[graylog2] Re: Logging of Graylog-Server to Syslog

[Jochen Schalanda]

Hi Frank,

thanks for the update!

Cheers,
Jochen 

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/1c2d2400-9587-4b06-aa35-cba6e629332d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Logging of Graylog-Server to Syslog

[Frank Engler]

Am Dienstag, 7. Februar 2017, 00:10:23 schrieb Jochen Schalanda:
> This shows that the appender mechanism itself is working but that either
> the Syslog appender doesn't work or that you have configured it wrong.
> 
> Try starting with the absolute minimum configuration for the Syslog
> appender...

I was abled to solve the problem. It was an error in the configuration though 
Log4j isn't very specific about what's right and what is the absolute minimum. 
Messages from Log4j are written 
to stderr instead of the log file, so I overlooked them at first:

...
Caused by: java.lang.$llegalArgumentException: No structured id name was 
supplied
...
main ERROR Null object returned for Syslog in Appenders.
main ERROR Unable to locate appender "RFC5424" for logger config "root"

Knowing that message it was an easy google to find the issue of Log4j having 
the mdcId parameter without a default 
(https://issues.apache.org/jira/browse/LOG4J2-922). A parameter nobody even 
cared to document 
(https://logging.apache.org/log4j/2.x/manual/appenders.html#SyslogAppender). 
If you really want to find out something about mdcId you have to go to 
https://logging.apache.org/log4j/2.0/log4j-core/apidocs/org/apache/logging/log4j/core/layout/Rfc5424Layout.html#createLayout%28org.apache.logging.log4j.core.net.Facility,
%20java.lang.String,%20int,%20boolean,%20java.lang.String,%20java.lang.String,
%20java.lang.String,%20boolean,%20java.lang.String,%20java.lang.String,
%20java.lang.String,%20java.lang.String,%20java.lang.String,
%20java.lang.String,%20java.lang.String,%20boolean,
%20org.apache.logging.log4j.core.layout.LoggerFields[],
%20org.apache.logging.log4j.core.config.Configuration%29 (yes, that's a link). 
Point is the mdcId parameter needs a value and doesn't have one. Log4j does 
not care what value it is, even an empty string is fine. So the minimum config 
for a RFC5424 syslog appender is:



Greetings
Frank

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/10857472.ASFgAvzGMa%40studio.engler.invalid.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Logging of Graylog-Server to Syslog

[Jochen Schalanda]

Hi Frank,

On Monday, 6 February 2017 22:49:23 UTC+1, Frank Engler wrote:
>
> Any clue what is going wrong? Why is only the Socket example working and 
> the 
> Syslog test isn't? 
>

This shows that the appender mechanism itself is working but that either 
the Syslog appender doesn't work or that you have configured it wrong.

Try starting with the absolute minimum configuration for the Syslog 
appender and add additional settings once this is working. For example, try 
using "127.0.0.1" in the "host" setting instead of "localhost" (which could 
resolve to any other IP address).

Cheers,
Jochen

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/b745808b-fa5c-4976-9d02-58e6bead126f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.