From eb0bab2d9fedcd02bfe65b654156e6a31a11841e Mon Sep 17 00:00:00 2001
From: Jason Pickering <jason@dhis2.org>
Date: Tue, 3 Feb 2026 17:59:04 +0100
Subject: [PATCH 1/7] chore: suppress expected test errors from CI console
 output

Adds package-level log suppressions in test log4j2 configs to hide
expected ERROR messages that fire during tests (e.g. missing
build.properties, apps-bundle.json, and tests exercising error paths).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../src/main/resources/log4j2-test.xml              | 13 +++++++++++++
 .../src/test/resources/log4j2-test.xml              | 13 +++++++++++++
 .../src/test/resources/log4j2-test.xml              | 13 +++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
index 9dd20813d726..2941b879a765 100644
--- a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
+++ b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
@@ -17,6 +17,19 @@
     </Appenders>
 
     <Loggers>
+        <!-- Suppress expected errors from tests exercising error paths and from resources
+        not available in test classpaths (e.g. build.properties, apps-bundle.json).
+        These are not real failures - the tests pass, but the application logs at ERROR. -->
+        <Logger name="org.hisp.dhis.scheduling" level="fatal"/>
+        <Logger name="org.hisp.dhis.system" level="fatal"/>
+        <Logger name="org.hisp.dhis.appmanager" level="fatal"/>
+        <Logger name="org.hisp.dhis.fileresource" level="fatal"/>
+        <Logger name="org.hisp.dhis.sms" level="fatal"/>
+        <Logger name="org.hisp.dhis.route" level="fatal"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
+
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
             we use due to for example misconfigurations or so. If you want to increase the verbosity of specific
diff --git a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
index a97e9aae339f..f7fd484a56d3 100644
--- a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
@@ -14,6 +14,19 @@
     </Appenders>
 
     <Loggers>
+        <!-- Suppress expected errors from tests exercising error paths and from resources
+        not available in test classpaths (e.g. build.properties, apps-bundle.json).
+        These are not real failures - the tests pass, but the application logs at ERROR. -->
+        <Logger name="org.hisp.dhis.scheduling" level="fatal"/>
+        <Logger name="org.hisp.dhis.system" level="fatal"/>
+        <Logger name="org.hisp.dhis.appmanager" level="fatal"/>
+        <Logger name="org.hisp.dhis.fileresource" level="fatal"/>
+        <Logger name="org.hisp.dhis.sms" level="fatal"/>
+        <Logger name="org.hisp.dhis.route" level="fatal"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
+
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
             we use due to for example misconfigurations or so. If you want to increase the verbosity of specific
diff --git a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
index bd964117d76a..ed5f3ebe5155 100644
--- a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
@@ -18,6 +18,19 @@
     </Appenders>
 
     <Loggers>
+        <!-- Suppress expected errors from tests exercising error paths and from resources
+        not available in test classpaths (e.g. build.properties, apps-bundle.json).
+        These are not real failures - the tests pass, but the application logs at ERROR. -->
+        <Logger name="org.hisp.dhis.scheduling" level="fatal"/>
+        <Logger name="org.hisp.dhis.system" level="fatal"/>
+        <Logger name="org.hisp.dhis.appmanager" level="fatal"/>
+        <Logger name="org.hisp.dhis.fileresource" level="fatal"/>
+        <Logger name="org.hisp.dhis.sms" level="fatal"/>
+        <Logger name="org.hisp.dhis.route" level="fatal"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
+
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
             we use due to for example misconfigurations or so. If you want to increase the verbosity of specific

From 2bfa91b960dd9a49815a48d259ec34b3de0f6adb Mon Sep 17 00:00:00 2001
From: Jason Pickering <jason@dhis2.org>
Date: Tue, 3 Feb 2026 18:05:48 +0100
Subject: [PATCH 2/7] chore: also suppress webapi.controller errors in test
 logs

