After applying FlexNet Manager for Engineering Applications 2021 Service Pack 2, if Log4j 1.2.17 still shows up on vulnerability scans, the Log4j 1.2.17 files have not been deleted and remain on the server as legacy files.

You may see the files remaining in the following directories:

• <Install Directory>\FLEXnet\manager\admin\release\platform\webapps\flexnet\WEB-INF\lib
• <Install Directory>\FLEXnet\manager\reporting\release\platform\webapps\flexnet\WEB-INF\lib

Remove Log4j 1.2.17 files

After applying Service Pack 2, if you still have Log4j 1.2.17 files appearing on your system, it is safe to delete them, as they are no longer used by the application.

Note: After Service Pack 2 is installed, the Log4j 1.2.17 files will not regenerate if you run either 'flexnet site' or 'flexnet site make.'