Re: syslog-ng and hadoop

[Brian Bockelman]

Hey Mike,

Yup.  We find the stock log4j needs two things:



log4j.rootLogger=INFO,SYSLOG,console,DRFA,EventCounter

2) Add the headers; otherwise log4j is not compatible with syslog:

log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.facility=local0
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.ConversionPattern=%p %c{2}: %m%n
log4j.appender.SYSLOG.SyslogHost=red
log4j.appender.SYSLOG.threshold=ERROR
log4j.appender.SYSLOG.Header=true
log4j.appender.SYSLOG.FacilityPrinting=true

Brian

On Aug 19, 2009, at 6:32 PM, Mike Anderson wrote:

1) Set the rootLogger manually. The way 0.19.x has the root logger set up breaks when adding new appenders. I.e., do:

Has anybody had any luck setting up the log4j.properties file to send logs

to a syslog-ng server?
My log4j.properties excerpt:
log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.syslogHost=10.0.20.164
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.ConversionPattern=%d{ISO8601} %p %c: %m%n
log4j.appender.SYSLOG.Facility=HADOOP

and my syslog-ng.conf file running on 10.0.20.164

source s_hadoop {
       # message generated by Syslog-NG
       internal();
       # standard Linux log source (this is the default place for the
syslog()
       # function to send logs to)
       unix-stream("/dev/log");
       udp();
};
destination df_hadoop { file("/var/log/hadoop/hadoop.log");};
filter f_hadoop {facility(hadoop);};
log {
source(s_hadoop);
filter(f_hadoop);
destination(df_hadoop);
};


Thanks in advance,
Mike

smime.p7s
Description: S/MIME cryptographic signature