Thanks David, We're not using Graylog, but your note about using UDP rather than TCP is advice I think I'll take!
Thanks for keeping up with your documentation. It's a great resource. Matt On Thursday, February 14, 2019 at 8:58:59 AM UTC-7, David Curry wrote: > > Not a direct answer to your question, but if you have a Graylog server > available, the GELF format for CAS logs is pretty excellent. For example, > I've included a SERVICE_TICKET_CREATED example below, since that's the > example you gave. > > Instructions are here: > https://dacurry-tns.github.io/deploying-apereo-cas/prod_configuration-changes.html#logging-to-graylog > > > (Note: The instructions use Graylog inputs, which is what we did > originally. When we rebuilt our "bigger faster better" Graylog environment, > we switched to using streams, one each for the dev, test, and prod CAS > environments. Either way works.) > > --Dave > > Received by*GELF UDP JSON format log messages* on 6bf1a9d3 / > graylog-web03-lip.newschool.edu > <https://tnslogs.newschool.edu/system/nodes/6bf1a9d3-2e6c-4615-bf3f-70b64a8910bb> > Stored in indexgraylog_11Routed into streams > > - casdev > <https://tnslogs.newschool.edu/streams/5be1f2a9e6fefe4d54b8e75d/search> > > _eventId > [submit] > accept > > text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 > accept-encoding > gzip, deflate, br > accept-language > en-US,en;q=0.9 > cache-control > max-age=0 > characterEncodingFilter_FILTERED > true > connection > keep-alive > content-length > 4467 > content-type > application/x-www-form-urlencoded > contentType > application/x-www-form-urlencoded > contextPath > /cas > cookie > BIGipServercasdev_pool=2372870037.64288.0000 > errorPageFilter_FILTERED > true > execution > > [5d87d18b-6de4-433e-9253-d35a3738e80c_ZXlKaGJHY2lPaUpJVXpVeE1pSjkuTTNsdFpkU3laeCtobVVEQy8rTFhZRS9qSEhFYmFUUnl5QTQwd2lKM3NiWkozQ012UmJJOEdGOTBZdjgzbS9wcGNyVWFYMmRpZ3NXWkpKZ2xnRjJSd21vRnNkZ0RXVnZ3TlAwUFVDcnVGM2ZhZ25iN0ZlZHE4VnlpQ1I2QmRrcU10ZVhXUEwwTjFUaEtlQzR1MWFUSHltM3BzT3ZnMEROUXpUR2c4UER1cENTVlFhbW1Yay9QSlB6MTh4ZG1GZGNMYkcyUFVWUnY1TDJWV2poeEdWYmUwcFhuMUlkWlA5eVgwaFgxeUxqRFVDRGJpY3JJVURidGV2UVJtL2tkQzd1ZTFkME44Z0JWR1ZQQmRMMXBsNXNNdE1XQXAwY1VBZTAxRE5pUm5Vb1BwZFZJVS8xYXFIc3F4YlNXNVNMbDZmMzVpc0dYemR6UnZ5N2QyNjk5NDEwalJhcGxGT29JSDEyT2sxNm1tbTdaZzlMQk43WGI0TEJjbEI5TFhtemE4UmJYdDNITXg4SlErSHBzejhhVUZGQ1Z5Q1ZTMFo1bVVRY0RNSlM2TUpaVytzd2FYR3RJR3JqMm5SRFlqbEVYWTg2dUpFbDN1V3QrV3o3QmhnMHhlcGdHdkgxdThBaG5XOFVFbVVxWXJwSzdUZmtIbGFpK01GVkwzUFROQjJqR2xwU3JVMDZIN1NDWTY2ajFPcmcxODVkRENSTzg0VnU0MmlWSFpmWkpRWjJTRU53MUVyTEx6ZnlNQkN5ZjljYS9oTFFKbkNubzdPbnZUNHVGdnpRaVZCVGY0bHpqdnZvT3ZqdEVZU3YvWDdpNzZWSmJ3S2dvV2ZWempuZkFIdEJwNjhSOVdreXA4TDNWVXZhY2FyWnRwV0VMMXJkTHcvOGFObTcyUmwzOTM2Q3RjazY1LzhMSytvL2VwMUJaU09xeFVTMEMvbTU0c1BMTldBUzNkTmZwaFdCK1ZucFhya1lDaHl6eHE1ZkZTSmsveUMrRnJYdEpHaGMvTGhPZCtUNjVqUjU0UnY5RFpYU0lFNU5mdVpHOWJIbko0RnU4MlRIM3F5MitDZnliWkdhREZrbzY3cXovVWplTXltSGc0SWQwNUlxWXFCeVFvYzB5RnB3UFU1L3RRbHJoMUUraVY4cWtIOFg1bkdYd21DK2dERlhFV3VuenNHd214V0hvZVg5emYxNDhJUDQrTGxLQXJSak9vOGE0ZVVzQXhWaWRLMFRMMUNkTURNZzVnZFN0OXd0cC9TVkI0VC9LWWhNTDF5ZWphc2JjTkJXZDhwekFSZUJqeXJ2KzBoTnByYTBqcWVDMDUzeVBQenF6RXdNWDhWKzJjUU5VRDRKUFlRaDczQ1IwUDhwYjJGZHJqRVlVc2loaWdkVWNyL2RldzVFNlhQTEpKYkg0dU5PY3ovSkdwY0V5ZUwrQmZuQ1pvQURPd1E2ZnN5ZUp6L3phODZtSmhOcHRRYi9KbXpnYVBOMit6a2NOb0NBcTVXcEU0TUcyZndPMzgzTzdTTzJjcU9ra3NucWpxMnJrTlZadHpQNlI0QzNBeXlYNmtxUzBSaHI0bVZRdkNSRERyd0lsYWFIRDRZeXA4RjFIeGRiZHlPS3g1Z2JNeDYvR3RvNVhRT0lGNlR3UlE1NVhrblhjRTgzM0Y4RWRqZ2RKeWxmejdwK2NuYnd2Ulp5M016WXBIbWhGWWNROU5ZS1ZnMTgrSXhPNmwyUEl4cXhHMTdjQXprNmlsZHQyMkhqN1dKTHRSSm05SmxQL295V3BOV1hWdXJnK2pKSnlySVlldHNrdEpHQ0Y2TzBPVmdqTERVSWhEWCtXd2tBUG5pZ3E5ZlFQZTJvYnMxdUFNUXpBMEt5TVB6K1FvNFNhbHJmSThZazduY1h6aDgyYjhKL0hZRXRacjVySXVVSFc5UWFWM3lOdExoa1pkd0tjUkx3WEtMVUl4VnByemhYam0vbXhvUnZRemJ4Y3YzY1hTUWpWRHJqSnZnbnltM2dpZXhXUUdlNURxYzh5RmNEQlo5M3BJcFROSW43cHpQa0NocnRJNXZETDREQmFDRW1KTDdkMkltR1lHQW1yZzFRTjYvTXNJNWxEYytVTTZVcStveGp2bWR4S2JjeWtIMWhDdTdWZWpxbUtTMDdoUFZRQ2FXWURNc1Z1M0xDdjZvVVVMeU9PRzZRUnpqRm9aUzhERU05ZHFyVlpmUDhtMXBPYUovckJGTjVFMDRPUjBSd2NFUXBaaUtqc1VJQ3lhRDQ5QXdXRDVvY3ZhQ3I3QzRXVUtZTkhsQ0pYT0lpMk4wTGJ6eEE5SllaTk8rOUNhMVlVTk9MV1F2RExaRlBMNGU3cjg2L0grRHpYbithaERaNU80WjFCTStFVWRMSjBtRFZSTVRPWWp4VnVvOUN3T2IzZnRiZTBZNmxxK1FiMW5ONzhrNFAxdTBkRXRzc29rczN0V3E4aFZlYllXb3VDSzVrczZ1Rk5xaEhueW42V3libjBkbDg5a2IwMXpILzFCbkpTWFUxeDVKTFBrL1gzOWQrWS9KZ2JDVXo1U0NNZGNidm4veWliTGRENkFXeFZnbmJ6NHc3Y3luYWNqa3d5WGZLM1dhL1FGaVBTZVhQWFhnaU9MWHB0d3FHODk3dFZFR0tyT0ppVy9jamlRQ2c2RmRJY0pyQnZ4VU50dGZVc1VYOHIzRTM2WEp3anlmYkExZ3RLelFIVDVUZjRDYkdJR29MWjJQMWxha0RNS3d2VTJCeGxCQklnK2Rmck9uNHR2Vk5NOGo3WnVsRG5jWHk3cFRpSUVZL0ZDOHFvT0JYcXoyVGtNc1NSc2RqSXdDS051dXcyNmd0YUQ4dmdQSUtaVHVNeUtRSkNBcnBsN2o1bkFpYXNtWENuNFoySXRSMEJNOTlIcDYvWU1JUlgxbGJreGphQ0w2TmJ5RGVkZFJ1QjdDS2FNZ3ROQ0xKdEhid0M3YWIyVis2UDYvZnkxUTBNVEVhdnlScGJ6YTFCcS8rU2dvbVh0L0hJUzhMdFk1QWFCcUFDQWtJdHpFakJOVDYrb3IrSzgyeldVOWpWZ0JVeEtSSTllN2FTLzBOWHIvOFlhanoyWDNNOHF4V0Y2NXVpcUFaZUZONUpUT0FTUjVORU1zQVJoM1RQS0JJUGVtNkhrbnpGNDd6OUxaVXF0VzR3cVZqNHZXRFZQSzVVNFFYcU4rbVllSWgwWUtFL3duMDhvUUZJcEVGb1BkUExSY045blcxMXN4NXZaakQ1V2VtVFpkR2FwR3I4dFRYeHEzeVA1dWhPU3kzT0JNS0M2c05pdDZmc3FkYUkwdWZzMzZIS2dNY29yNlNUOUtvdXdPTkdZcVh2eXdCbWkvOWV2SEltN2V3dXduc0JQeUtXdzV1dVpFUS9SRlQ2MVZXUW1ST3d5aXRMVGVDd2dZRVk1ZDJEM2FtTWFQQUVWTGJaMFFqbmQ4bjN3ZnBpa3VhbUIyaElmRG5LY3gvQW85Y3MrbjMzRkY1N2ZUWlJrQnBBNTQ2bkI4NFdadnBIdWJIb05FdVBvUW5yaUp3VlZ2RFFJZkNGbkpUczFJQ3F4emJsR3pIcXhXck8yL1AvOEJXVnFuY3llMnRaWnJacGJsYjRFNFV2QThaUTVzZkhXcW5iUHQ3dVNoSmltMHAwZDVZTnkyT1I4Y3JOdTdmNXY1UTlnOEZQY0w5SWFFUVo2QXd2Y1BuSWNFaXN4UzhIcVR2a3ZFd213eFB1QnRPZWZnMHVqaFgrWXZUUUtjUmt4dlQxQ2Fvc0ZSYmtCSzhSbGsxNDQ5TkVrUUl1ZFFEbGhaNlFrRk45VEJuY0lhOUpqeWNnSUMvbjNjWlg4SEVNcDlRTm9JenhhcFkwQUppaktsZVJ4L0VsUXQwM3RGS3lmUkxBMnY3WGUxcG1TaXpzVFFueUR4SUdiWHF0bko3Z21nblFKZ3FqQVcvWnFKeW8zY1pnWnhPRnVoSmVGUTVKUEk2cy9xQzVWUHBHVEVMeGthVmprbXhLRjFWb0ppMERaZUlmeTJKbGovR2o4Q2hKMlpBQWFSellydTJqYWh1QnpBYTBSZ09ibnFFeHNYSmpBNXJBTDJteDh0aEFZc0NKclExemhxWENIUlptWTlXYUprcnFLeGdqRkYvbzM4OEZucnRsYkt4d1crS0tkenRVci9kZUZIQ2p6NUZyTWx6OS4zY0RqNWZVUVdhVGJUX3pxN2NRYVZsQ096Vk91RUx0cXpBdVd2VlhqeWRVVm9NMHZhYzRVOEw2Z2ltRVBHMWZmT05XTEh3ZTVxUnZlTjlrNno2Ym1MZw==] > geolocation > [] > javax_servlet_request_cipher_suite > TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 > javax_servlet_request_key_size > 128 > javax_servlet_request_ssl_session_id > 74b6fcbe193a81c8dd9b37044de5f376f0e46a5d13f630b82a6a51cb03866d2d > javax_servlet_request_ssl_session_mgr > org.apache.tomcat.util.net.jsse.JSSESupport@1fdc30ae > level > 6 > localAddress > 149.31.111.141 > localPort > 8443 > locale > English (United States) > logger > org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager > message > Audit trail record BEGIN > ============================================================= WHO: curryd > WHAT: ST-1--vjc6pF-JTXRREREbxxE7sn87RI-casdev-srv01-lid for > https://casdev-casapp.newschool.edu/secured-by-cas/index.php ACTION: > SERVICE_TICKET_CREATED APPLICATION: CAS WHEN: Thu Feb 14 10:45:58 EST 2019 > CLIENT IP ADDRESS: 149.31.50.13 SERVER IP ADDRESS: 149.31.111.141 > ============================================================= > method > POST > metricsFilter_FILTERED > true > org_apache_catalina_AccessLog_Protocol > HTTP/1.1 > org_apache_catalina_AccessLog_RemoteAddr > 149.31.50.13 > org_apache_catalina_AccessLog_RemoteHost > 149.31.50.13 > org_apache_catalina_AccessLog_ServerPort > 443 > org_apache_logging_log4j_web_Log4jServletFilter_FILTERED > true > org_apache_tomcat_remoteAddr > 149.31.50.13 > org_apache_tomcat_util_net_secure_protocol_version > TLSv1.2:TLS > org_springframework_boot_actuate_autoconfigure_MetricsFilter_StopWatch > StopWatch '': running time (millis) = 0 > > org_springframework_web_context_request_async_WebAsyncManager_WEB_ASYNC_MANAGER > org.springframework.web.context.request.async.WebAsyncManager@cc9a36b > origin > https://casdev.newschool.edu > password > [xxxxxxxx] > protocol > HTTP/1.1 > queryString > service=https%3a%2f%2fcasdev-casapp.newschool.edu > %2fsecured-by-cas%2findex.php > referer > > https://casdev.newschool.edu/cas/login?service=https%3a%2f%2fcasdev-casapp.newschool.edu%2fsecured-by-cas%2findex.php > remoteAddress > 149.31.50.13 > remotePort > 17996 > requestUri > /cas/login > scheme > https > serverName > casdev.newschool.edu > serverPort > 443 > service > [https://casdev-casapp.newschool.edu/secured-by-cas/index.php] > source > casdev-srv01-lid.newschool.edu > submit > [Continue] > thread > https-openssl-nio-8443-exec-24 > timestamp > 2019-02-14T15:45:58.248Z > timezone > Eastern Standard Time > upgrade-insecure-requests > 1 > user-agent > Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like > Gecko) Chrome/71.0.3578.98 Safari/537.36 > username > [curryd] > webappName > cas > x-forwarded-for > 149.31.55.205 > > > > > > -- > > DAVID A. CURRY, CISSP > *DIRECTOR OF INFORMATION SECURITY* > THE NEW SCHOOL • INFORMATION TECHNOLOGY > > 71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003 > +1 212 229-5300 x4728 • [email protected] <javascript:> > > > On Thu, Feb 14, 2019 at 10:40 AM Matthew Uribe <[email protected] > <javascript:>> wrote: > >> Hi all, >> >> We've just recently added the appender and logger to log4j2.xml referred >> to in the documentation to route logs to SysLog (CAS 5.2.x). However, each >> individual line is being sent as a separate log entry. Is there a way to >> keep all the relevant lines for an entry together? >> >> For example, each of the following lines is sent separately: >> >> ============================================================= >> WHO: user >> WHAT: ST... >> ACTION: SERVICE_TICKET_CREATED >> APPLICATION: CAS >> WHEN: Wed Feb 13 00:00:12 MST 2019 >> CLIENT IP ADDRESS: 1.2.3.4 >> SERVER IP ADDRESS: 4.3.2.1 >> ============================================================= >> >> Only, they're not sent over in this exact order. Instead, they are all >> jumbled with unrelated entries overlapping each other. I'm using the >> configuration from the "Routing Logs to SysLog" section of this page: >> https://apereo.github.io/cas/5.2.x/installation/Logging.html >> The only thing I've really changed so far is the newLine - I set it to >> false thinking it might change this line by line behavior, but it did not. >> My next thought is to change the format, or experiment with other layouts, >> but rather than guess and check, I thought I'd first reach out to the >> community. Any insights would truly be appreciated. >> >> >> ... >> <Appenders> >> <Syslog name="SYSLOG" format="RFC5424" host="log.server.example" >> port="514" >> protocol="TCP" appName="MyApp" includeMDC="true" mdcId="mdc" >> facility="LOCAL0" enterpriseNumber="18060" newLine="false" >> messageId="Audit" id="App"/> >> </Appenders> >> ... >> <AsyncLogger name="org.apereo" additivity="true" level="debug"> >> <appender-ref ref="SYSLOG" /> >> </AsyncLogger> >> >> >> >> Thanks! >> Matt >> >> -- >> - Website: https://apereo.github.io/cas >> - Gitter Chatroom: https://gitter.im/apereo/cas >> - List Guidelines: https://goo.gl/1VRrw7 >> - Contributions: https://goo.gl/mh7qDG >> --- >> You received this message because you are subscribed to the Google Groups >> "CAS Community" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> To view this discussion on the web visit >> https://groups.google.com/a/apereo.org/d/msgid/cas-user/c1f44156-80ad-4b4b-bd0a-2f9c9741ede9%40apereo.org >> >> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/c1f44156-80ad-4b4b-bd0a-2f9c9741ede9%40apereo.org?utm_medium=email&utm_source=footer> >> . >> > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/2396b279-d849-47fe-999d-4cc4c6ac88b1%40apereo.org.
