One of our developers put logback in our project and didn't add a config file. This has killed our prod server for a week - 2 gig of hibernate debug messages per day, until I worked out WTF.

Log4j handles this situation by emitting a single message and producing no more output. This is a pain in the butt in development - because you always have to put a log4j config somewhere while coding - but now I understand why: it's built to be usable safely in a production environment.

I think you should consider altering the logback default behaviour to do what log4j does. Without that, it's a nervous business staging it on an internet-facing server.