code.

Relevant links:

• maintenance burden #48471
• Fix divider in rotated access log for DefaultAccessLogReceiver #48398
• Drop unused members of DefaultAccessLogReceiver #48449

Migration Consideration: Spring

Given Quarkus's current limitations, migrating to Spring may be worthwhile, as it benefits from a decade more maturity—especially in security.

Security Comparison

Spring has a dedicated security subproject with extensive documentation, while Quarkus offers only a single guide—suggesting a disparity in prioritization.

Production Challenges

We faced these shortcomings directly during our Quarkus deployment:

• Lack of javax.security support caused critical issues, with no timely resolution (PanacheEntityResource not propagating javax.annotation.security #28995).
• As a workaround, we replaced all Panache repositories with manual boilerplate due to delayed security patches.
• Reference: https://quarkus.io/guides/security-architecture

[maxandersen]

@Pankraz76 you are pointing to #28995 which shows issues reported Nov 2,2022 - where you report a security issue in public github rather than using the documented way of opening security issues - it is fixed the same day - was backported Nov 3, 2022.

Since that time the Quarkus Security guides greatly expanded - your link to security-architecture guide has tons of information linked of it.

Here is a screenshot to call it out explicitly:

Similar if you go to our main guide page and look in security catagory: https://quarkus.io/guides/#categories=security

You'll find lots of info:

If you are trying to make a point that we are not taking security seriously, you are really failing hard at it.

[Pankraz76]

it was not released with next patch or hotfix, which i expected for security, but with next bigger version, meaning major or feature, idk, which took longer then the regular 3 weeks cycle back then.

This was the reason, we did not rely on (quarkus) release but fix it ourself, reimplementing the panache auto generated endpoints.

[Pankraz76]

Assuming Closed on: Dec 19, 2022, 5:04 PM GMT+1 took only 6 weeks to release security.

Fix in repo does not matter, need fix on server in production.

Dont want to hate, quarkus and the community giving their very best.

Very dedicated as well. Its simply never enough.

[maxandersen]

@Pankraz76 it was released in main snapshots that night. Available in 2.14.1 release Nov 16.

We also backported it in 2.13 when we felt it been tested and could be backported in a timely manner.

We backported as things came in as fast as we could.

All for free.

Since that time we set up LTS releases because feedback from users and customers was that a more regular cadence should happen.

That is in place now in Quarkus 3 stream.

Please stop spreading FUD.