Hello,

I am working on remediating old versions of Apache Log4j from my company’s AnalyticsPlus installations.  We have upgraded AnalyticsPlus over time from build 4600 to 5210 over about 13 upgrade steps.    In our install directory we then have about 13 instances of this directory path where XXXX is each build number: 

C:\ManageEngine\AnalyticsPlus\Patch\ManageEngine_Analytics_Plus-XXXX-SP-0\

Deeper down into these directories many of them have older versions of Apache Log4j:    C:\ManageEngine\AnalyticsPlus\Patch\ManageEngine_Analytics_Plus-5020-SP-0\SERVER\lib\log4j-1.2.17.jar

If the current running version of AnalyticsPlus is using the current version of Log4j, I am looking to get rid of the old versions of Log4j, even if they are not actively being used any more.

My questions are:

1. Does AnalyticsPlus need/depend on files in these older patch directories I mentioned above if they are from older builds?
2. If we’re on build 5210 which appears to be using current Log4j version 2.1.17, can the older instances of the Log4j libraries in folders for older builds safely be renamed or deleted without affecting our current version of AnalyticsPlus?
3. Any other advice or suggestions on removing old log4j from this specific ManageEngine product?

Thanks.