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../dhis-support-test/src/main/resources/log4j2-test.xml         | 1 +
 dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml  | 1 +
 dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
index 2941b879a765..bfec5c90afda 100644
--- a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
+++ b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
@@ -29,6 +29,7 @@
         <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
         <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
         <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
+        <Logger name="org.hisp.dhis.webapi.controller" level="fatal"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
diff --git a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
index f7fd484a56d3..3b01e787a574 100644
--- a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
@@ -26,6 +26,7 @@
         <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
         <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
         <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
+        <Logger name="org.hisp.dhis.webapi.controller" level="fatal"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
diff --git a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
index ed5f3ebe5155..856e4b676227 100644
--- a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
@@ -30,6 +30,7 @@
         <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
         <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
         <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
+        <Logger name="org.hisp.dhis.webapi.controller" level="fatal"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries

From 1656ec51a20f38656eaa1f7476e5cc9cbfe61444 Mon Sep 17 00:00:00 2001
From: Jason Pickering <jason@dhis2.org>
Date: Tue, 3 Feb 2026 18:35:28 +0100
Subject: [PATCH 3/7] test: add temporary FATAL log to verify suppression
 config (remove me)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../src/main/java/org/hisp/dhis/system/DefaultSystemService.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/system/DefaultSystemService.java b/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/system/DefaultSystemService.java
index f089cdc94cbb..9daae1a7630d 100644
--- a/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/system/DefaultSystemService.java
+++ b/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/system/DefaultSystemService.java
@@ -246,6 +246,7 @@ public static SystemInfo loadBuildProperties() {
       log.error(
           "build.properties is not available in the classpath. "
               + "Make sure you build the project with Maven before you start the embedded Jetty server.");
+      log.fatal("TEST: verifying FATAL level is still visible in CI (remove me)");
     }
     return SystemInfo.builder().build();
   }

From 0ffdfae83fd53e8e289b87e2de5ef0309b51a5a1 Mon Sep 17 00:00:00 2001
From: Jason Pickering <jason@dhis2.org>
Date: Tue, 3 Feb 2026 18:41:02 +0100
Subject: [PATCH 4/7] chore: make test log suppression toggleable via
 ci-verbose label

Use TEST_LOG_SUPPRESSED_LEVEL env var to control log4j2 suppression of
expected test errors. Defaults to fatal (suppressed). The ci-verbose
PR label or debug workflow dispatch sets it to error (visible).

Also removes broken log.fatal() call (SLF4J has no fatal level).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/analyse-pr.yml              |  2 ++
 .../run-api-analytics-tests-doris.yml         |  2 ++
 .github/workflows/run-api-analytics-tests.yml |  2 ++
 .github/workflows/run-api-tests.yml           |  2 ++
 .github/workflows/run-tests.yml               |  2 ++
 .../dhis/system/DefaultSystemService.java     |  1 -
 .../src/main/resources/log4j2-test.xml        | 23 +++++++++++--------
 .../src/test/resources/log4j2-test.xml        | 23 +++++++++++--------
 .../src/test/resources/log4j2-test.xml        | 23 +++++++++++--------
 9 files changed, 49 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/analyse-pr.yml b/.github/workflows/analyse-pr.yml
index cfcc445370b0..4318ca5ad0dc 100644
--- a/.github/workflows/analyse-pr.yml
+++ b/.github/workflows/analyse-pr.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   SONAR_TOKEN: ${{ secrets.DHIS2_BOT_SONARCLOUD_TOKEN }}
 on:
diff --git a/.github/workflows/run-api-analytics-tests-doris.yml b/.github/workflows/run-api-analytics-tests-doris.yml
index 421607536af4..05ba7e7bfb7d 100644
--- a/.github/workflows/run-api-analytics-tests-doris.yml
+++ b/.github/workflows/run-api-analytics-tests-doris.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
 
 on:
   pull_request:
diff --git a/.github/workflows/run-api-analytics-tests.yml b/.github/workflows/run-api-analytics-tests.yml
index 8948cb92dd54..1a8bf88857df 100644
--- a/.github/workflows/run-api-analytics-tests.yml
+++ b/.github/workflows/run-api-analytics-tests.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
 
