Hi,
I'm trying to log messages from graylog-server to a syslog listener. But log4j
included in graylog-server package does not send any message to the listener.
A test with a Socket Appender seems to work fine, nc -klp 9500 127.0.0.1
outputs a lot of garbage:
<?xml version="1.0" encoding="UTF-8"?>
<Configuration packages="org.graylog2.log4j" shutdownHook="disable">
<Appenders>
<!- ... -->
<Socket name="socket" host="localhost" port="9500">
<SerializedLayout />
</Socket>
<!-- Internal Graylog log appender. Please do not disable. This makes
in
ternal log messages available via REST calls. -->
<Memory name="graylog-internal-logs" bufferSize="500"/>
</Appenders>
<Loggers>
<!-- Application Loggers -->
<!-- ... -->
<Root level="warn">
<AppenderRef ref="rolling-file"/>
<AppenderRef ref="socket"/>
<AppenderRef ref="graylog-internal-logs"/>
</Root>
</Loggers>
But if I test the Syslog Appender, no message arrives at nc -klp 8514
127.0.0.1. I copy and pasted from
https://logging.apache.org/log4j/2.x/manual/appenders.html#SyslogAppender to
avoid typos:
<?xml version="1.0" encoding="UTF-8"?>
<Configuration packages="org.graylog2.log4j" shutdownHook="disable">
<Appenders>
<!- ... -->
<Syslog name="RFC5424" format="RFC5424" host="localhost" port="8514"
protocol="TCP" appName="MyApp" includeMDC="true"
facility="LOCAL0" enterpriseNumber="18060" newLine="true"
messageId="Audit" id="App"/>
<!-- Internal Graylog log appender. Please do not disable. This makes
in
ternal log messages available via REST calls. -->
<Memory name="graylog-internal-logs" bufferSize="500"/>
</Appenders>
<Loggers>
<!-- Application Loggers -->
<!-- ... -->
<Root level="warn">
<AppenderRef ref="rolling-file"/>
<AppenderRef ref="RFC5424"/>
<AppenderRef ref="graylog-internal-logs"/>
</Root>
</Loggers>
Any clue what is going wrong? Why is only the Socket example working and the
Syslog test isn't?
Thanks
Frank
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/2356262.h3jl1WoZ6B%40studio.engler.invalid.
For more options, visit https://groups.google.com/d/optout.
