diff --git a/buildSrc/version.properties b/buildSrc/version.properties
index 68731866d6969..149cc5fe05587 100644
--- a/buildSrc/version.properties
+++ b/buildSrc/version.properties
@@ -7,7 +7,7 @@ jts               = 1.13
 jackson           = 2.8.6
 snakeyaml         = 1.15
 # when updating log4j, please update also docs/java-api/index.asciidoc
-log4j             = 2.9.1
+log4j             = 2.11.1
 slf4j             = 1.6.2
 
 # when updating the JNA version, also update the version in buildSrc/build.gradle
diff --git a/core/build.gradle b/core/build.gradle
index ee9da16a0b17f..01d05ff58795a 100644
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -179,8 +179,6 @@ thirdPartyAudit.excludes = [
   'com.fasterxml.jackson.dataformat.xml.JacksonXmlModule',
   'com.fasterxml.jackson.dataformat.xml.XmlMapper',
   'com.fasterxml.jackson.dataformat.xml.util.DefaultXmlPrettyPrinter',
-  'com.fasterxml.jackson.databind.node.JsonNodeFactory',
-  'com.fasterxml.jackson.databind.node.ObjectNode',
   'org.fusesource.jansi.Ansi',
   'org.fusesource.jansi.AnsiRenderer$Code',
   'com.lmax.disruptor.BlockingWaitStrategy',
@@ -221,12 +219,6 @@ thirdPartyAudit.excludes = [
   'javax.mail.internet.MimeMultipart',
   'javax.mail.internet.MimeUtility',
   'javax.mail.util.ByteArrayDataSource',
-  'javax.persistence.AttributeConverter',
-  'javax.persistence.EntityManager',
-  'javax.persistence.EntityManagerFactory',
-  'javax.persistence.EntityTransaction',
-  'javax.persistence.Persistence',
-  'javax.persistence.PersistenceException',
   'org.apache.commons.compress.compressors.CompressorStreamFactory',
   'org.apache.commons.compress.utils.IOUtils',
   'org.apache.commons.csv.CSVFormat',
@@ -259,6 +251,16 @@ thirdPartyAudit.excludes = [
   'org.noggit.JSONParser',
 ]
 
+if (JavaVersion.current() <= JavaVersion.VERSION_1_8) {
+  // Used by Log4J 2.11.1
+  thirdPartyAudit.excludes += [
+    'java.io.ObjectInputFilter',
+    'java.io.ObjectInputFilter$Config',
+    'java.io.ObjectInputFilter$FilterInfo',
+    'java.io.ObjectInputFilter$Status'
+  ]
+}
+
 if (JavaVersion.current() > JavaVersion.VERSION_1_8) {
   thirdPartyAudit.excludes += ['javax.xml.bind.DatatypeConverter']
 }
diff --git a/core/licenses/log4j-1.2-api-2.11.1.jar.sha1 b/core/licenses/log4j-1.2-api-2.11.1.jar.sha1
new file mode 100644
index 0000000000000..575d75dbda8c5
--- /dev/null
+++ b/core/licenses/log4j-1.2-api-2.11.1.jar.sha1
@@ -0,0 +1 @@
+3aba3398fe064a3eab4331f88161c7480e848418
\ No newline at end of file
diff --git a/core/licenses/log4j-1.2-api-2.9.1.jar.sha1 b/core/licenses/log4j-1.2-api-2.9.1.jar.sha1
deleted file mode 100644
index 0b5acc62b7a13..0000000000000
--- a/core/licenses/log4j-1.2-api-2.9.1.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-894f96d677880d4ab834a1356f62b875e579caaa
\ No newline at end of file
diff --git a/core/licenses/log4j-api-2.11.1.jar.sha1 b/core/licenses/log4j-api-2.11.1.jar.sha1
new file mode 100644
index 0000000000000..4b1bfffac179f
--- /dev/null
+++ b/core/licenses/log4j-api-2.11.1.jar.sha1
@@ -0,0 +1 @@
+268f0fe4df3eefe052b57c87ec48517d64fb2a10
\ No newline at end of file
diff --git a/core/licenses/log4j-api-2.9.1.jar.sha1 b/core/licenses/log4j-api-2.9.1.jar.sha1
deleted file mode 100644
index e1a89fadfed95..0000000000000
--- a/core/licenses/log4j-api-2.9.1.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-7a2999229464e7a324aa503c0a52ec0f05efe7bd
\ No newline at end of file
diff --git a/core/licenses/log4j-core-2.11.1.jar.sha1 b/core/licenses/log4j-core-2.11.1.jar.sha1
new file mode 100644
index 0000000000000..2fb8589380a03
--- /dev/null
+++ b/core/licenses/log4j-core-2.11.1.jar.sha1
@@ -0,0 +1 @@
+592a48674c926b01a9a747c7831bcd82a9e6d6e4
\ No newline at end of file
diff --git a/core/licenses/log4j-core-2.9.1.jar.sha1 b/core/licenses/log4j-core-2.9.1.jar.sha1
deleted file mode 100644
index 990ea322a7613..0000000000000
--- a/core/licenses/log4j-core-2.9.1.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-c041978c686866ee8534f538c6220238db3bb6be
\ No newline at end of file
diff --git a/docs/java-api/index.asciidoc b/docs/java-api/index.asciidoc
index 8ae55e70132ed..e4aeced5d9ba4 100644
--- a/docs/java-api/index.asciidoc
+++ b/docs/java-api/index.asciidoc
@@ -70,7 +70,7 @@ You need to also include Log4j 2 dependencies:
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-core</artifactId>
-    <version>2.9.1</version>
+    <version>2.11.1</version>
 </dependency>
 --------------------------------------------------
 
