<div><font>Hi !<br></font></div><div><font><br></font></div><div><font>I completed some changes in SyslogAppender a month ago, but no response so far, and my pull request has expired.<br></font></div><div><font>Sending a last reminder, in case it has simply been forgotten (</font><font>let me know if you want me to issue another pull request). <br>
</font></div><div><font><br></font></div><div><font>cheers,<br></font></div><div><font>Ingebrigt<br></font></div><div><font><br></font></div><div><font><br></font></div><br><div class="gmail_quote">2012/4/19 Ingebrigt Berg <span dir="ltr"><<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><font>Hi Ceki!<br><br>Just checking up on this, if it's likely to go into Logback, and if you think there are any further changes required on my part.<br>
<br>I've been using a local copy of the changes in SyslogAppender in 2 applications. They have been tested all week (the newest version including a stacktraceLayout), so far they're doing fine and our problems with Syslog logging are gone. Production on april 25 (I don't expect this to be in logback by then).<br>
<br>No hurry in getting the fix in, but it's important to know soon if Logback will eventually include this (or a functionally similar) fix. I have another 20-30 applications I'll be doing similar maintenance work on over the next few months, and until I know where this is heading it's a bit difficult to get a go ahead on moving them all from Log4j to Logback (We don't really want to maintain inhouse modifications to Logback permanently).<br>
<br>cheers,<br>Ingebrigt<br><br><br><br></font><br><div class="gmail_quote">Den 15:22 12. april 2012 skrev ceki <span dir="ltr"><<a href="mailto:ceki@qos.ch" target="_blank">ceki@qos.ch</a>></span> følgende:<div><div>
<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
FYI, I just commented on <a href="https://github.com/ceki/logback/pull/42" target="_blank">https://github.com/ceki/logback/pull/42</a><div><br>
<br>
<br>
On 12.04.2012 15:20, Ingebrigt Berg wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>
Done.<br>
<br>
Credit where credit is due, it was actually my coworker Marius Eikenes<br>
that proposed this way of fixing the problem.<br>
Thanx for looking into this, it's much appreciated.<br>
<br>
cheers,<br>
Ingebrigt<br>
<br></div>
Den 09:08 12. april 2012 skrev ceki <<a href="mailto:ceki@qos.ch" target="_blank">ceki@qos.ch</a> <mailto:<a href="mailto:ceki@qos.ch" target="_blank">ceki@qos.ch</a>>><div><br>
følgende:<br>
<br>
Hi Ingebrigt,<br>
<br>
Are you familiar with git/github? In short, you would fork logback<br>
on github, make your changes and then send me a pull request.<br>
Posting a diff file with your changes would be OK as well.<br>
<br>
BTW, I quite like your idea of a separate pattern for the stack trace.<br>
<br>
Best regards,<br>
--<br>
Ceki<br></div>
<a href="http://twitter.com/#%21/ceki" target="_blank">http://twitter.com/#!/ceki</a> <<a href="http://twitter.com/#%21/ceki" target="_blank">http://twitter.com/#%21/ceki</a>><div><br>
<br>
<br>
<br>
On 11.04.2012 16:57, Ingebrigt Berg wrote:<br>
<br>
Hi again.<br>
<br>
As suggested I've implemented a POC on how SyslogAppender could be<br>
fixed, and have got it working. It resolves our issue. With the<br>
changes<br>
I made, the stacktrace lines can be prefixed as required, and<br>
with the<br>
proper configuration they now end up in the correct file on our<br>
logserver.<br>
<br>
My configuration now looks like this:<br>
<br></div>
<contextName>xxx-${CONTEXT___PATH}-${environment}</__contextName><br>
<appender name="LOGSERVER_FILE"<br>
class="no.xxx.logback.__SyslogAppender"><br>
<contextName>xxx-${CONTEXT___PATH}-${environment}</__contextName><br>
<syslogHost>localhost</__syslogHost><div><br>
