Rob, I have also done some testing and it looks like the syslog daemons in Linux and BSD do not implement the rfc 3164. The rfc was written after the syslog was implemented and it claims to document observed behaviour, however the behaviour of the HOSTNAME field as specified in the rfc does not seem to be the same as the BSD or Linux implementations.
I think that the solution is to ignore the TIMESTAMP and HOSTNAME fields as the daemon should add them although their values may not be exactly what we want. My network admin tells me that syslogd is no longer typically run in 'remote' mode, i.e. only allows local processes to log. So the SyslogNativeAppender may be more usefull than the SyslogAppender. What do you think about calling the UDP version RemoteSyslogAppender and the libc version LocalSyslogAppender? Also we could write a mapping that allows the log4net level to syslog severity to be specified in the config file. It is probably not a good idea to send Emergency syslog messages unless you really mean it (Emergency log will wall all users!). Let me have a play around with this and do some more testing tomorrow and we will see how far we get. Cheers, Nicko > -----Original Message----- > From: Rob Lyon [mailto:[EMAIL PROTECTED] > Sent: 25 August 2004 00:08 > To: [email protected] > Subject: RE: syslog log4net appender > > Nicko, > > I mis-read your comments and I went ahead and re-wrote to the > RFC you sent. I did have to remove the options enumeration * > but probably not a problem. > > The newer syslog daemons by default do not accept network > traffic. The SyslogAppender will only work (like the log4j > version) if you enable network traffic with the "-r" option. > This could be considered a security risk. The native version > uses a unix socket and will work without reconfiguring the > syslogd options. > > The timestamp and host are being added automatically by the > daemon (I tried to override with the event timestamp, but was > unsuccessful). I did add, per your comment, a tag with a > pid. The Udp and Native versions now appear the same in the log. > > Thanks, > Rob > > >>> [EMAIL PROTECTED] 8/24/04 03:03 PM >>> > Rob, > > This looks great. A couple of things. > > I would rather not have to include the BSD licence as it does > complicate things. I will go back to the RFC > (http://www.faqs.org/rfcs/rfc3164.html) and rewrite those > portions as necessary. > > Does the native mono appender do anything that the SyslogAppender (Udp > based) cannot do? > Reading through the man page it looks like it is following > exactly the same protocol. Are there times when a call to > syslog(3) will work but there isn't a syslog deamon listening? > > Looking at the syslog protocol it looks as though we should > be including the date, hostname and a tag in the content of > the message. I know that we can specify this in the layout, > but it might be better to do it in code because it has a fixed format. > > Cheers, > > Nicko > > > -----Original Message----- > > From: Rob Lyon [mailto:[EMAIL PROTECTED] > > Sent: 24 August 2004 21:30 > > To: [email protected] > > Subject: RE: syslog log4net appender > > > > This is a cleaned-up version that includes a native version for > > Mono/Linux. > > > > Rob > > > > >>> [EMAIL PROTECTED] 8/24/04 11:11 AM >>> > > I attached an implementation of a syslog log4net appender. > > Please review. I added a BSD license header because I used the > > defines from syslog.h. Is that correct? Please review the > copyright > > and license. > > > > Thanks, > > Rob > > > > >>> [EMAIL PROTECTED] 8/22/04 10:16 AM >>> > > Rob, > > > > You may want to look at the log4j syslog implementation: > > > > http://cvs.apache.org/viewcvs.cgi/logging-log4j/src/java/org/a > > pache/log4 > > > > > > j/net/SyslogAppender.java?rev=1.18&view=auto > > > > http://cvs.apache.org/viewcvs.cgi/logging-log4j/src/java/org/a > > pache/log4 > > > > > > j/helpers/SyslogWriter.java?rev=1.5&view=auto > > > > http://cvs.apache.org/viewcvs.cgi/logging-log4j/src/java/org/a > > pache/log4 > > > > > > j/helpers/SyslogQuietWriter.java?rev=1.5&view=auto > > > > Nicko > > > > > -----Original Message----- > > > From: Rob Lyon [mailto:[EMAIL PROTECTED] > > > Sent: 21 August 2004 16:06 > > > To: [email protected] > > > Subject: syslog log4net appender > > > > > > I need a syslog log4net appender. Has anyone started an > > > implementation? > > > Does anyone have any suggestions as I start an implementation? > > > > > > Thanks, > > > Rob > > > > > > > > > >
