Configure log4net to send errors to different appenders based on level

Question

I want to send Info Level & above to the XML appender and Error/Fatal Level to the EventLog appender.

I gather that I need to modify the root element of the config but I'm struggling with the syntax. What is the configuration syntax to direct logs to the correct appender for a given level or range of levels?

This is the configuration so far:

<log4net>
  <appender name="SomeXmlAppender" type="log4net.Appender.RollingFileAppender">
    ...
  </appender>
  <appender name="SomeEventLogAppender" type="log4net.Appender.EventLogAppender">
    ...
  </appender>
  <root>
    <level value="DEBUG" />
    <appender-ref ref="SomeXmlAppender" />
    <appender-ref ref="SomeEventLogAppender" />
  </root>
</log4net>

Edit: Thanks @agileguy. That post did indeed contain the syntaxt I needed. The working solution now looks like this:

<log4net>
  <appender name="SomeXmlAppender" type="log4net.Appender.RollingFileAppender">
    ...
    <evaluator type="log4net.Core.LevelEvaluator">
      <threshold value="INFO"/>
    </evaluator>
    <filter type="log4net.Filter.LevelRangeFilter">
      <levelMin value="INFO" />
      <acceptOnMatch value="true" />
    </filter>
    <filter type="log4net.Filter.DenyAllFilter" />
  </appender>
  <appender name="SomeEventLogAppender" type="log4net.Appender.EventLogAppender">
    ...
    <evaluator type="log4net.Core.LevelEvaluator">
      <threshold value="ERROR"/>
    </evaluator>
    <filter type="log4net.Filter.LevelRangeFilter">
      <levelMin value="ERROR" />
      <acceptOnMatch value="true" />
    </filter>
    <filter type="log4net.Filter.DenyAllFilter" />
  </appender>
  <root>
    <level value="DEBUG" />
    <appender-ref ref="SomeXmlAppender" />
    <appender-ref ref="SomeEventLogAppender" />
  </root>
</log4net>

Answer 1

This can be done using the threshold or filter elements within the appender.

Note that the threshold can be directly under the appender, where it acts as an inclusive filter, or under a evaluator e.g.

<evaluator type="log4net.Core.LevelEvaluator">
  <threshold value="ERROR"/>
</evaluator>

where it acts as an inclusive filter for skipping buffering (immediate output), where applicable.

---

Full explanation (source):

<threshold value="ERROR" />

The Threshold is implemented in the AppenderSkeleton and therefore supported by almost all appenders. It is just a simple test that is used to ignore logging events that have a level below the threshold. The threshold is checked early and as a simple test is very performant.

There is another way to specify the same behaviour as the threshold using filters. Filters are very much more flexible and as they are pluggable you can also develop your own custom logic and insert it into the filter chain.

<filter type="log4net.Filter.LevelRangeFilter">
    <levelMin value="ERROR" />
    <levelMax value="OFF" />
</filter>

Like the Threshold check Filters are implemented in the AppenderSkelton base class and are supported by almost all appenders. The above filter has the same effect as <threshold value="ERROR" />. It is a LevelRangeFilter that will allow through any events with a level in the range ERROR to OFF (inclusive). Note that OFF is the name of the highest level, conversely ALL is the name of the lowest level.

Filters have a great deal of flexibility because multiple filters can be chained together to provide fine grained control over the events that are output. Because of this they also have a higher cost in terms of performance, each filter in the chain is an object and is asked to decide on the correct course of action. In the simple case of the threshold filtering the Threshold property should be used in preference to a filter.

The Evaluator is implemented by the BufferingAppenderSkeleton and is therefore only supported by appenders that extend this base class and provide support for buffering. The SmtpAppender is one such appender.

The Evaluator is a pluggable object that is used by the BufferingAppenderSkeleton to determine if a logging event should not be buffered, but instead written/sent immediately. If the Evaluator decides that the event is important then the whole contents of the current buffer will be sent along with the event. The evaluator does not function like the threshold or a filter in that it does not discard events.