The java stack trace is multiple lines, right? Syslog messages are single lines - and so syslog-ng's filters match one line at a time. You need to match each and every line or just have the java app log to a file and parse it. If you have swatch or logsurfer or SEC or something the you can probably see the initial line of the stack trace and and look for the rest of the message and send the whole thing via email/snmp trap/pager/mon trap/whatever. Are you just feeding STDOUT of the app server into logger or something? I hope it doesn't send messages with newlines in them into openlog()/syslog(). I hate when that happens, but crappy logs are better than no logs, I always say. ;) On 4/18/05, Vaibhav Goel <vgoel@cucbc.com> wrote:
Hi all
I am trying to get syslog-ng to log a java stack trace such as one shown below.
PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce
ption on include tag
javax.servlet.ServletException: Got error: 404
at com.cucbc.servlet.SimpleMDRequestDispatcher.handleError(SimpleMDRequestDispatcher.java:72)
at com.cucbc.servlet.AbstractMDRequestDispatcher.checkForError(AbstractMDRequestDispatcher.java:87)
at com.cucbc.servlet.AbstractMDRequestDispatcher.include(AbstractMDRequestDispatcher.java:71)
at com.cucbc.taglib.content.IncludeTagContent.write(IncludeTag.java:137)
at com.cucbc.taglib.content.ContentTagSupport.doEndTag(ContentTagSupport.java:52)
at jsp_servlet._personal.__index._jspService(index.jsp:63)
at weblogic.servlet.jsp.JspBase.service(JspBase.java:33)
at weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run(ServletStubImpl.java:996)
etc…
I have a filter match "LOGERROR" configured for syslog-ng. It matches fine and logs the line:
PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce
ption on include tag
However, the stack trace after that is ignored….
Any way to get that? I guess a regexp match on LOGERROR is out of the question…
Thanks