If you perform an upgrade-in-place to SAS 9.4M8 or later, the following log4j configuration files in the <Config-Lev>/Web/Common/LogConfig/ directory will still be at log4j version 1:
These files are attached to products that have been end-dated as of SAS 9.4M8 and are not being actively used by the deployment. You can either manually delete them from the file system or leave them in place. There is no security vulnerability if they are left on the file system.