Mailing List Archive: RSyslog: users

Need Help .... Exception traces are missed out!!

Index | Next | Previous | View Threaded

sanjeevcr at gmail

May 25, 2012, 5:15 AM

Post #1 of 5 (287 views)
Permalink

Need Help .... Exception traces are missed out!!

Hello Everyone,

I'm facing an issue using rsyslog with log4j (SysLog4jAppender) and posted
that on the forum. Can someone help me out on this.

http://kb.monitorware.com/need-help-exception-traces-are-missed-out-t11540.html

Thank you for your time !!

Regards,
Sanjeev.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

swillis at compete

May 25, 2012, 7:20 AM

Post #2 of 5 (268 views)
Permalink

Re: Need Help .... Exception traces are missed out!! [In reply to]

Hi Sanjeev,

I've been dealing with similar issues in log4j for a few weeks now. I'm not sure if it's exactly the same as yours, but I'm using the builtin UDP based SyslogAppender in log4j 1.2.15. The problem is that the SyslogAppender in log4j treats stack traces specially. After the main message has been formatted through the layout formatter, each line of the stack trace is sent as a separate log message with just facility/priority timestamp and hostname. It doesn't format these lines, so anything you were depending on being there from your conversion pattern (like the appname/tag) for filtering won't be there for the stack trace lines.

It looks like you're actually writing out the stack trace as part of the main message since you have "%throwable" in your conversion pattern. It's probably related to how either log4j or rsyslog is treating the new lines in your stack trace. Historically, any new line would separate log messages and they'd be treated as separate messages. Check /var/log/messages for these stack trace lines, then see if there's some way you can write out the stacktrace without new lines.

-Steve

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Sanjeev Reddy
> Sent: Friday, May 25, 2012 8:16 AM
> To: rsyslog [at] lists
> Subject: [rsyslog] Need Help .... Exception traces are missed out!!
>
> Hello Everyone,
>
> I'm facing an issue using rsyslog with log4j (SysLog4jAppender) and
> posted that on the forum. Can someone help me out on this.
>
> http://kb.monitorware.com/need-help-exception-traces-are-missed-out-
> t11540.html
>
> Thank you for your time !!
>
> Regards,
> Sanjeev.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

gentoo at floriancrouzat

May 25, 2012, 7:50 AM

Post #3 of 5 (268 views)
Permalink

Re: Need Help .... Exception traces are missed out!! [In reply to]

Le 25/05/2012 14:15, Sanjeev Reddy a écrit :
> Hello Everyone,
>
> I'm facing an issue using rsyslog with log4j (SysLog4jAppender) and posted
> that on the forum. Can someone help me out on this.
>
> http://kb.monitorware.com/need-help-exception-traces-are-missed-out-t11540.html
>
> Thank you for your time !!
>

I have been facing the same issue.
AFAIK, there is absolutely no way to force all lines of a stracktrace to
be treated by your Log4J Layout as you mentionned.

The only workaround I found was to extract the "timestamp hostname app:"
part from log4j PatternLayout and to hard-code it into my rsyslog
template so that any log line of any kind produced by Java will have the
correct layout.
I discuss this in a blogpost[1].

[1]
http://floriancrouzat.net/2012/05/ossec-jboss-log4j-and-syslog-are-on-a-plane/

--
Cheers,
Florian Crouzat
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

rgerhards at hq

May 25, 2012, 8:43 AM

Post #4 of 5 (266 views)
Permalink

Re: Need Help .... Exception traces are missed out!! [In reply to]

Maybe this is useful:

http://www.rsyslog.com/tcp-syslog-rfc5424-log4j-appender/

Rainer

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Florian Crouzat
> Sent: Friday, May 25, 2012 4:51 PM
> To: rsyslog [at] lists
> Subject: Re: [rsyslog] Need Help .... Exception traces are missed out!!
>
> Le 25/05/2012 14:15, Sanjeev Reddy a écrit :
> > Hello Everyone,
> >
> > I'm facing an issue using rsyslog with log4j (SysLog4jAppender) and posted
> > that on the forum. Can someone help me out on this.
> >
> > http://kb.monitorware.com/need-help-exception-traces-are-missed-out-
> t11540.html
> >
> > Thank you for your time !!
> >
>
> I have been facing the same issue.
> AFAIK, there is absolutely no way to force all lines of a stracktrace to
> be treated by your Log4J Layout as you mentionned.
>
> The only workaround I found was to extract the "timestamp hostname app:"
> part from log4j PatternLayout and to hard-code it into my rsyslog
> template so that any log line of any kind produced by Java will have the
> correct layout.
> I discuss this in a blogpost[1].
>
> [1]
> http://floriancrouzat.net/2012/05/ossec-jboss-log4j-and-syslog-are-on-a-
> plane/
>
> --
> Cheers,
> Florian Crouzat
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

swillis at compete

May 25, 2012, 9:38 AM

Post #5 of 5 (269 views)
Permalink

Re: Need Help .... Exception traces are missed out!! [In reply to]

I forgot to mention that there is a bug that has been open for a long time addressing this issue:

https://issues.apache.org/bugzilla/show_bug.cgi?id=46626

I had recently found it and submitted a patch that would add a tag attribute to the SyslogAppender class and would append this tag to the header (which is printed out for each message). Please weigh in there if this is something that is important to you.

-Steven Willis

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Florian Crouzat
> Sent: Friday, May 25, 2012 10:51 AM
> To: rsyslog [at] lists
> Subject: Re: [rsyslog] Need Help .... Exception traces are missed out!!
>
> Le 25/05/2012 14:15, Sanjeev Reddy a écrit :
> > Hello Everyone,
> >
> > I'm facing an issue using rsyslog with log4j (SysLog4jAppender) and
> > posted that on the forum. Can someone help me out on this.
> >
> > http://kb.monitorware.com/need-help-exception-traces-are-missed-out-
> t1
> > 1540.html
> >
> > Thank you for your time !!
> >
>
> I have been facing the same issue.
> AFAIK, there is absolutely no way to force all lines of a stracktrace
> to be treated by your Log4J Layout as you mentionned.
>
> The only workaround I found was to extract the "timestamp hostname
> app:"
> part from log4j PatternLayout and to hard-code it into my rsyslog
> template so that any log line of any kind produced by Java will have
> the correct layout.
> I discuss this in a blogpost[1].
>
> [1]
> http://floriancrouzat.net/2012/05/ossec-jboss-log4j-and-syslog-are-on-
> a-plane/
>
> --
> Cheers,
> Florian Crouzat
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads