Hi James,
for scenario A (log4j logging to a file and using imfile on the rsyslog) I
have this configuration:
Log4j:
*# OPTION A: log4j: file; local file: rocks; rsyslog server: missing
INFO*
log4j.rootLogger=INFO,stdout,R
# stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%5p %d{HH:mm:ss,SSS} %m%n
# Rolling log file
log4j.appender.R=org.apache.log4j.RollingFileAppender
log4j.appender.R.maxFileSize=20MB
log4j.appender.R.maxBackupIndex=50
log4j.appender.R.layout=org.apache.log4j.PatternLayout
log4j.appender.R.layout.ConversionPattern=%d{dd MMM yyyy HH:mm:ss,SSS} %-5p
%c{1}:%L - %m%n
log4j.appender.R.File=/var/log/cassandra/system.log
rsyslog.conf:
....
# escapelf="on" LF escaping turned on by default
module(load="imfile") #needs to be done just once
# List local files
# Cassandra log
input(type="imfile"
File="/var/log/cassandra/system.log"
Tag="cassandra:"
StateFile="stat-tss-cass9-1"
ReadMode="2"
Severity="info"
Facility="local2")
....
if $syslogfacility-text == 'local0' or $syslogfacility-text == 'local1' or
$syslogfacility-text == 'local2' then {
action(type="omrelp" target="127.0.0.1" port="20500" template="GroupApp"
queue.filename="app_queue"
queue.type="linkedlist"
queue.spoolDirectory="/mnt/spool/rsyslog"
queue.highwatermark="8000"
queue.lowwatermark="6000"
queue.maxdiskspace="1g"
queue.timeoutenqueue="0"
queue.saveonshutdown="on"
queue.size="10000" )
stop
}
I am using facility local2 for imfile in the rsyslog configuration. In this
case, the box is using stunnel (127.0.01) to send it to the remote rsyslog.
Local logs work correctly but I see there are some missing INFO logs on the
server.
About second scenario, using an appender I don't understand exactly what
you suggested. I tried the SyslogTCPAppender that people on that mailing
list suggested but I am not sure I am configuring log4j correctly to use
it. The configuration is what I wrote on my first email
*log4j:*
log4j.rootLogger=INFO, SYSLOG
log4j.appender.SYSLOG=org.apache.log4j.net.SyslogTCPAppender
log4j.appender.SYSLOG.syslogHost=localhost
log4j.appender.SYSLOG.layout=org.apache.log4j.EnhancedPatternLayout
##log4j.appender.SYSLOG.layout.ConversionPattern=%-4r [%t] %-5p %c %x - %m%n
log4j.appender.SYSLOG.layout.ConversionPattern=cassandra: %m
%throwable{short} %n
log4j.appender.SYSLOG.Header=true
log4j.appender.SYSLOG.Facility=LOCAL1
rsyslog.conf is the same than above but removing the imfile section. As I
said before, I copied the jar file to the jar app directory and restart
Cassandra but it doesn't seem to be enough. It doesn't log anything.
Thanks a lot for your help,
Xavi
On 16 September 2014 16:48, Boylan, James <[email protected]> wrote:
> For the first scenario, it could be several things. A pastebin of the
> config would help.
>
> For the second, if you are using an appender I actually recommend
> urlencoding the message payload. That will remove the multi-line issue
> completely and is how we are currently handling our java logs, both ones
> written to disk and streamed using an appender.
>
> -- James
> --- Sent from my mobile phone ---
>
> ----- Reply message -----
> From: "Xavier Fustero" <[email protected]>
> To: "rsyslog-users" <[email protected]>
> Subject: [rsyslog] SyslogTCPAppender help!
> Date: Tue, Sep 16, 2014 6:25 PM
>
> Hi,
>
> let me explain my problem first. I am trying to log Cassandra logs locally
> and sending them to a remote server.
>
> So far I have tried it:
>
> A. Configure log4j to write to a file and configure rsyslog to use imfile
> for reading it and sending to the remote server.
> I don't know why but the local file contains much more INFO than in the
> server. It is not only that rsyslog skipe java stack traces it actually
> miss some INFO logs. So it doesn't seem to be working. I don't understand
> much this behaviour honestly.
>
> B. Use SyslogAppender. I have already read that this is not working
> properly. Apparently it works for me but if I get a multi-line logs I get
> the extraneous logs in the server as my parser just crash with these lines.
>
> C.I read http://www.rsyslog.com/tcp-syslog-rfc5424-log4j-appender/ and try
> to use it but I can't get it working.
>
> I have download the SyslogTCPAppender.tar.gz and copied the jar file to the
> same path where I have all jar files I am using in my Cassandra. Then have
> modified the log4j to use this appender in that way:
>
> log4j.rootLogger=INFO, SYSLOG
>
> log4j.appender.SYSLOG=org.apache.log4j.net.SyslogTCPAppender
> log4j.appender.SYSLOG.syslogHost=localhost
> log4j.appender.SYSLOG.layout=org.apache.log4j.EnhancedPatternLayout
> ##log4j.appender.SYSLOG.layout.ConversionPattern=%-4r [%t] %-5p %c %x -
> %m%n
> log4j.appender.SYSLOG.layout.ConversionPattern=cassandra: %m
> %throwable{short} %n
> log4j.appender.SYSLOG.Header=true
> log4j.appender.SYSLOG.Facility=LOCAL1
>
>
> I am basically a bit lost on how to use that Appender on log4j. Am I
> missing some important step here?
>
> Thanks a lot for your help,
> Xavi
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
