<font>Done. <br><br></font><font>Credit where credit is due, it was actually my coworker Marius Eikenes </font>that proposed this way of fixing the problem.<br>Thanx for looking into this, it's much appreciated.<br><br>
cheers, <br>Ingebrigt<br><br><div class="gmail_quote">Den 09:08 12. april 2012 skrev ceki <span dir="ltr"><<a href="mailto:ceki@qos.ch">ceki@qos.ch</a>></span> følgende:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Ingebrigt,<br>
<br>
Are you familiar with git/github? In short, you would fork logback on github, make your changes and then send me a pull request. Posting a diff file with your changes would be OK as well.<br>
<br>
BTW, I quite like your idea of a separate pattern for the stack trace.<br>
<br>
Best regards,<br>
-- <br>
Ceki<br>
<a href="http://twitter.com/#%21/ceki" target="_blank">http://twitter.com/#!/ceki</a><div><div class="h5"><br>
<br>
<br>
On 11.04.2012 16:57, Ingebrigt Berg wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Hi again.<br>
<br>
As suggested I've implemented a POC on how SyslogAppender could be<br>
fixed, and have got it working. It resolves our issue. With the changes<br>
I made, the stacktrace lines can be prefixed as required, and with the<br>
proper configuration they now end up in the correct file on our logserver.<br>
<br>
My configuration now looks like this:<br>
<br>
<contextName>xxx-${CONTEXT_<u></u>PATH}-${environment}</<u></u>contextName><br>
<appender name="LOGSERVER_FILE" class="no.xxx.logback.<u></u>SyslogAppender"><br>
<contextName>xxx-${CONTEXT_<u></u>PATH}-${environment}</<u></u>contextName><br>
<syslogHost>localhost</<u></u>syslogHost><br>
<facility>local3</facility><br>
<SuffixPattern>%contextName %d{dd.MM.yyyy HH:mm:ss.SSS} [%p] [%c{1}]<br>
[%X{ThreadId}]: %m%n</SuffixPattern><br>
<StackTraceSuffixPattern>xxx-$<u></u>{CONTEXT_PATH}-${environment} -<br>
</StackTraceSuffixPattern><br>
</appender><br>
<br>
( Notice the new property <StackTraceSuffixPattern> )<br>
<br>
All I had to change in the code (in SyslogAppender.java) was to<br>
implement a new member variable stackTraceSuffixPattern (plus<br>
getter/setter) and to append it in line 89 (after the prefix and before<br>
the tab).<br>
<br>
In actual code I imagine you'd also want to add:<br>
-a null test, to make the new parameter optional<br>
-the new property should be subjected to pattern convertion (this was<br>
not required for my POC to work, but would be nice/expected)<br>
<br>
If someone would work with me and get this fix into logback proper it<br>
would be much appreciated. I can send/post working code. For how to best<br>
activate pattern conversion for the new property I would hope to get<br>
some help/guidance.<br>
<br>
cheers,<br>
Ingebrigt Berg<br>
<br>
<br>
Den 14:48 30. mars 2012 skrev Ingebrigt Berg <<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a><br></div></div>
<mailto:<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a>>> følgende:<div><div class="h5"><br>
<br>
Hi !<br>
<br>
We have looked more into this issue.<br>
<br>
From a TCPdump for the traffic between the app (using logback) and<br>
the syslog-server we learn that each line in the stacktrace is<br>
actually sent as a separate message to syslog (sensitive info<br>
replaced with xx/yy/zz):<br>
<br>
11:28:37.911604 IP xx<br>
localhost.localdomain.55934 > localhost.localdomain.syslog:<br>
[bad udp cksum af4f!] SYSLOG, length: 101<br>
Facility local3 (19), Severity error (3)<br>
Msg: Mar 30 11:28:37 yy2-31 zz-mce-test 30.03.2012<br>
11:28:37.910 [ERROR] [LogbackTester] []: Fjas\0x0a<br>
11:28:37.912028 IP xx<br>
localhost.localdomain.55934 > localhost.localdomain.syslog:<br>
[bad udp cksum 6076!] SYSLOG, length: 104<br>
Facility local3 (19), Severity error (3)<br>
Msg: Mar 30 11:28:37 yy2-31 \0x09at<br>
sun.reflect.<u></u>NativeConstructorAccessorImpl.<u></u>newInstance0(Native Method)<br>
<br>
The first packet is a regular log statement, the second one is a<br>
line in a stack trace.<br>
<br>
Notice how<br>
'zz-mce-test 30.03.2012 11:28:37.910 [ERROR] [LogbackTester] []:'<br>
is replaced with:<br>
'\0x09at'<br>
<br>
If we interpret this correctly, SyslogAppender will log the error<br>
message and each StackTraceElement separately. But for the<br>
StackTraceElements it will ignore what we configure in the<br>
<SuffixPattern> property:<br>
( <SuffixPattern>%contextName %d{dd.MM.yyyy HH:mm:ss.SSS} [%p]<br>
[%c{1}] [%X{ThreadId}]: %m%n</SuffixPattern> )<br>
Instead the stackline messages simply get a '\0x09at' (a TAB)<br>
appended in place of the SuffixPattern.<br>
<br>
This happens in line 89 in <a href="http://ch.qos.logback.classic.net" target="_blank">ch.qos.logback.classic.net</a>.<u></u>SyslogAppender:<br>
sb.append(prefix).append(<u></u>CoreConstants.TAB).append(<u></u>step);<br>
<br>
Contrast that to line 59 in<br>
<a href="http://ch.qos.logback.classic.net" target="_blank">ch.qos.logback.classic.net</a>.<u></u>SyslogAppender (normal messages), where<br>
the SuffixPattern gets added:<br>
fullLayout.setPattern(<u></u>prefixPattern + suffixPattern);<br>
<br>
We see two viable solutions:<br>
<br>
EITHER:<br>
when a message is split into a main message and StackTraceElements,<br>
the StackTraceElement messages must also get the content of the<br>
<SuffixPattern> appended<br>
<br>
OR:<br>
an optional property <StackTraceSuffixPattern> could be added to<br>
SyslogAppender, allowing control of what goes into StackTraceElement<br>
messages.<br>
<br>
cheers,<br>
Ingebrigt Berg + Marius Eikenes<br>
<br>
<br>
Den 11:40 20. mars 2012 skrev Ingebrigt Berg <<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a><br></div></div>
<mailto:<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a>>> følgende:<div><div class="h5"><br>
<br>
Hi !<br>
<br>
We've recently made the switch from Log4j to Logback. We use<br>
Syslog to send logfiles to our logserver, and things generally work.<br>
<br>
But when there are stacktraces in the logs we get in trouble.<br>
SyslogAppender will replace lineshifts with '#011' to make the<br>
logentry a single line. Then it will cut each line that is to<br>
long according to the syslog limit of 2K/line. Only the fist<br>
segment will arrive in the correct log. The remaining segments<br>
are not prefixed with everything in the suffixPattern, and our<br>
regexp will not have anything to match. The segment will end up<br>
in a 'trash' log for unmatchable loglines.<br>
<br>
My config for the SyslogAppender looks like this:<br>
<br>
<contextName>company-${<u></u>CONTEXT_PATH}-${environment}</<u></u>contextName><br>
<appender name="LOGSERVER_FILE"<br>
class="ch.qos.logback.classic.<u></u>net.SyslogAppender"><br>
<syslogHost>localhost</<u></u>syslogHost><br>
<facility>local3</facility><br>
<SuffixPattern>%contextName %d{dd.MM.yyyy HH:mm:ss.SSS} [%p]<br>
[%c{1}] [%X{ThreadId}]: %m%n</SuffixPattern><br>
</appender><br>
<br>
We use the contextName property to control the logfilename. On<br>
the receiving end we read the contextName parameter (using a<br>
regexp) for each log line, and write the line to a file with a<br>
corresponding name.<br>
<br>
We had a similar problem when we used Log4J (Where the Tag<br>
element was used in the same manner), and fixed it back then by<br>
writing a custom log4j SyslogAppender. But the main purpose of<br>
moving to Logback is to loose all our home brew logging stuff,<br>
we don't want to go down that path again. If we can't make<br>
Logback work out of the box with Syslog we'll probably end up<br>
going back to Log4J. (Another alternative is to replace Syslog<br>
with Gelf, but that's further down the road).<br>
<br>
However, I imagine Logback and Syslog being a common<br>
combination, and surely someone must have this working out of<br>
the box. Any advice will be appreciated. My requirements are simple:<br>
-must work with no custom logging code, only config (preferably xml)<br>
-stacktraces in logs must work<br>
-must be able to fully control the filename on the recieving end.<br>
<br>
cheers,<br>
Ingebrigt Berg<br>
<br>
</div></div></blockquote>
______________________________<u></u>_________________<br>
Logback-user mailing list<br>
<a href="mailto:Logback-user@qos.ch" target="_blank">Logback-user@qos.ch</a><br>
<a href="http://mailman.qos.ch/mailman/listinfo/logback-user" target="_blank">http://mailman.qos.ch/mailman/<u></u>listinfo/logback-user</a><br>
</blockquote></div><br>