log4j2-Syslog附加程序和PatternLayout [英] log4j2 - Syslog appender and PatternLayout

问题描述

我需要将事件记录到系统日志中. 我使用lo4j2和syslog附加程序. log4j2.xml中的appenders块如下所示:

I need to log events into the syslog. I use lo4j2 and the syslog appender. My appenders block in log4j2.xml looks like this:

<appenders>
        <Console name="Console" target="SYSTEM_OUT">
            <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
        </Console>
        <Syslog name="syslog" host="localhost" port="514" protocol="UDP" charset="ISO-8859-1">
        </Syslog>
        <RollingFile name="AppLog" fileName="/var/log/app.log"
                     filePattern="/var/log/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz">
            <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
            <Policies>
                <TimeBasedTriggeringPolicy/>
            </Policies>
        </RollingFile>          
    </appenders>

如您所见，我有一个带有特定PatternLayout的控制台附加程序和RollingFile附加程序. 我想对Syslog附加程序使用相同的PatternLayout. 但是，系统日志中的日志消息似乎总是使用预定义的布局. 我尝试执行以下操作:

As you can see I have a Console appender and RollingFile appender with a specific PatternLayout. I want to use the same PatternLayout for the Syslog appender. However, the log messages in the syslog seem to always use a predefined layout. I tried to do the following:

<Syslog name="syslog" host="localhost" port="514" protocol="UDP" charset="ISO-8859-1">
    <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
</Syslog>

但这没有任何作用. syslog消息仍具有相同的预定格式.

But this does not have any effect. the syslog messages still have the same predfined format.

如何确定进入系统日志的日志消息的格式?

How can I determine the format of my log messages that go into the syslog?

推荐答案

此 log4j2错误报告，log4j2的开发人员对 SyslogAppender进行了编码作为 SocketAppender 硬连接到 SyslogLayout

As mentioned in this log4j2 bug report, the developers of log4j2 coded the SyslogAppender as a SocketAppender hardwired to a SyslogLayout

因为它旨在符合原始syslog格式或RFC5424.因此不应允许其他布局.

because it is intended to conform to either the original syslog format or RFC 5424. No other Layout should be permitted.

不幸的是，他们没有意识到RFC 5424规范并未对日志中包含的消息实施任何特定格式，在Log4j2实现中只是日志的%m部分.

They unfortunately did not realize that the RFC 5424 specifications do not enforce any particular format for the message contained in the log, that in the Log4j2 implementation is only the %m portion of the log.

要解决此问题，一个解决方案(在同一错误报告中建议)是使用

To solve this issue, a solution (suggested in the same bug report) is to reproduce the syslog format using a PatternLayout inside a SocketAppender, like so

<Socket name="SYSLOG" host="localhost" port="514" protocol="UDP">
  <PatternLayout
    pattern="&lt;1&gt;%d{MMM dd HH:mm:ss} ${hostName} appName: {
      &quot;host&quot;:&quot;${hostName}&quot;,
      &quot;thread&quot;:&quot;%t&quot;,
      &quot;level&quot;:&quot;%p&quot;,
      &quot;logger&quot;:&quot;%c{1}&quot;,
      &quot;line&quot;:%L,
      &quot;message&quot;:&quot;%enc{%m}&quot;,
      &quot;exception&quot;:&quot;%exception&quot;
      }%n"
  />
</Socket>

这将通过UDP将格式正确的RFC5424日志写入本地514端口.以下是示例日志输出:

This will write well-formatted RFC5424 logs to local 514 port through UDP. Following is a sample log output:

Sep 14 10:40:50 app-hostname app-name: { "host":"host-name-01", "thread":"http-nio-8080-exec-4", "level":"DEBUG", "logger":"ExecuteTimeInterceptor", "line":52, "message":"GET /health 200 served in 3", "exception":"" }

这篇关于log4j2-Syslog附加程序和PatternLayout的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！