[slf4j-user] hi and a basic question

[Joachim Durchholz]

Am 30.01.2017 um 22:46 schrieb Hendrick, James:
> Sorry if this is covered somewhere. I searched back a couple months and didn't see anything.
>
> How does the API support sending to a local system syslog service?

slf4j does not, it is just a uniform API for various logging libraries.

> Specifically I do *not* want this to send to a server over the network (e.g. udp/514) but to send to the local kernel logger.

The easiest way would be to use syslog on "localhost". Network stacks 
are optimized to discover that case, the bytes never get sent out.

It would be slightly better to directly use the kernel's logging API, 
but I guess somebody would have to write a Java interface to that using 
JNI or JNA.

> With that, how do I as a developer have control over things in the syslog header and message body?
>
> It looks like: logger.debug("This is my application syslog message part")
> Would generate a Severity debug message - but I do not easily see where to set the rest of the header fields.
>
> For example, if I want APP-NAME (in the syslog header) to use a specific string - where is that set?
> Also for things like PROCID, MSGID, PRI etc.

I tried something similar, a few years ago.

The most important challenge is to make sure that this information gets 
logged even for log messages from 3rd-party libraries. I.e. you need 
some kind of global variable because you can't send the data through the 
API.
The downside is that you have to be pretty careful whenever the software 
starts working on a new task (you usually have a sessionid or something 
similar that you want to log).
In typical applications, you need a thread-local static variable to keep 
that information, with all the fun associated with passing the data on 
to child processes. You can put the data in the MDC, which has this 
specific ground covered, but insists that all data be stored as Strings.
The other downside is that you are providing data that's specific to a 
particular appender, and you need to do extra configuration to make that 
data visible if you use a different appender.

> I want to have different groups of developers separate their logs using the syslog standard fields, and then use the standard syslog daemon to forward these to our central logging service.

The alternative would be to log to a local file, and have a background 
process watch the local log files and send newly appended lines to the 
central syslog. (I have seen this done using Splunk. I hear Splunk is 
pretty expensive, so you might want to investigate alternatives; more 
likely, you already have something installed and are supposed to use that.)
The advantage is that you can infer information like app-name or 
developer from the name of the directory the file is located in, so you 
may be able to avoid using the MDC entirely.