 on:
   pull_request:
diff --git a/.github/workflows/run-api-tests.yml b/.github/workflows/run-api-tests.yml
index d03aac2a9a55..f02f1b9e9801 100644
--- a/.github/workflows/run-api-tests.yml
+++ b/.github/workflows/run-api-tests.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Xmx1024m -Xms1024m -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
 
 on:
   push:
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 7f340761f8bf..f990a6c1b48b 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
 on:
   push:
     branches:
diff --git a/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/system/DefaultSystemService.java b/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/system/DefaultSystemService.java
index 9daae1a7630d..f089cdc94cbb 100644
--- a/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/system/DefaultSystemService.java
+++ b/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/system/DefaultSystemService.java
@@ -246,7 +246,6 @@ public static SystemInfo loadBuildProperties() {
       log.error(
           "build.properties is not available in the classpath. "
               + "Make sure you build the project with Maven before you start the embedded Jetty server.");
-      log.fatal("TEST: verifying FATAL level is still visible in CI (remove me)");
     }
     return SystemInfo.builder().build();
   }
diff --git a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
index bfec5c90afda..770893cc5d19 100644
--- a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
+++ b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
@@ -5,6 +5,9 @@
 <Configuration status="warn">
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
+        <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
+        Defaults to fatal which effectively suppresses all messages since SLF4J has no fatal level. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-fatal}</Property>
     </Properties>
 
     <Appenders>
@@ -20,16 +23,16 @@
         <!-- Suppress expected errors from tests exercising error paths and from resources
         not available in test classpaths (e.g. build.properties, apps-bundle.json).
         These are not real failures - the tests pass, but the application logs at ERROR. -->
-        <Logger name="org.hisp.dhis.scheduling" level="fatal"/>
-        <Logger name="org.hisp.dhis.system" level="fatal"/>
-        <Logger name="org.hisp.dhis.appmanager" level="fatal"/>
-        <Logger name="org.hisp.dhis.fileresource" level="fatal"/>
-        <Logger name="org.hisp.dhis.sms" level="fatal"/>
-        <Logger name="org.hisp.dhis.route" level="fatal"/>
-        <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
-        <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
-        <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
-        <Logger name="org.hisp.dhis.webapi.controller" level="fatal"/>
+        <Logger name="org.hisp.dhis.scheduling" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.system" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.appmanager" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.fileresource" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.route" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.webapi.controller" level="${suppressed.level}"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
diff --git a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
index 3b01e787a574..a811be53577a 100644
--- a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
@@ -2,6 +2,9 @@
 <Configuration status="warn">
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
+        <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
+        Defaults to fatal which effectively suppresses all messages since SLF4J has no fatal level. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-fatal}</Property>
     </Properties>
 
     <Appenders>
@@ -17,16 +20,16 @@
         <!-- Suppress expected errors from tests exercising error paths and from resources
         not available in test classpaths (e.g. build.properties, apps-bundle.json).
         These are not real failures - the tests pass, but the application logs at ERROR. -->
-        <Logger name="org.hisp.dhis.scheduling" level="fatal"/>
-        <Logger name="org.hisp.dhis.system" level="fatal"/>
-        <Logger name="org.hisp.dhis.appmanager" level="fatal"/>
-        <Logger name="org.hisp.dhis.fileresource" level="fatal"/>
-        <Logger name="org.hisp.dhis.sms" level="fatal"/>
-        <Logger name="org.hisp.dhis.route" level="fatal"/>
-        <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
-        <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
-        <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
-        <Logger name="org.hisp.dhis.webapi.controller" level="fatal"/>
+        <Logger name="org.hisp.dhis.scheduling" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.system" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.appmanager" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.fileresource" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.route" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.webapi.controller" level="${suppressed.level}"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
diff --git a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
index 856e4b676227..d7656dea87d5 100644
--- a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
@@ -2,6 +2,9 @@
 <Configuration status="warn">
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
+        <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
+        Defaults to fatal which effectively suppresses all messages since SLF4J has no fatal level. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-fatal}</Property>
     </Properties>
 