@@ -98,7 +98,7 @@ If you want to use another logger than Log4j 2, you can use http://www.slf4j.org
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-to-slf4j</artifactId>
-    <version>2.9.1</version>
+    <version>2.11.1</version>
 </dependency>
 <dependency>
     <groupId>org.slf4j</groupId>
diff --git a/plugins/repository-hdfs/build.gradle b/plugins/repository-hdfs/build.gradle
index d9e5d9a276680..fb0b1e1d85a1a 100644
--- a/plugins/repository-hdfs/build.gradle
+++ b/plugins/repository-hdfs/build.gradle
@@ -559,7 +559,6 @@ thirdPartyAudit.excludes = [
   // we are not pulling in slf4j-ext, this is okay, Log4j will fallback gracefully
   'org.slf4j.ext.EventData',
 
-  'org.apache.log4j.AppenderSkeleton',
   'org.apache.log4j.AsyncAppender',
   'org.apache.log4j.helpers.ISO8601DateFormat',
   'org.apache.log4j.spi.ThrowableInformation',
diff --git a/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.11.1.jar.sha1 b/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.11.1.jar.sha1
new file mode 100644
index 0000000000000..6178556b31848
--- /dev/null
+++ b/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.11.1.jar.sha1
@@ -0,0 +1 @@
+4b41b53a3a2d299ce381a69d165381ca19f62912
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.9.1.jar.sha1 b/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.9.1.jar.sha1
deleted file mode 100644
index 66119e87e211f..0000000000000
--- a/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.9.1.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-0a97a849b18b3798c4af1a2ca5b10c66cef17e3a
\ No newline at end of file
diff --git a/test/logger-usage/build.gradle b/test/logger-usage/build.gradle
index 98fe76bfcdc31..c16dab6a625c8 100644
--- a/test/logger-usage/build.gradle
+++ b/test/logger-usage/build.gradle
@@ -45,3 +45,13 @@ thirdPartyAudit.excludes = [
   'org.osgi.framework.wiring.BundleWire',
   'org.osgi.framework.wiring.BundleWiring'
 ]
+
+if (JavaVersion.current() <= JavaVersion.VERSION_1_8) {
+  // Used by Log4J 2.11.1
+  thirdPartyAudit.excludes += [
+    'java.io.ObjectInputFilter',
+    'java.io.ObjectInputFilter$Config',
+    'java.io.ObjectInputFilter$FilterInfo',
+    'java.io.ObjectInputFilter$Status'
+  ]
+}
\ No newline at end of file