Yes the stack trace is multiple lines. We are actually using log4j to log the traces locally as well as over a custom TCP appender which hooks up to syslog-ng and sends the logs to the loghost. This is how I was able to find the problem. The exception error showed up on both the local log as well as the syslog-ng produced log but stack trace after the error did not show up (as you mentioned syslog-ng should match each and every line). I do have logsurfer on the app server however I don’t think I would know the initial line of the stack trace since its arbirtrary depending on the error. I hear ya on the STDOUT newline issue. I think I did run into that once where I was feeding stdin from syslog-ng to a perl script... Thanks, Vaibhav Goel -----Original Message----- From: syslog-ng-admin@lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of UNIX Admin Sent: April 18, 2005 9:44 PM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]Logging Java stack traces with syslog-ng and log4j The java stack trace is multiple lines, right? Syslog messages are single lines - and so syslog-ng's filters match one line at a time. You need to match each and every line or just have the java app log to a file and parse it. If you have swatch or logsurfer or SEC or something the you can probably see the initial line of the stack trace and and look for the rest of the message and send the whole thing via email/snmp trap/pager/mon trap/whatever. Are you just feeding STDOUT of the app server into logger or something? I hope it doesn't send messages with newlines in them into openlog()/syslog(). I hate when that happens, but crappy logs are better than no logs, I always say. ;) On 4/18/05, Vaibhav Goel <vgoel@cucbc.com> wrote:

Hi all

I am trying to get syslog-ng to log a java stack trace such as one shown below.

PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce

ption on include tag

javax.servlet.ServletException: Got error: 404

at com.cucbc.servlet.SimpleMDRequestDispatcher.handleError(SimpleMDRequestDispatcher.java:72)

at com.cucbc.servlet.AbstractMDRequestDispatcher.checkForError(AbstractMDRequestDispatcher.java:87)

at com.cucbc.servlet.AbstractMDRequestDispatcher.include(AbstractMDRequestDispatcher.java:71)

at com.cucbc.taglib.content.IncludeTagContent.write(IncludeTag.java:137)

at com.cucbc.taglib.content.ContentTagSupport.doEndTag(ContentTagSupport.java:52)

at jsp_servlet._personal.__index._jspService(index.jsp:63)

at weblogic.servlet.jsp.JspBase.service(JspBase.java:33)

at weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run(ServletStubImpl.java:996)

etc…

I have a filter match "LOGERROR" configured for syslog-ng. It matches fine and logs the line:

PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce

ption on include tag

However, the stack trace after that is ignored….

Any way to get that? I guess a regexp match on LOGERROR is out of the question…

Thanks

³+%¢ à™¨¥–+-³+%¢ à–+-±¶¥i¸­†èm¶›?þX¬¶ÆÚ•¦â¶¿™¨¥™©ÿ–+-Šwèþ̬–ˆ'€Zު秶\š²Gªç¬¶*'±«a¶Úÿ 0q©©ŠyÞ·û2²Z žßj¨m