On Fri, Mar 04, 2011 at 11:27:37AM +0100, Peter Czanik wrote:
Hello,
As I don't code in Java, I don't have any personal experiences with log4j. But from e-mail and forum messages, and also from discussions at FOSDEM I know, that log4j is often used together with syslog-ng.
I ran into this log4j related question this morning: http://serverfault.com/questions/242972/getting-syslog-ng-to-recognize-a-jav...
I'd like to ask, if there is anybody who already has a solution for the above question or any other useful tips about log4j & syslog-ng to share.
The problem is we don't know whether the user and log4j were smart about how they generated and sent the message to syslog-ng. A Java stack trace is multiple lines (one Java stack frame per line). We need to learn exactly how they have configured it, with a packet capture of the problematic message, before we can say if it can be made to work. If they have sent their multiline message via TCP with \n, all hope is lost, because the RFC says this must be interpreted as separate syslog messages. If they have sent it in separate UDP datagrams, same problem. If they sent all of it in one UDP datagram with \n, there are ways syslog-ng can decode that already if you set it up right. Unfortunately almost nobody reads the manual of syslog-ng to set up this stuff, and even fewer people read the RFCs. This stuff is not magic and it does not automatically read the user's mind and do everything they want. People need to go step by step and put their pants on one leg at a time. Matthew.