Log4net: SysLog Appender Example

Question

I am looking for example configuration on how to get Log4net logging to a Syslog server. Any help would be welcome.

Answer 1

Instead of using the lower-level UDP appender, you could try log4net.Appender.RemoteSyslogAppender. You can find an example in Simon Whittemore's blog entry Centralised Application logging via Log4Net.

<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <layout type="log4net.Layout.PatternLayout" value="%date{dd/MM/yyyy hh:mm:ss,fff} | %thread | %level | %logger | %username | %P{log4net:HostName} | dev | %message | %exception | "/>
  <remoteAddress value="LOGSERVER" />
  <filter type="log4net.Filter.LevelRangeFilter">
    <levelMin value="ALL" />
  </filter>
</appender>

Answer 2

I didn't find Simon Whittemore's entry very helpful, this is what got my appender producing "proper" syslog remote messages:

<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <identity value="HepeManok" />
  <layout type="log4net.Layout.PatternLayout" value="%-5p %type: %m%n"/>
  <remoteAddress value="syslog.lameserver.net" />
</appender>

The "key" [sic] is the identity parameter, that produces the correct (or correct looking) output - I'm using rsyslog on Debian, YMMV.

You most definitely do not need or want to send the date (as in Simon Whittemore's blog), as syslogd will add the date for you, using the server's timezone.

Here's a received message from my log4net enabled app, followed by a real message:

Jun 21 09:58:40 vs2008.local HepeManok: INFO  Irc: irc_OnConnected
Jun 21 09:42:45 chips30 kernel: [10210014.974069] device eth0 entered promiscuous mode

As you can see, the basic format of "Date Time Host Service: message" is all good, unlike

Jun 21 09:38:57 WARN  Irc [(null)] - OnQuit#015

or an example of what Simon's config would produce:

Jun 21 09:56:42 Hepe Manok.vshost.exe: 21/06/2012 07:54:44,828 | 6 | INFO | Irc | WIN-2008-DEV\Administrator | WIN-2008-DEV | dev | irc_OnConnecting |  | 

Answer 3

<appender name="UdpAppender" type="log4net.Appender.UdpAppender">
      <param name="RemoteAddress" value="127.0.0.1" />
      <param name="RemotePort" value="514" />
      <layout type="log4net.Layout.PatternLayout, log4net">
        <conversionPattern value="%-5level %logger [%property{NDC}] - %message%newline" />
      </layout>
</appender>

Answer 4

You could also give syslog4net a try. syslog4net works by creating a custom log4net layout that writes messages in Syslog’s RFC5424 standard format. You can then hook that up to any log4net appender. You can write to a Syslog daemon, splunk, or any machine data aggregator pretty easily by connecting our SyslogLayout class to log4net’s UdpAppender or syslog4net's custom TcpAppender.

Documentation, usage, and examples are available on the project's github site.

Answer 5

I have my servers logging to a ubuntu server running syslog-ng. In order to get the hostname showing correctly, I used this:

  <appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
    <facility value="local7" />
    <identity value=" %date{yyyy-MM-ddTHH:mm:ss.ffffffzzz} %P{log4net:HostName} %P{app}" />
    <RemoteAddress value="192.168.1.248" />
    <layout type="log4net.Layout.PatternLayout" value="&#9;%P{pid}:%logger %m%n"/>
    <RemotePort value="516" />
  </appender>