Right, I believe the throwable option change the control character. The problem with stack traces coming out of log4j is they use a vertical tab for a delimiter. Rsyslog picks this up as a control character hence the multiple entries per stack trace. The conversion pattern in the sample log4j.xml is appender agnostic so you can use it with file, console, etc.
So really if you want to work around vertical tabs in rsyslog (which can have other problems) that works too. Sorry for the delayed response, Eric On Sunday, August 4, 2013, David Lang wrote: > On Fri, 2 Aug 2013, Zippy Zeppoli wrote: > > Hi Eric, >> I haven't tried the log4j option yet but it seems like thats the >> recommended method and I am keeping it in mind. >> >> However, I am wondering if anyone out there in rsyslog land is >> successfully >> logging stack traces using the file appender? >> >> The only documentation I've seen says >> $InputFileReadMode 2 >> $**EscapeControlCharactersOnRecei**ve off >> >> Should do it and fix the problem, but it doesn't seem to do anything. >> > > actually, I think you need to allow it to escape control characters. > > without escaping the control characters (including the newline), > additional processing of the log message as it's sent from machine to > machine may cause it to be split again. > > what exactly are you seeing that's telling you that this isn't working? > > David Lang > > > On Fri, Aug 2, 2013 at 12:18 PM, Eric Black <[email protected]> wrote: > > Heya, > > So I ran into this problem as well. I was able to solve it with this log4j > appender layout. > > <appender name="syslog-appender" > class="org.apache.log4j.net.**SyslogAppender"> > <param name="SyslogHost" value="10.200.11.182"/> > <param name="Facility" value="USER"/> > <param name="FacilityPrinting" value="true"/> > <layout class="org.apache.log4j.**EnhancedPatternLayout"> > <!-- notice the ConversionPattern is the same with the > difference of %m%throwable%n > which prints the stack trace as a single %m escaping the > control characters --> > <param name="ConversionPattern" value="%-5p | %d{MM-dd-yyyy > HH:mm:ss.SSS} | %t | %c(0) - %m%throwable%n"/> > </layout> > </appender> > > Specifically the throwable option. Hopefully this is helpful for you. > > Eric > > > On Fri, Aug 2, 2013 at 12:14 PM, Zippy Zeppoli <[email protected] > > wrote: > > > Here is what it looks like on boot: > Aug 2 12:14:07 rsyslog-server kernel: Kernel logging (proc) stopped. > Aug 2 12:14:07 rsyslog-server rsyslogd: [origin software="rsyslogd" > swVersion="5.8.10" x-pid="1307" x-info="http://www.rsyslog.com**";] exiting > on > signal 15. > Aug 2 12:14:07 rsyslog-server kernel: imklog 5.8.10, log source = > /proc/kmsg started. > Aug 2 12:14:07 rsyslog-server rsyslogd: [origin software="rsyslogd" > swVersion="5.8.10" x-pid="1327" x-info="http://www.rsyslog.com**";] start > > > On Fri, Aug 2, 2013 at 11:31 AM, Zippy Zeppoli <[email protected] > > wrote: > > > here is the version. sorry about the double reply. > > [root@rsyslog-server ~]# rpm -q rsyslog > rsyslog-5.8.10-6.el6.x86_64 > [root@rsyslog-server ~]# cat /etc/issue > CentOS release 6.3 (Final) > Kernel \r on an \m > > > > ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > > ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > > ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sit > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
