Yes, sorry about that. I forgot that we have a customized class for log4j
syslog
(to try to fix the stack trace problem(s)).
This may work:
<param name="ConversionPattern" value="service [%p] %c{1}:%L -> %m%n" />
Check the docs - maybe
http://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/PatternLayout.html
Alan Edmonds
> -----Original Message-----
> From: [email protected] [mailto:rsyslog-
> [email protected]] On Behalf Of Hanish Bansal
> Sent: 10 October 2013 14:42
> To: rsyslog-users
> Subject: Re: [rsyslog] Logging for different components using different
> facility level
>
> Hi Alan,
>
> SuffixPattern may solve our problem. But my SyslogAppender is not
> supporting *SuffixPattern* property. I am using *
> org.apache.log4j.net.SyslogAppender* .
>
> My log4j.xml configuration is:
>
> <appender name="syslog"
> class="org.apache.log4j.net.SyslogAppender">
> <param name="facility" value="local3" />
> <param name="facilityPrinting" value="true" />
> <param name="syslogHost" value="100.125.12.154" />
> <param name="threshold" value="info" />
> <layout class="org.apache.log4j.PatternLayout">
> <param name="ConversionPattern" value="[%p] %c{1}:%L -
> %m%n" />
> </layout>
> </appender>
>
> Are you using different class for syslog?
>
>
>
>
> On Thu, Oct 10, 2013 at 6:12 PM, Edmonds, Alan
> <[email protected]>wrote:
>
> > Here we have multiple JVMs. Each JVM contains the applications for a
> > "service".
> > We want our logs organized by "service". In not sure if you have
> separate
> > log4j/logback
> > Configurations for each component...
> >
> > So what works for us, is to have each put a "service" name in the
> > logback.xml suffix pattern:
> >
> > <appender name="SYSLOG" >
> > <syslogHost>syslog</syslogHost>
> > <facility>LOCAL0</facility>
> > <suffixPattern>servicename %-5level %logger{36}%replace(
> > %X{log-keyword} ){' ',' '}- %msg%nopex%n</suffixPattern>
> > </appender>
> >
> > The on the syslog server, rsyslog does this:
> >
> > $template
> > AppFileTemplate,"/var/logs/%$YEAR%/%$MONTH%/%$DAY%/%programname%.log"
> > $template AppFileFormat,"%HOSTNAME% %TIMESTAMP:::date-rfc3339%
> > <%syslogfacility-text%,%syslogseverity-text%>
> > %programname%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
> >
> > local0.* ?AppFileTemplate;AppFileFormat
> >
> > Stack traces can be a problem with this though. But you get the
> idea.
> >
> > Alan Edmonds
> >
> >
> > > -----Original Message-----
> > > From: [email protected] [mailto:rsyslog-
> > > [email protected]] On Behalf Of Hanish Bansal
> > > Sent: 10 October 2013 13:24
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] Logging for different components using
> different
> > > facility level
> > >
> > > I can not use *':msg, contains, "<something>"' *because my log
> messages
> > > are
> > > completely random.
> > >
> > > As you suggested i tried *programname *and also* app-name *but hard
> > > luck !!
> > > I didn't get much success. Because *programname *and *app-name*
> both
> > > are
> > > giving value as facility name, in mycase value of programname and
> app-
> > > name
> > > is *local3* because my facility level is local3.
> > >
> > >
> > >
> > > On Wed, Oct 9, 2013 at 8:31 PM, Jeremy Hoel <[email protected]>
> wrote:
> > >
> > > > You don't have to define the application name, just know that
> it's
> > > > present in the syslogs that it writes. It would be helpful to
> have
> > > > examples to see.. but for rough ideas, you could do things like
> this:
> > > >
> > > > template (name="logs" type="string"
> > > > string="/data/logs/java/%HOSTNAME%-%$YEAR%%$MONTH%%$DAY%")
> > > > :programname, isequal, "java" action(type="omfile"
> > > > DirCreateMode="0755" FileCreateMode="0644" dynafile="javalogs")
> > > > :programname, isequal, "java" stop
> > > >
> > > > Or, if the program name field isn't java you could used ':msg,
> > > > contains, "<something>" ' that is common to all those types of
> > > > messages.
