13

we have bridged our log4net with Jira using SMTP.

Now we are worried that since the site is public what could happen to the Jira server if we get alot of issues in the production environment.

We have already filtered on Critical and Fatal, but we want to see either some acumulator service on log4net or a plain filter which identifies repeating issues and prevents them from being sent via Email. Preferably without having to change the error reporting code, so a config solution would be best.

I guess dumping the log into a db and then create a separate listener some smart code would be a (pricy) alternative.

Andreas
  • 545
  • 1
  • 4
  • 16

2 Answers2

17

Maybe this is sufficient for your requirements:

it basically limits the number of emails that are sent in a given time span. I think it should be quite easy to customize this to your needs. I did something similar that even discards messages within a certain time span:

public class SmtpThrottlingAppender : SmtpAppender
{
    private DateTime lastFlush = DateTime.MinValue;
    private TimeSpan flushInterval = new TimeSpan(0, 5, 0);

    public TimeSpan FlushInterval
    {
        get { return this.flushInterval; }
        set { this.flushInterval = value; }
    }

    protected override void SendBuffer(LoggingEvent[] events)
    {
        if (DateTime.Now - this.lastFlush > this.flushInterval)
        {
            base.SendBuffer(events);
            this.lastFlush = DateTime.Now;
        } 
    }
}

The flush interval can be configured like normal settings of other appenders:

<flushInterval value="01:00:00" />
Stefan Egli
  • 17,398
  • 3
  • 54
  • 75
  • Not sure if I quite understand, but will this wait and then send a bunch of emails all at once or does it send one email with all the events in it? What does `base.SendBuffer(events)` do? As the OP is also asking for "_a plain filter which identifies repeating issues and prevents them from being sent_" then perhaps this could be done by removing items from the `events` array before calling `base.SendBuffer(events)`. Is this right? – Ben Nov 17 '13 at 15:03
  • It sends one email with all events. If you need you can remove certain events from the array before calling `base.SendBuffer()`. – Stefan Egli Nov 18 '13 at 08:51
  • Great idea! Simple yet effective. Thanks! – Peter Pompeii Nov 23 '13 at 00:18
  • For me it discards all those messages that are skipped. Any idea why? – Greg Z. Jul 27 '16 at 01:12
  • My implementation is meant to discard messages. I suggest you post your problem as a question so that you can provide the sufficient information about what you are trying to do. – Stefan Egli Jul 27 '16 at 09:54
4

You can also use a plain SmtpAppender with a log4net.Core.TimeEvaluator as the Evaluator.

Suppose we have an interval of 5 minutes, and events at 00:00, 00:01 and 01:00.

  • Stefan Egli's SmtpThrottlingAppender will send emails at 00:00 (event 1) and 01:00 (events 2 and 3).
  • An SmtpAppender with a TimeEvaluator will send emails at 00:05 (events 1 and 2) and 01:05 (event 3).

Which one you want depends on whether you're more bothered by the guaranteed delay or the potentially large delay.

I attempted the combine the SmptThrottlingAppender with a TimeEvaluator, but couldn't get the behaviour I wanted. I'm beginning to suspect that I should be writing a new ITriggeringEventEvaluator, not a new IAppender.

Dave Roberts
  • 537
  • 3
  • 7
  • 1
    Reading the TimeEvaluator source code http://svn.apache.org/viewvc/logging/log4net/trunk/src/Core/TimeEvaluator.cs?revision=1159605&view=markup, the way I understand it the TimeEvaluator will trigger the send at 00:00 (event 1), not trigger at 00:01 (because 5 minutes have not passed since previous trigger), and then trigger again at 01:00 (with event 2 and 3 depending on buffersize etc.) – Oskar Berggren Nov 15 '12 at 10:47
  • To be more precise, if TimeEvaluator is created at 00:00 then it will not send anything at 00:00 neither at 00:01 – irriss Jun 17 '16 at 03:40