SyslogAppender not working

Abhishek bhutra picture Abhishek bhutra · Sep 19, 2012 · Viewed 17.7k times · Source

I have a java program and I want to log in /var/log/messages file on fedora machine. I am usin log4j SyslogAppender but its not working.

my log4j properties file contains

# Set root category priority to INFO and its only appender to CONSOLE.
log4j.rootCategory=INFO, CONSOLE, SYSLOG
#log4j.rootCategory=INFO, CONSOLE, LOGFILE

# Set the enterprise logger priority to DEBUG
log4j.logger.com.locaid=INFO, CONSOLE, LOGFILE, SYSLOG

# CONSOLE is set to be a ConsoleAppender using a PatternLayout.
log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
log4j.appender.CONSOLE.layout.ConversionPattern=%-4r [%t] %-5p %c %x - %m%n

# LOGFILE is set to be a File appender using a PatternLayout.
log4j.appender.LOGFILE=org.apache.log4j.FileAppender
log4j.appender.LOGFILE.File=/home/dev/app.log
log4j.appender.LOGFILE.Append=true
log4j.appender.LOGFILE.layout=org.apache.log4j.PatternLayout
log4j.appender.LOGFILE.layout.ConversionPattern=[%d{dd/MM/y HH:mm:ss}][%t][%1p] %c - %m%n

log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.syslogHost=localhost
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.conversionPattern=%d{ISO8601} %-5p [%t] %c{2} %x - %m%n
log4j.appender.SYSLOG.Facility=LOCAL1
log4j.appender.SYSLOG.Threshold=debug
log4j.appender.SYSLOG.FacilityPrinting=true

in /etc/rsyslog.conf i have

local1.*      /var/log/app.log

in /etc/sysconfig/rsyslog have

SYSLOGD_OPTIONS="-r -m 0 -c 4"

On restarting rsyslog service app.log file is created but no logs are being appended. I have also tried with default USER facility its not working although logger -p LOCAL1.info cmd is working and appending log to app.log. Need help.

Answer

Ian Roberts picture Ian Roberts · Oct 1, 2012

I can't see anything wrong at the log4j end, but my /etc/default/rsyslog (on Ubuntu) says

# Options for rsyslogd
# -m 0 disables 'MARK' messages (deprecated, only used in compat mode < 3)
# -r enables logging from remote machines (deprecated, only used in compat mode < 3)
# -x disables DNS lookups on messages received with -r
# -c compatibility mode
# See rsyslogd(8) for more details

which suggests that -r and -m 0 won't work in combination with -c 4. Instead of trying to set remote access here, you should edit your /etc/rsyslogd.conf and add (or uncomment)

$ModLoad imudp
$UDPServerRun 514