We are using slf4j + logback for logging. Sometimes other logging libs like commons-logging or log4j creep into the dependency tree. Only way to make sure we get rid of them once and for all is to ban them explicitly via enforcer. There is a rule "bannedDependencies" which can be easily used.