Following a question in a tender's RFP, in the context of IT Security, they asked if Liferay logs any changes done to logging configurations (the changes to the log levels or adding new log categories that can be done in the Server Administration panel UI) .
I've checked the sourcecode (com.liferay.petra.log4j.Log4JUtil.java) and actually we are not logging anything after such changes, at any log level.
In the aim to better comply with future security requests like this, would it be possible to add some logging in the implementation of this class to log this type of changes?
Would that make sense?
Thank you and regards!