     <Appenders>
@@ -21,16 +24,16 @@
         <!-- Suppress expected errors from tests exercising error paths and from resources
         not available in test classpaths (e.g. build.properties, apps-bundle.json).
         These are not real failures - the tests pass, but the application logs at ERROR. -->
-        <Logger name="org.hisp.dhis.scheduling" level="fatal"/>
-        <Logger name="org.hisp.dhis.system" level="fatal"/>
-        <Logger name="org.hisp.dhis.appmanager" level="fatal"/>
-        <Logger name="org.hisp.dhis.fileresource" level="fatal"/>
-        <Logger name="org.hisp.dhis.sms" level="fatal"/>
-        <Logger name="org.hisp.dhis.route" level="fatal"/>
-        <Logger name="org.hisp.dhis.dxf2.gml" level="fatal"/>
-        <Logger name="org.hisp.dhis.rules.engine" level="fatal"/>
-        <Logger name="org.hisp.dhis.tracker.imports.sms" level="fatal"/>
-        <Logger name="org.hisp.dhis.webapi.controller" level="fatal"/>
+        <Logger name="org.hisp.dhis.scheduling" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.system" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.appmanager" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.fileresource" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.route" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.webapi.controller" level="${suppressed.level}"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries

From 027d06150823ce874b6506a7eb1040db56840481 Mon Sep 17 00:00:00 2001
From: Jason Pickering <jason@dhis2.org>
Date: Wed, 4 Feb 2026 06:03:56 +0100
Subject: [PATCH 5/7] chore: use log4j2 OFF level instead of FATAL for test log
 suppression

OFF is the canonical log4j2 level for disabling a logger, making the
intent self-documenting rather than relying on the SLF4J/log4j2 level
mismatch where FATAL works only because SLF4J has no fatal() method.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/analyse-pr.yml                              | 2 +-
 .github/workflows/run-api-analytics-tests-doris.yml           | 2 +-
 .github/workflows/run-api-analytics-tests.yml                 | 2 +-
 .github/workflows/run-api-tests.yml                           | 2 +-
 .github/workflows/run-tests.yml                               | 2 +-
 .../dhis-support-test/src/main/resources/log4j2-test.xml      | 4 ++--
 .../dhis-test-integration/src/test/resources/log4j2-test.xml  | 4 ++--
 dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml   | 4 ++--
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/analyse-pr.yml b/.github/workflows/analyse-pr.yml
index 4318ca5ad0dc..99b97a2cc98b 100644
--- a/.github/workflows/analyse-pr.yml
+++ b/.github/workflows/analyse-pr.yml
@@ -5,7 +5,7 @@ env:
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
   # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
-  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   SONAR_TOKEN: ${{ secrets.DHIS2_BOT_SONARCLOUD_TOKEN }}
 on:
diff --git a/.github/workflows/run-api-analytics-tests-doris.yml b/.github/workflows/run-api-analytics-tests-doris.yml
index 05ba7e7bfb7d..6e80a697ee0e 100644
--- a/.github/workflows/run-api-analytics-tests-doris.yml
+++ b/.github/workflows/run-api-analytics-tests-doris.yml
@@ -5,7 +5,7 @@ env:
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
   # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
-  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
 
 on:
   pull_request:
diff --git a/.github/workflows/run-api-analytics-tests.yml b/.github/workflows/run-api-analytics-tests.yml
index 1a8bf88857df..4f2c0e5de727 100644
--- a/.github/workflows/run-api-analytics-tests.yml
+++ b/.github/workflows/run-api-analytics-tests.yml
@@ -5,7 +5,7 @@ env:
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
   # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
-  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
 
 on:
   pull_request:
diff --git a/.github/workflows/run-api-tests.yml b/.github/workflows/run-api-tests.yml
index f02f1b9e9801..d553bd130809 100644
--- a/.github/workflows/run-api-tests.yml
+++ b/.github/workflows/run-api-tests.yml
@@ -5,7 +5,7 @@ env:
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
   # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
-  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
 
 on:
   push:
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index f990a6c1b48b..299431647fc8 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -5,7 +5,7 @@ env:
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
   # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
-  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'fatal' }}
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
 on:
   push:
     branches:
diff --git a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
index 770893cc5d19..575f10689694 100644
--- a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
+++ b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
@@ -6,8 +6,8 @@
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
         <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
-        Defaults to fatal which effectively suppresses all messages since SLF4J has no fatal level. -->
-        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-fatal}</Property>
+        Defaults to off which disables these loggers entirely. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-off}</Property>
     </Properties>
 
