7

I'm trying to get a logback syslog appender working, and I've definitely got something misconfigured. I've created a small sample project which I think should log to syslog, yet it doesn't.

I'm sure I'm missing something stupid. Here's the appender from logback.xml:

<appender name="SYSLOG" class="ch.qos.logback.classic.net.SyslogAppender">
    <syslogHost>localhost</syslogHost>
    <facility>USER</facility>
    <suffixPattern>[%thread] %logger %msg</suffixPattern>
</appender>

I've tried adding the port (514) explicitly, and, no joy. on both systems I've tried this on, I've verified syslog is receiving input using logger "test message" and then tailing either /var/log/messages or /var/log/system.log.

What do I need to change in order to get logback/slf4j logging to syslog?

Paul Sanwald
  • 10,899
  • 6
  • 44
  • 59
  • Have you checked http://stackoverflow.com/questions/8350027/log4j-and-syslogappender ? – Fox Apr 09 '15 at 20:15
  • I did, but I'm logging to syslog on the same machine from node.js (bunyan-syslog) just fine, so this is very unlikely. I'll give it a try. – Paul Sanwald Apr 09 '15 at 20:18
  • Not sure how node.js syslog logging works, but judging by `syslog.cc` I'd say it is using local logging, while logback/log4j use remote logging (hence the Host and Port). btw. tcpdumping loopback interface may tell if messages are getting sent from java ... – Fox Apr 10 '15 at 09:50

1 Answers1

12

Nothing is wrong with your code, the problem is the system config. Using your provided test project, I was able to make the syslog appender work (Ubuntu 14.10).

Here are some steps:

  • edit /etc/syslog.conf and ensure you have network syslog enabled:
# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
# note that logback seems to use UDP, so this isn't strictly necessary.
$ModLoad imtcp
$InputTCPServerRun 514
  • restart rsyslog (service rsyslog restart) if you change the config (reload doesn't work)
  • check that syslog is listening with lsof -i | grep syslog

results:

enter image description here

Paul Sanwald
  • 10,899
  • 6
  • 44
  • 59