[
https://issues.apache.org/jira/browse/LOG4J2-3380?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17484757#comment-17484757
]
Ralph Goers commented on LOG4J2-3380:
-------------------------------------
I suspect you are not missing the first message after restarting the syslog
service but the last message sent to the prior service instance.
If that is the case we have seen that before and there is no known solution.
The problem is that Log4j sends the message to the service. The target OS
accepts the message but the target application never processes it. Log4j is
never informed that there was any problem. Since the send in the SocketAppender
completes successfully the message ends up being lost.
The only way to fix this is to have the target application acknowledge the
receipt of the message. But the syslog protocol doesn't allow for that.
> Log4j syslog appender misses writing the 1st event after syslog service is
> restarted
> ------------------------------------------------------------------------------------
>
> Key: LOG4J2-3380
> URL: https://issues.apache.org/jira/browse/LOG4J2-3380
> Project: Log4j 2
> Issue Type: Bug
> Components: Appenders
> Affects Versions: 2.17.1
> Environment: CentOS 7.9 + RSyslog Service, Application deployed in
> Tomcat and running on Java 11, Log4j2 version is 2.17.1
> Reporter: Loganathan
> Priority: Major
>
> Hi Team,
> We configured our application to push certain log messages to the local
> system Syslog. We used the Syslog appender with RFC format. There is no
> problem in writing the log to the Syslog file. But when the Syslog service is
> restarted, the next message from the application is not written to the
> Syslog. But subsequent messages are getting pushed properly.
> I enabled the debug level log for Log4j but there is no trace of any
> exception/errors when this first message is missed. I checked in the
> threaddump but there is no Reconnector running.
> One more thing, after restarting of Syslog service, when the 2nd message is
> pushed the following log message is captured,
>
> {{2022-01-27 18:07:40,120 ajp-nio-0.0.0.0-8009-exec-3 DEBUG Reconnecting
> localhost/127.0.0.1:514}}
> {{2022-01-27 18:07:40,121 ajp-nio-0.0.0.0-8009-exec-3 DEBUG Creating socket
> localhost/127.0.0.1:514}}
> {{2022-01-27 18:07:40,122 ajp-nio-0.0.0.0-8009-exec-3 DEBUG Closing
> SocketOutputStream java.net.SocketOutputStream@1a769d7}}
> {{2022-01-27 18:07:40,122 ajp-nio-0.0.0.0-8009-exec-3 DEBUG Connection to
> localhost:514 reestablished:
> Socket[addr=localhost/127.0.0.1,port=514,localport=57852]}}
>
> I am not sure what files to be attached, please let me know if any additional
> details or files are required.
> Thanks, Loganathan T
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