     <Appenders>
diff --git a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
index a811be53577a..f1109522f6bb 100644
--- a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
@@ -3,8 +3,8 @@
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
         <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
-        Defaults to fatal which effectively suppresses all messages since SLF4J has no fatal level. -->
-        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-fatal}</Property>
+        Defaults to off which disables these loggers entirely. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-off}</Property>
     </Properties>
 
     <Appenders>
diff --git a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
index d7656dea87d5..aeb49b5c970b 100644
--- a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
@@ -3,8 +3,8 @@
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
         <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
-        Defaults to fatal which effectively suppresses all messages since SLF4J has no fatal level. -->
-        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-fatal}</Property>
+        Defaults to off which disables these loggers entirely. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-off}</Property>
     </Properties>
 
     <Appenders>

From 660b4f2e9fbd707d915b2d248be18dc5f672c784 Mon Sep 17 00:00:00 2001
From: Jason Pickering <jason@dhis2.org>
Date: Mon, 11 May 2026 10:59:16 +0200
Subject: [PATCH 6/7] More noise suppression

---
 .../src/main/resources/log4j2-test.xml                |  4 ++++
 ...his2OAuth2AuthorizationServiceIntegrationTest.java |  6 ------
 .../src/test/resources/log4j2-test.xml                |  4 ++++
 .../src/test/resources/log4j2-test.xml                | 11 +++++++++++
 4 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
index 575f10689694..49b2d5131d9d 100644
--- a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
+++ b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
@@ -44,6 +44,10 @@
             <AppenderRef ref="file" level="warn"/>
         </Root>
 
+        <!-- Tests that verify uniqueness constraints intentionally trigger duplicate-key
+             violations; Hibernate logs every such exception at ERROR via SqlExceptionHelper. -->
+        <Logger name="org.hibernate.engine.jdbc.spi.SqlExceptionHelper" level="fatal" additivity="false"/>
+
         <!-- A few examples of loggers that might be useful to debug integration test issues.
         Adding an AppenderRef is necessary to overrule the log level we have set on the Root AppenderRefs.
         Once you add an AppenderRef to a Logger you need to set additivity to false otherwise logs might appear twice
diff --git a/dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/security/oauth2/authorization/Dhis2OAuth2AuthorizationServiceIntegrationTest.java b/dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/security/oauth2/authorization/Dhis2OAuth2AuthorizationServiceIntegrationTest.java
index a90b0304d83e..4174242f8a7e 100644
--- a/dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/security/oauth2/authorization/Dhis2OAuth2AuthorizationServiceIntegrationTest.java
+++ b/dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/security/oauth2/authorization/Dhis2OAuth2AuthorizationServiceIntegrationTest.java
@@ -34,7 +34,6 @@
 import static org.junit.jupiter.api.Assertions.assertNull;
 
 import java.time.Instant;
-import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
@@ -172,11 +171,6 @@ void testFindByAuthorizationCode() {
     // When
     authorizationService.save(authorization);
 
-    List<Dhis2OAuth2Authorization> all = authorizationService.getAll();
-    for (Dhis2OAuth2Authorization oAuth2Authorization : all) {
-      System.out.println(oAuth2Authorization);
-    }
-
     OAuth2Authorization foundAuthorization =
         authorizationService.findByToken(
             "code-value", new OAuth2TokenType(OAuth2ParameterNames.CODE));
diff --git a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
index f1109522f6bb..5e13dc0800e5 100644
--- a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
@@ -47,6 +47,10 @@
         as they propagate up from the Logger to its parent which is the Root.
         Check the log4j2 config documentation for more details. Uncomment the various loggers to debug the tests. -->
 
