CAS Warning On Startup -> Eventually becomes 500 Error

[Michael Santangelo]

Hello all,

Just deployed a CAS 7.3.3 to replace an antiquated 6 due to Duo support ending for it, and got it mostly working.  During startup after running ./gradlew run (only for testing, I plan on pushing it to a Tomcat instance in the future) we are seeing a warning in the console:

WARN The use of package scanning to locate Log4j plugins is deprecated. Please remove the `packages` attribute from your configuration file.

--- Which configuration file is it referring to? The log4j.xml? I am unsure where to begin looking.

More importantly, after leaving CAS running for the weekend I arrived today to see error 500 all over whenever trying to access it:

HTTP Status 500 – Internal Server Error

---

Type Exception Report

Message Filter execution threw an exception

Description The server encountered an unexpected condition that prevented it from fulfilling the request.

Exception

jakarta.servlet.ServletException: Filter execution threw an exception org.apereo.cas.web.support.filters.AddResponseHeadersFilter.doFilter(AddResponseHeadersFilter.java:62)

When I dug into the log files on the server this line kept popping up:

java.lang.classnotfoundexception org.apache.logging.log4j.core.impl.throwableproxy

So I think it's related to whatever log4j issue I'm getting warned about.  I just don't know enough about CAS to find the file that is generating the warning.

Any suggestions where I can look?

Thanks!

[Michael Santangelo]

Also seeing: "Log4j2-TF-1-AsyncLogger[/cas]-1 WARN No log appender could be found for [file] 
Log4j2-TF-1-AsyncLogger[/cas]-1 WARN No log appender could be found for [auditlogfile]" in the console logs.

[Michael Santangelo]

It seemed like every user trying to load the page was getting the error after it happened but a simple restart of CAS fixed it.  I'll see if it happens again. Thanks!  Now to try and figure out how to customize the thing properly.

On Tue, Feb 10, 2026 at 9:39 AM Jeremiah Garmatter <j-gar...@onu.edu> wrote:

I get the same warning on startup with CAS 7.3.0. It doesn't impact my deployment though.

In my experience, the 500 internal server error can be caused by many situations, from opening two SSO tabs at the same time, to a user's IP addressing changing mid-auth. Even leaving a tab on the SSO login page for more than a few hours has caused the problem for our users (often happens over the weekend). Many of the situations that cause the 500 error are correctable by the user, at least in my experience. Simply hitting the page again seems to work most of the time.

--

: Michael A. Santangelo

:: Owner, https://talesofatech.com
:: Primary: (908) 285-8760
:: Rutgers University, Class of 2007 & 2011
:::: B.A. in Mathematics
:::: B.S. in Information Technology

[Jeremiah Garmatter]

I get the same warning on startup with CAS 7.3.0. It doesn't impact my deployment though.

In my experience, the 500 internal server error can be caused by many situations, from opening two SSO tabs at the same time, to a user's IP addressing changing mid-auth. Even leaving a tab on the SSO login page for more than a few hours has caused the problem for our users (often happens over the weekend). Many of the situations that cause the 500 error are correctable by the user, at least in my experience. Simply hitting the page again seems to work most of the time.

On Monday, February 9, 2026 at 2:14:41 PM UTC-5 Michael Santangelo wrote:

[Danny]

The log4j messages is probably a red herring.  Given that it works for awhile, then starts failing, I'd look for a resource issue.  I just made the same jump, and in my environment, I'd start getting 500 errors due to thread exhaustion in the CAS application after it had been running for several hours in production.  Probably particular to my environment, but something to look at.   Lots of things can trigger a 500 error.  I've been in production for just over a week and I think I've finally worked out all of the issues as of yesterday.