> > > >
> > > >
> > > > Examples of the logs you are looking at would help. And since
> you
> > > are
> > > > specifying a log server, can you change the port in that
> > > > specification? You could use a non standard port and do something
> > > > simple like this
> > > >
> > > >
> > > > template (name="logs" type="string"
> > > > string="/data/logs/java/%HOSTNAME%-%$YEAR%%$MONTH%%$DAY%")
> > > > ruleset(name="java"){
> > > > action(type="omfile" dynafile="javalogs")
> > > > stop
> > > > }
> > > > input(type="imptcp" port="10514" ruleset="java")
> > > >
> > > > On Wed, Oct 9, 2013 at 7:09 AM, Hanish Bansal
> > > > <[email protected]> wrote:
> > > > > Hi
> > > > >
> > > > > I am not defining application name in logging configuration. In
> my
> > > java
> > > > > application i define below configuration in log4j.xml file:
> > > > >
> > > > > <appender name="syslog"
> > > class="org.apache.log4j.net.SyslogAppender">
> > > > > <param name="facility" value="local3" />
> > > > > <param name="facilityPrinting" value="true" />
> > > > > <param name="syslogHost" value="100.125.12.154" />
> > > > > <param name="threshold" value="info" />
> > > > > <layout class="org.apache.log4j.PatternLayout">
> > > > > <param name="ConversionPattern" value="[%p]
> %c{1}:%L -
> > > %m%n"
> > > > />
> > > > > </layout>
> > > > > </appender>
> > > > >
> > > > > Where 100.125.12.154 is syslog server.
> > > > >
> > > > > In /etc/rsyslog.conf on machine 100.125.12.154 i define below
> > > > configuration
> > > > > to maintain logs:
> > > > >
> > > > > $template LOCAL3,"/var/log/component3.log"
> > > > > local3.* ?LOCAL3
> > > > >
> > > > > Could you please elaborate how to define rules for maintaining
> > > different
> > > > > log files using same facility level for different components?
> > > > >
> > > > >
> > > > > On Wed, Oct 9, 2013 at 12:21 PM, Jeremy Hoel <[email protected]>
> > > wrote:
> > > > >
> > > > >> Of the different components can use different ports you can
> base
> > > rules
> > > > >> around the port of the listener and run a few listeners. Or if
> the
> > > > >> components have different t application names you can run a
> if-
> > > then rule
> > > > >> and send different applications to different log files.
> > > > >> On Oct 9, 2013 12:26 AM, "Hanish Bansal" <
> > > > [email protected]>
> > > > >> wrote:
> > > > >>
> > > > >> > Hi All,
> > > > >> >
> > > > >> > I have more than 10 components and i want to maintain logs
> of
> > > those
> > > > >> > component as different log files. If i have 10 components
> then i
> > > want
> > > > 10
> > > > >> > log files one for each component.
> > > > >> >
> > > > >> > I am using facilities level from local1 to local6. Using
> this i
> > > am
> > > > able
> > > > >> to
> > > > >> > maintain logs of 6 components. As we define one facility
> level
> > > for one
> > > > >> > component. Using this scenario i am limited not to have
> more
> > > log
> > > > files.
> > > > >> >
> > > > >> > What should i do for maintaining logs for different
> components?
> > > > >> >
> > > > >> >
> > > > >> > Thanks in Advance !!!
> > > > >> >
> > > > >> > --
> > > > >> > *Regards*
> > > > >> > *Hanish Bansal*
> > > > >> > _______________________________________________
> > > > >> > rsyslog mailing list
> > > > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > >> > http://www.rsyslog.com/professional-services/
> > > > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by
> > > a
> > > > myriad
> > > > >> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > > if you
> > > > >> > DON'T LIKE THAT.
> > > > >> >
> > > > >> _______________________________________________
> > > > >> rsyslog mailing list
> > > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > >> http://www.rsyslog.com/professional-services/
> > > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED
> by a
> > > myriad
> > > > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST if
> > > you
> > > > >> DON'T LIKE THAT.
> > > > >>
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > *Thanks & Regards*
> > > > > *Hanish Bansal*
> > > > > _______________________________________________
> > > > > rsyslog mailing list
> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > > http://www.rsyslog.com/professional-services/
> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
> a
> > > myriad
> > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if
> > > you
> > > > DON'T LIKE THAT.
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad
> > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if
> > > you
> > > > DON'T LIKE THAT.
> > > >
> > >
> > >
> > >
> > > --
> > > *Thanks & Regards*
> > > *Hanish Bansal*
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> POST
> > > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad
> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
> you
> > DON'T LIKE THAT.
> >
>
>
>
> --
> *Thanks & Regards*
> *Hanish Bansal*
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