<facility>local3</facility><br>
<SuffixPattern>%contextName %d{dd.MM.yyyy HH:mm:ss.SSS} [%p] [%c{1}]<br>
[%X{ThreadId}]: %m%n</SuffixPattern><br></div>
<StackTraceSuffixPattern>xxx-$__{CONTEXT_PATH}-${environment} -<div><br>
</StackTraceSuffixPattern><br>
</appender><br>
<br>
( Notice the new property <StackTraceSuffixPattern> )<br>
<br>
All I had to change in the code (in SyslogAppender.java) was to<br>
implement a new member variable stackTraceSuffixPattern (plus<br>
getter/setter) and to append it in line 89 (after the prefix and<br>
before<br>
the tab).<br>
<br>
In actual code I imagine you'd also want to add:<br>
-a null test, to make the new parameter optional<br>
-the new property should be subjected to pattern convertion<br>
(this was<br>
not required for my POC to work, but would be nice/expected)<br>
<br>
If someone would work with me and get this fix into logback<br>
proper it<br>
would be much appreciated. I can send/post working code. For how<br>
to best<br>
activate pattern conversion for the new property I would hope to get<br>
some help/guidance.<br>
<br>
cheers,<br>
Ingebrigt Berg<br>
<br>
<br>
Den 14:48 30. mars 2012 skrev Ingebrigt Berg <<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a><br>
<mailto:<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a>><br></div>
<mailto:<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a> <mailto:<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a>>>> følgende:<div><br>
<br>
<br>
Hi !<br>
<br>
We have looked more into this issue.<br>
<br>
From a TCPdump for the traffic between the app (using<br>
logback) and<br>
the syslog-server we learn that each line in the stacktrace is<br>
actually sent as a separate message to syslog (sensitive info<br>
replaced with xx/yy/zz):<br>
<br>
11:28:37.911604 IP xx<br>
localhost.localdomain.55934 > localhost.localdomain.syslog:<br>
[bad udp cksum af4f!] SYSLOG, length: 101<br>
Facility local3 (19), Severity error (3)<br>
Msg: Mar 30 11:28:37 yy2-31 zz-mce-test 30.03.2012<br>
11:28:37.910 [ERROR] [LogbackTester] []: Fjas\0x0a<br>
11:28:37.912028 IP xx<br>
localhost.localdomain.55934 > localhost.localdomain.syslog:<br>
[bad udp cksum 6076!] SYSLOG, length: 104<br>
Facility local3 (19), Severity error (3)<br>
Msg: Mar 30 11:28:37 yy2-31 \0x09at<br>
<br></div>
sun.reflect.__NativeConstructorAccessorImpl.__newInstance0(Native Method)<div><br>
<br>
The first packet is a regular log statement, the second one is a<br>
line in a stack trace.<br>
<br>
Notice how<br>
'zz-mce-test 30.03.2012 11:28:37.910 [ERROR] [LogbackTester] []:'<br>
is replaced with:<br>
'\0x09at'<br>
<br>
If we interpret this correctly, SyslogAppender will log the<br>
error<br>
message and each StackTraceElement separately. But for the<br>
StackTraceElements it will ignore what we configure in the<br>
<SuffixPattern> property:<br>
( <SuffixPattern>%contextName %d{dd.MM.yyyy HH:mm:ss.SSS} [%p]<br>
[%c{1}] [%X{ThreadId}]: %m%n</SuffixPattern> )<br>
Instead the stackline messages simply get a '\0x09at' (a TAB)<br>
appended in place of the SuffixPattern.<br>
<br>
This happens in line 89 in <a href="http://ch.qos.logback.classic.net" target="_blank">ch.qos.logback.classic.net</a><br></div>
<<a href="http://ch.qos.logback.classic.net" target="_blank">http://ch.qos.logback.classic.net</a>>.__SyslogAppender:<br>
sb.append(prefix).append(__CoreConstants.TAB).append(__step);<div><br>
<br>
Contrast that to line 59 in<br>
<a href="http://ch.qos.logback.classic.net" target="_blank">ch.qos.logback.classic.net</a><br></div>
<<a href="http://ch.qos.logback.classic.net" target="_blank">http://ch.qos.logback.classic.net</a>>.__SyslogAppender (normal<div><br>
messages), where<br>
the SuffixPattern gets added:<br></div>
fullLayout.setPattern(__prefixPattern + suffixPattern);<div><br>
