Writing Log Data to Syslog Using Log4J

Writing log data to syslog using log4j

Add the following lines to rsyslog.conf file

$ModLoad imudp
$UDPServerRun 514

It worked for me.

Need to restart the rsyslog after modfications.

Log4j2 Syslog appender is not writing the 1st message to syslog after the syslog service is restarted

This is due to the way plain text TCP syslog works. Check out this post for further information.

This "bug" exists, since version 8.1901 and newer.

The only way you can fix this - as far as i know - is to send the messages over the RELP protocol. See omrelp module.

How to log error and info messages separately into syslog with log4j?

Add to your log4j.properties another appender:

# configure the root logger
log4j.rootLogger=INFO, SYSLOG, SYSLOG7

# configure Syslog facility LOCAL6 appender
log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.threshold=INFO
log4j.appender.SYSLOG.syslogHost=localhost
log4j.appender.SYSLOG.facility=LOCAL6
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.conversionPattern="MyApp: %d\{ISO8601\}%m\n"

# configure Syslog facility LOCAL7 appender
log4j.appender.SYSLOG7=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG7.threshold=ERROR
#                                  vv change to whatever the host is
log4j.appender.SYSLOG7.syslogHost=localhost 
log4j.appender.SYSLOG7.facility=LOCAL7
log4j.appender.SYSLOG7.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG7.layout.conversionPattern="MyApp: %d\{ISO8601\}%m\n"

Edit regarding comment:

If SYSLOG7 shall only log ERROR (and higher): set the threshold to ERROR level. All messages logged with a lower level won't show.

Tricky part is to show only low levels in Syslog:

You can use a filter to log only messages "lower" than e.g. ERROR level.

In log4j 2 : The filter is not supported by PropertyConfigurator. So you must change to XML config to use it. See log4j-Wiki about filters.

Example "specific level"

<appender name="info-out" class="org.apache.log4j.FileAppender"> 
            <param name="File" value="info.log"/> 
            <layout class="org.apache.log4j.PatternLayout"> 
                    <param name="ConversionPattern" value="%m%n"/> 
            </layout> 
            <filter class="org.apache.log4j.varia.LevelMatchFilter">
                    <param name="LevelToMatch" value="info" />
                    <param name="AcceptOnMatch" value="true"/>
            </filter>
            <filter class="org.apache.log4j.varia.DenyAllFilter" />
</appender> 

Or "Level range"

<appender name="info-out" class="org.apache.log4j.FileAppender"> 
            <param name="File" value="info.log"/> 
            <layout class="org.apache.log4j.PatternLayout"> 
                    <param name="ConversionPattern" value="%m%n"/> 
            </layout> 
            <filter class="org.apache.log4j.varia.LevelRangeFilter">
                    <param name="LevelMax" value="info"/>
                    <param name="LevelMin" value="info"/>
                    <param name="AcceptOnMatch" value="true"/>
            </filter>
</appender>

Tomcat6 webapp using log4j for logging, unable to log to syslog

Typically, appending to syslog fails because the syslog daemon is not set up to accept packets from the network. Your "logger -i -p" does not say if packets are allowed...

---

Related Topics