19

I am looking for example configuration on how to get Log4net logging to a Syslog server. Any help would be welcome.

5 Answers 5

19

I didn't find Simon Whittemore's entry very helpful, this is what got my appender producing "proper" syslog remote messages:

<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <identity value="HepeManok" />
  <layout type="log4net.Layout.PatternLayout" value="%-5p %type: %m%n"/>
  <remoteAddress value="syslog.lameserver.net" />
</appender>

The "key" [sic] is the identity parameter, that produces the correct (or correct looking) output - I'm using rsyslog on Debian, YMMV.

You most definitely do not need or want to send the date (as in Simon Whittemore's blog), as syslogd will add the date for you, using the server's timezone.

Here's a received message from my log4net enabled app, followed by a real message:

Jun 21 09:58:40 vs2008.local HepeManok: INFO  Irc: irc_OnConnected
Jun 21 09:42:45 chips30 kernel: [10210014.974069] device eth0 entered promiscuous mode

As you can see, the basic format of "Date Time Host Service: message" is all good, unlike

Jun 21 09:38:57 WARN  Irc [(null)] - OnQuit#015

or an example of what Simon's config would produce:

Jun 21 09:56:42 Hepe Manok.vshost.exe: 21/06/2012 07:54:44,828 | 6 | INFO | Irc | WIN-2008-DEV\Administrator | WIN-2008-DEV | dev | irc_OnConnecting |  | 
0
10
<appender name="UdpAppender" type="log4net.Appender.UdpAppender">
      <param name="RemoteAddress" value="127.0.0.1" />
      <param name="RemotePort" value="514" />
      <layout type="log4net.Layout.PatternLayout, log4net">
        <conversionPattern value="%-5level %logger [%property{NDC}] - %message%newline" />
      </layout>
</appender>
1
6

Instead of using the lower-level UDP appender, you could try log4net.Appender.RemoteSyslogAppender. You can find an example in Simon Whittemore's blog entry Centralised Application logging via Log4Net.

<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <layout type="log4net.Layout.PatternLayout" value="%date{dd/MM/yyyy hh:mm:ss,fff} | %thread | %level | %logger | %username | %P{log4net:HostName} | dev | %message | %exception | "/>
  <remoteAddress value="LOGSERVER" />
  <filter type="log4net.Filter.LevelRangeFilter">
    <levelMin value="ALL" />
  </filter>
</appender>
1
  • UdpAppender only sent/received garage but RemoteSyslogAppender works great. Commented Jan 14, 2021 at 21:23
3

You could also give syslog4net a try. syslog4net works by creating a custom log4net layout that writes messages in Syslog’s RFC5424 standard format. You can then hook that up to any log4net appender. You can write to a Syslog daemon, splunk, or any machine data aggregator pretty easily by connecting our SyslogLayout class to log4net’s UdpAppender or syslog4net's custom TcpAppender.

Documentation, usage, and examples are available on the project's github site.

2

I have my servers logging to a ubuntu server running syslog-ng. In order to get the hostname showing correctly, I used this:

  <appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
    <facility value="local7" />
    <identity value=" %date{yyyy-MM-ddTHH:mm:ss.ffffffzzz} %P{log4net:HostName} %P{app}" />
    <RemoteAddress value="192.168.1.248" />
    <layout type="log4net.Layout.PatternLayout" value="&#9;%P{pid}:%logger %m%n"/>
    <RemotePort value="516" />
  </appender>
3
  • Hi, does this support TCP and UDP? Thanks!
    – PKCS12
    Commented Feb 19, 2020 at 9:43
  • I don't think so. Syslog is traditionally UDP and RemoteSyslogAppender derives from log4net.Appender.UdpAppender. You can configure syslog-ng to listen to a TCP transport but I don't know if you can configure an Appender to send via TCP.
    – CircaLucid
    Commented Feb 21, 2020 at 16:58
  • @PKCS12 You would need to use the RemotingAppender with a sink set to tcp://.....:1514 and you would need to make the layout like RFC3164. Commented Feb 26, 2021 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.