<br>
We see two viable solutions:<br>
<br>
EITHER:<br>
when a message is split into a main message and<br>
StackTraceElements,<br>
the StackTraceElement messages must also get the content of the<br>
<SuffixPattern> appended<br>
<br>
OR:<br>
an optional property <StackTraceSuffixPattern> could be added to<br>
SyslogAppender, allowing control of what goes into<br>
StackTraceElement<br>
messages.<br>
<br>
cheers,<br>
Ingebrigt Berg + Marius Eikenes<br>
<br>
<br>
Den 11:40 20. mars 2012 skrev Ingebrigt Berg<br>
<<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a> <mailto:<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a>><br></div>
<mailto:<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a> <mailto:<a href="mailto:ingebrigt@jpro.no" target="_blank">ingebrigt@jpro.no</a>>>> følgende:<div><br>
<br>
<br>
Hi !<br>
<br>
We've recently made the switch from Log4j to Logback. We use<br>
Syslog to send logfiles to our logserver, and things<br>
generally work.<br>
<br>
But when there are stacktraces in the logs we get in<br>
trouble.<br>
SyslogAppender will replace lineshifts with '#011' to<br>
make the<br>
logentry a single line. Then it will cut each line that<br>
is to<br>
long according to the syslog limit of 2K/line. Only the fist<br>
segment will arrive in the correct log. The remaining<br>
segments<br>
are not prefixed with everything in the suffixPattern,<br>
and our<br>
regexp will not have anything to match. The segment will<br>
end up<br>
in a 'trash' log for unmatchable loglines.<br>
<br>
My config for the SyslogAppender looks like this:<br>
<br></div>
<contextName>company-${__CONTEXT_PATH}-${environment}</__contextName><br>
<appender name="LOGSERVER_FILE"<br>
class="ch.qos.logback.classic.__net.SyslogAppender"><br>
<syslogHost>localhost</__syslogHost><div><div><br>
<facility>local3</facility><br>
<SuffixPattern>%contextName %d{dd.MM.yyyy HH:mm:ss.SSS} [%p]<br>
[%c{1}] [%X{ThreadId}]: %m%n</SuffixPattern><br>
</appender><br>
<br>
We use the contextName property to control the<br>
logfilename. On<br>
the receiving end we read the contextName parameter (using a<br>
regexp) for each log line, and write the line to a file<br>
with a<br>
corresponding name.<br>
<br>
We had a similar problem when we used Log4J (Where the Tag<br>
element was used in the same manner), and fixed it back<br>
then by<br>
writing a custom log4j SyslogAppender. But the main<br>
purpose of<br>
moving to Logback is to loose all our home brew logging<br>
stuff,<br>
we don't want to go down that path again. If we can't make<br>
Logback work out of the box with Syslog we'll probably<br>
end up<br>
going back to Log4J. (Another alternative is to replace<br>
Syslog<br>
with Gelf, but that's further down the road).<br>
<br>
However, I imagine Logback and Syslog being a common<br>
combination, and surely someone must have this working<br>
out of<br>
the box. Any advice will be appreciated. My requirements<br>
are simple:<br>
-must work with no custom logging code, only config<br>
(preferably xml)<br>
-stacktraces in logs must work<br>
-must be able to fully control the filename on the<br>
recieving end.<br>
<br>
cheers,<br>
Ingebrigt Berg<br>
<br>
</div></div></blockquote><span><font color="#888888">
<br>
<br>
<br>
-- <br>
Ceki<br>
<a href="http://twitter.com/#%21/ceki" target="_blank">http://twitter.com/#!/ceki</a></font></span><div><div><br>
_______________________________________________<br>
Logback-user mailing list<br>
<a href="mailto:Logback-user@qos.ch" target="_blank">Logback-user@qos.ch</a><br>
<a href="http://mailman.qos.ch/mailman/listinfo/logback-user" target="_blank">http://mailman.qos.ch/mailman/listinfo/logback-user</a><br>
</div></div></blockquote></div></div></div><br>
</blockquote></div><br>