+        <!-- Tests that verify uniqueness constraints intentionally trigger duplicate-key
+             violations; Hibernate logs every such exception at ERROR via SqlExceptionHelper. -->
+        <Logger name="org.hibernate.engine.jdbc.spi.SqlExceptionHelper" level="fatal" additivity="false"/>
+
         <!-- DHIS2 -->
         <!--        
         <Logger name="org.hisp.dhis.migration" level="info" additivity="false">
diff --git a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
index aeb49b5c970b..b6a6ad8b887c 100644
--- a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
@@ -47,6 +47,17 @@
 
         <Logger name="org.openapitools.codegen" level="off"/>
 
+        <!-- Analytics tables do not exist in the test database, so any test that drives
+             the analytics engine (e.g. ADEX) produces expected "relation does not exist"
+             SQL errors.  The tests still pass; suppress the noise. -->
+        <Logger name="org.hisp.dhis.analytics.data.JdbcAnalyticsManager" level="fatal" additivity="false"/>
+        <Logger name="org.hisp.dhis.analytics.data.handler.DataHandler" level="fatal" additivity="false"/>
+        <Logger name="org.hisp.dhis.analytics.util.AnalyticsUtils" level="fatal" additivity="false"/>
+
+        <!-- Tests that verify uniqueness constraints intentionally trigger duplicate-key
+             violations; Hibernate logs every such exception at ERROR via SqlExceptionHelper. -->
+        <Logger name="org.hibernate.engine.jdbc.spi.SqlExceptionHelper" level="fatal" additivity="false"/>
+
         <!-- A few examples of loggers that might be useful to debug integration test issues.
         Adding an AppenderRef is necessary to overrule the log level we have set on the Root AppenderRefs.
         Once you add an AppenderRef to a Logger you need to set additivity to false otherwise logs might appear twice

From 7be94b73d01ae3c9ce1430083f80b652ddd0bb93 Mon Sep 17 00:00:00 2001
From: Jason Pickering <jason@dhis2.org>
Date: Mon, 11 May 2026 16:37:30 +0200
Subject: [PATCH 7/7] Narrow scope

---
 .../dhis-support-test/src/main/resources/log4j2-test.xml     | 5 ++++-
 .../dhis-test-integration/src/test/resources/log4j2-test.xml | 5 ++++-
 dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml  | 5 ++++-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
index 49b2d5131d9d..672012e504ed 100644
--- a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
+++ b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
@@ -32,7 +32,10 @@
         <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
         <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
         <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
-        <Logger name="org.hisp.dhis.webapi.controller" level="${suppressed.level}"/>
+        <!-- CrudControllerAdvice is the global @ControllerAdvice that catches exceptions from tests
+        deliberately exercising error paths (e.g. SQL injection tests). The broad package suppression
+        was replaced with this targeted class to keep other controller errors visible. -->
+        <Logger name="org.hisp.dhis.webapi.controller.CrudControllerAdvice" level="${suppressed.level}"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
diff --git a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
index 5e13dc0800e5..756b996b146a 100644
--- a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
@@ -29,7 +29,10 @@
         <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
         <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
         <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
-        <Logger name="org.hisp.dhis.webapi.controller" level="${suppressed.level}"/>
+        <!-- CrudControllerAdvice is the global @ControllerAdvice that catches exceptions from tests
+        deliberately exercising error paths (e.g. SQL injection tests). The broad package suppression
+        was replaced with this targeted class to keep other controller errors visible. -->
+        <Logger name="org.hisp.dhis.webapi.controller.CrudControllerAdvice" level="${suppressed.level}"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
diff --git a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
index b6a6ad8b887c..12cf879d2e47 100644
--- a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
@@ -33,7 +33,10 @@
         <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
         <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
         <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
-        <Logger name="org.hisp.dhis.webapi.controller" level="${suppressed.level}"/>
+        <!-- CrudControllerAdvice is the global @ControllerAdvice that catches exceptions from tests
+        deliberately exercising error paths (e.g. SQL injection tests). The broad package suppression
+        was replaced with this targeted class to keep other controller errors visible. -->
+        <Logger name="org.hisp.dhis.webapi.controller.CrudControllerAdvice" level="${suppressed.level}"/>
 
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries