HOW TO : Configure Jboss to send log messages to syslog

Jboss uses the log4j framework for providing logging services. log4j is a very flexible framework and can do a lot of things. One of the features provided by log4j is to send log messages to multiple destinations. Here is a quick how to on configuring Jboss to send log messages using the syslog protocol to a syslog server. This is pretty useful, when you are trying to consolidate logs from multiple sources into a central location.

First, some background about how log4j is configured in Jboss

The log4j configuration in Jboss is managed by the file jboss-log4j.xml located at $JBOSS_HOME/server/$JBOSS_PROFILE/conf.

There are three parts to this configuration file

1. Appenders
• An appender is a way to define a particular logging method. By default, Jboss provides a bunch of appenders in this config file, but only the FILE and CONSOLE appenders are enabled. The FILE appender writes the log messages to a log file and rotates them based on the criteria in the appender. The CONSOLE appender just sends messages to the console. This will come into picture, when you are not running Jboss as a service. In addition, there are appenders for syslog, snmp, email that are commented out.
2. Categories
• A category is where you define the class you want to log  messages for and which appender it should use. If you don’t specify an appender or the threshold for the logging level, logging for this class will be done at the default log levels and by the appender specified by the default (root) category.
3. Default (root) Category
• As mentioned above, this is the catch all for classes that are not specified specifically in the categories section.

So pictorially, it would look like this

Getting back to the reason for this post, here is how you would enable the syslog appender and then configure a category to use this appender. For this example, we will use a class names org.kudithipudi

1. Enable the syslog appender by un-commenting the following section in the jboss-log4j.xml file[code]   <!– Syslog events –>
   <appender name="SYSLOG">
   <errorHandler/>
   <param name="Threshold" value="ERROR"/>
   <param name="Facility" value="LOCAL7"/>
   <param name="FacilityPrinting" value="true"/>
   <param name="SyslogHost" value="localhost"/>
   <layout>
   <param name="ConversionPattern" value="[%d{ABSOLUTE},%c{1}] %m%n"/>
   </layout>
   </appender>
   [/code]
2. Add a new category to use this appender [code]   <category name="org.kudithipudi">
   <priority value="INFO" />
   <appender-ref ref="SYSLOG"/>
   </category> [/code]
3. Restart Jboss and you should see messages from Jboss being sent to the syslog server

Couple of notes..

• Even though we are specifying the threshold of INFO in the category, because we specified a threshold of ERROR in the appender, only message of ERROR type will be sent to the syslog server. This is actually pretty useful when you want to specify two appenders to a category and log them at different levels. You can set another appender to INFO level and add it to this category. And in essence, the appender will log everything of INFO and higher, while the syslog appender will only process ERROR messages.
• The destination for the syslog messages is the SysLogHost parameter. In this example, I just used localhost.