(Re)Configuring the log4j.properties in dCache to output to Syslog

At AGLT2 we have setup a central loghost running syslog-ng which also has a php-syslog-ng web interface to a backend MySQL DB. To aid in problem resolution and event notification we wanted to get more information from dCache sent as part of our regular syslog-ng data flow.

Brian Bockleman gave me the idea to try to reconfigure the log4j setup that dCache uses. Digging into it a bit I found that there was a "appender" for syslog available. I edited the /opt/d-cache/config/log4j.properties (after making a copy). The diff is:

root@head01 /opt/d-cache/config# diff -urN log4j.properties.25Sep2008 log4j.properties
--- log4j.properties.25Sep2008  2008-07-04 08:11:22.000000000 -0400
+++ log4j.properties    2008-09-25 16:47:44.000000000 -0400
@@ -2,7 +2,10 @@
 # $Id: DCachetoSyslogNG.txt,v 1.3 2009/10/16 20:14:39 TomRockwell Exp $
 #
 # Sample log4j setup file
-log4j.rootLogger=WARN, stdout
+log4j.rootLogger=WARN, stdout, SYSLOG
+
+#+SPM Sep 25 2008
+#log4j.debug=true

 # do not print twice if appender already defined
 #
@@ -12,14 +15,14 @@
 log4j.additivity.org.dcache=false
 log4j.additivity.diskCacheV111=false

-log4j.logger.org.dcache.chimera=INFO, stdout
-log4j.logger.com.mchange=ERROR, stdout
+log4j.logger.org.dcache.chimera=INFO, stdout, SYSLOG
+log4j.logger.com.mchange=ERROR, stdout, SYSLOG

 # dCache business logic logging
-log4j.logger.logger.org.dcache.repository=INFO, stdout
-log4j.logger.logger.org.dcache.namespace=INFO, stdout
-log4j.logger.logger.org.dcache.cells.messages=ERROR, stdout
-log4j.logger.diskCacheV111.doors=WARN,stdout
+log4j.logger.logger.org.dcache.repository=INFO, stdout, SYSLOG
+log4j.logger.logger.org.dcache.namespace=INFO, stdout, SYSLOG
+log4j.logger.logger.org.dcache.cells.messages=ERROR, stdout, SYSLOG
+log4j.logger.diskCacheV111.doors=WARN,stdout, SYSLOG



@@ -60,6 +63,14 @@
 log4j.appender.traceFile.layout=org.apache.log4j.PatternLayout
 log4j.appender.traceFile.layout.ConversionPattern=%d{dd MMM yyyy HH:mm:ss} %c %l %m%n

+# Syslog
+log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
+log4j.appender.SYSLOG.syslogHost=head01.aglt2.org
+log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
+log4j.appender.SYSLOG.layout.ConversionPattern=%m%n
+log4j.appender.SYSLOG.Facility=LOCAL0
+
+
 # Mail
 #
 # SMTPAppender needs jars from j2ee: mail.jar, j2ee.jar, activation.jar

Some comments:

• You need to define your syslogHost. I used the FQDN of my localhost to get the syslog-ng forwarding correctly done.
• If you run syslog-ng on your localhost, make sure the inputs allow udp (udp() or equivalent)
• The ConversionPattern is very customizable and I will show options below. I choose a simple default of %m%n (Message followed by return)

I am including the complete edit log4j.properties here log4j.properties

Options for Message Layout

Here are some options outlined that I found at this very useful site http://www.vipan.com/htdocs/log4jhelp.html :

!-----------------------------------------------------------------------------!
!                          PATTERN FORMATS GLOSSARY                           !
!-----------------------------------------------------------------------------!
! %n - newline                                                                !
! %m - your log message                                                       !
! %p - message priority (FATAL, ERROR, WARN, INFO, DEBUG or custom)           !
! %r - millisecs since program started running                                !
! %% - percent sign in output                                                 !
!                                                                             !
!-----------------------SOME MORE CLUTTER IN YOUR LOG-------------------------!
! %c - name of your category (logger), %c{2} will outputs last two components !
! %t - name of current thread                                                 !
! %x - Nested Diagnostic Context (NDC) (you supply it!)                       !
!                                                                             !
!-------------------------SLOW PERFORMANCE FORMATS----------------------------!
! %d - date and time, also %d{ISO8601}, %d{DATE}, %d{ABSOLUTE},               !
!        %d{HH:mm:ss,SSS}, %d{dd MMM yyyy HH:mm:ss,SSS} and so on             !
! %l - Shortcut for %F%L%C%M                                                  !
! %F - Java source file name                                                  !
! %L - Java source line number                                                !
! %C - Java class name, %C{1} will output the last one component              !
! %M - Java method name                                                       !
!                                                                             !
!------------------------------FORMAT MODIFIERS-------------------------------!
! %-any_letter_above - Left-justify in min. width (default is right-justify)  !
! %20any_letter_above - 20 char. min. width (pad with spaces if reqd.)        !
! %.30any_letter_above - 30 char. max. width (truncate beginning if reqd.)    !
! %-10.10r - Example.  Left-justify time elapsed within 10-wide field.        !
!              Truncate from beginning if wider than 10 characters.           !
!-----------------------------------------------------------------------------!

You can just edit the log4j.properties and put your own selection in. After making a change I just kill -HUP <PID> for every PID using log4j.properties (Not sure what this does to any pid file tracking these processes though...).

Contact me (Shawn McKee; smckee@umich.edu) if you have questions or suggestions.

-- ShawnMcKee - 25 Sep 2008