Skip to main content

Sending jboss log4j logs to remote syslog server

Since the following modifications are made on the conf/jboss-log4j.xml file, jboss apllication middleware logs can be sent to a remote syslog server:

Coment out SYSLOG section and change necessary values according to yours, on the syslog server there are some log facilities as LOCAL0..7 for customizing logs. Choose one of them:
  <appender name="SYSLOG" class="org.apache.log4j.net.SyslogAppender">
     <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/>
     <param name="Facility" value="LOCAL7"/>
     <param name="FacilityPrinting" value="true"/>
     <param name="SyslogHost" value="remote_syslog_server_ip"/>
     <layout class="org.apache.log4j.PatternLayout">
       <param name="ConversionPattern" value="[%d{ABSOLUTE},%c{1}] %m%n"/>
     </layout>
   </appender>

add an appender reference named SYSLOG:
   <root>
      <priority value = "INFO" />
      <appender-ref ref="FILE"/>
      <appender-ref ref="SYSLOG"/>
   </root>

After these changes stop and start jboss server. At the remote syslog server jboss logs can be viewed.

Comments

Popular posts from this blog

Find and replace with sed command in Linux

Find and replace feature is always handy. It can turn into a torture when it comes to change or delete a simple constant string in a text file. There is a handy tool in linux for doing these kind of tihngs. Actually sed is not a text editor but it is used outside of the text file to make changes.

Sending Jboss Server Logs to Logstash Using Filebeat with Multiline Support

In addition to sending system logs to logstash, it is possible to add a prospector section to the filebeat.yml for jboss server logs. Sometimes jboss server.log has single events made up from several lines of messages. In such cases Filebeat should be configured for a multiline prospector.
Filebeat takes lines do not start with a date pattern (look at pattern in the multiline section "^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}" and negate section is set to true) and combines them with the previous line that starts with a date pattern.

server.log file excerpt where DatePattern: yyyy-MM-dd-HH and ConversionPattern: %d %-5p [%c] %m%n
Logstash filter: