You also might want to give Syslog4j a look - http://syslog4j.org/
I don't know specifically if it will solve your issue but it can be used as a log4j appender. Brian On Thu, Jun 14, 2012 at 8:00 AM, Florian Crouzat <[email protected]>wrote: > Le 14/06/2012 12:32, Rainer Gerhards a écrit : > >> >> >> -----Original Message----- >>> From: >>> [email protected].**com<[email protected]>[mailto: >>> rsyslog- >>> [email protected]] On Behalf Of Florian Crouzat >>> Sent: Thursday, June 14, 2012 11:01 AM >>> To: [email protected] >>> Subject: Re: [rsyslog] %msg% is missing a part of the message received in >>> %rawmsg% >>> >>> Le 14/06/2012 10:46, Florian Crouzat a écrit : >>> >>>> Hi, >>>> >>>> Since a couple weeks I started configuring jboss to log through syslog >>>> using a syslog log4j appender. Everything is fine except I sometimes >>>> miss a part of the very first line of some stacktraces. >>>> >>>> My configuration is the following, jboss -> log4j -> rsyslog -> >>>> server.log. >>>> I created a raw template for comparison. >>>> >>>> $template jbossFormat,"%timegenerated% host.example.com jboss: >>>> >>> %msg%\n" >>> >>>> $template jbossFormatRAW,"%rawmsg%\n" >>>> local2.* /var/log/jboss/server.log;**jbossFormat >>>> local2.* /var/log/jboss/raw.log;**jbossFormatRAW >>>> local2.* ~ >>>> >>>> As you can see, one use %msg%, the other %rawmsg%. >>>> My problem: there is a difference between the "message" part of the two >>>> template, see http://pastie.org/4085022 >>>> >>>> Line 2 of the jbossFormat template is missing the >>>> "com.foo.bar.baz.exception.**InvalidSessionException:" part. >>>> >>>> It seems jboss and log4j are working fine since it's present in %rawmsg% >>>> so why it doesn't reach %msg% ? >>>> >>>> Thanks in advance. >>>> >>>> >>> I think I get it, but I'd like confirmation, and maybe even a solution >>> (not using Java would be a great one, yes) >>> Java stacktraces are multilines. Only the first line goes through the >>> log4j pattern layout. So a stacktrace in %rawmsg% looks like this: >>> >>> >>> <148>local2:WARN [ 1.2.3.4 ] [**InternalTransactionOperationMa** >>> nagerBean >>> ] - Transaction error ! >>> <148>foo.bar.exception.**TransactionException: fooError = >>> transaction.notfound >>> <148> at >>> foo.bar..manager.transaction.**cancel(TransactionOperation.**java:323) >>> <148> at sun.reflect.**GeneratedMethodAccessor1234.**invoke(Unknown >>> Source) >>> <148> at >>> sun.reflect.**DelegatingMethodAccessorImpl.**invoke(** >>> DelegatingMethodAccessorI >>> mpl.java:48) >>> >>> As I already said, lines 1,3,4& 5 are logged "properly", line is >>> >>> complete and prepended by my rsyslog template header. >>> >>> Line 2 isn't. My guess: rsyslog thinks that >>> "foo.bar.exception.**TransactionException:" is the syslogfacility and >>> removes it for %msg% as it's not "the message". >>> >>> Could it be so ? >>> >> >> Yeah, the default log4j syslog appender is know to emit severely >> malformed messages. You may find this small appender useful: >> >> http://www.rsyslog.com/tcp-**syslog-rfc5424-log4j-appender/<http://www.rsyslog.com/tcp-syslog-rfc5424-log4j-appender/> >> >> In any case, I think the rsyslog parser also screws up in line 2. I >> (think) I would expect that "foo.bar..." ends up as tag. >> >> Rainer >> > > Thanks for your quick answer. > So it what I was afraid of, the first part of the line is considered as a > tag... > Thanks for suggesting your appender, your already mentionned it in another > mail exchange we had and I think I can't really use it because of security > constraints. > > I'll see what I kind do, either in Java or I'll use %rawmsg% in my regular > template. > > -- > Cheers, > Florian Crouzat > > ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
