serioussam / syslogappender

Syslog appender for logback with full rfc 5424 support

Syslog appender for logback with full RFC-5424 support

syslogappender

A Logback appender that leverages [syslog4j][] to send log messages to remote systems via syslog compatible to RFC-5424 format.

Why?

The existing syslog appender for Logback only provides the ability to send messages via UDP. Using syslog-java-client allows us to send messages via TCP and optionally to encrypt them by sending over TCP with TLS. This library also take care of adding message length as per RFC-5424 so log lines containing new lines work correctly.

How?

Setup using https://bintray.com/serioussam/oss/com.github.serioussam%3Asyslogappender Add this to your pom.xml:

    <dependency>
      <groupId>com.github.serioussam</groupId>
      <artifactId>syslogappender</artifactId>
      <version>1.0.0</version>
    </dependency>

Then add the appender to your logback.xml.

If not using Maven, download [logback-syslog4j-1.0.0.jar][] and the latest [syslog4j][] JAR. Place these files in the classpath, in addition to Logback itself.

Logging via TCP with TLS (recommended)

  <appender name="SYSLOG-TLS" class="com.github.serioussam.syslogappender.SyslogAppender">
    <layout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%date %-5level %logger{35} - %message%n</pattern>
    </layout>

    <syslogConfig class="SyslogConfig">
      <!-- remote system to log to -->
      <host>localhost</host>
      <!-- remote port to log to -->
      <port>514</port>
      <!-- program name to log as -->
      <programName>java-app</programName>
      <!-- protocol TCP_TLS -->
      <protocol>TCP_TLS</protocol>
    </syslogConfig>
  </appender> 

  <root level="DEBUG">
    <appender-ref ref="SYSLOG-TLS" />
  </root>

Logging via TCP

  <appender name="SYSLOG-TCP" class="com.github.serioussam.syslogappender.SyslogAppender">
    <layout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%date %-5level %logger{35} - %message%n</pattern>
    </layout>

    <syslogConfig class="SyslogConfig">
      <!-- remote system to log to -->
      <host>localhost</host>
      <!-- remote port to log to -->
      <port>514</port>
      <!-- program name to log as -->
      <programName>java-app</programName>
      <!-- protocol TCP -->
      <protocol>TCP</protocol>
    </syslogConfig>
  </appender> 

  <root level="DEBUG">
    <appender-ref ref="SYSLOG-TCP" />
  </root>

Logging via UDP

  <appender name="SYSLOG-UDP" class="com.github.serioussam.syslogappender.SyslogAppender">
    <layout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%date %-5level %logger{35} - %message%n</pattern>
    </layout>

    <syslogConfig class="SyslogConfig">
      <!-- remote system to log to -->
      <host>localhost</host>
      <!-- remote port to log to -->
      <port>514</port>
      <!-- program name to log as -->
      <programName>java-app</programName>
      <!-- protocol UDP -->
      <protocol>UDP</protocol>
    </syslogConfig>
  </appender> 

  <root level="DEBUG">
    <appender-ref ref="SYSLOG-UDP" />
  </root>

syslogappender's Issues

SyslogConfig class must be fully qualified

The examples in the readme contain a bug. The syslogConfig class name needs to be fully qualified. So this:
<syslogConfig class="SyslogConfig">

Should be this:
<syslogConfig class="com.github.serioussam.syslogappender.SyslogConfig">

Blank log entries are generated with every message

This line writes the size of the message before the message:
https://github.com/serioussam/syslogappender/blob/master/src/main/java/com/github/serioussam/syslogappender/TcpSyslogMessage.java#L18

But it writes the message using the syslog library, which is adding \r\n after the message:
https://github.com/CloudBees-community/syslog-java-client/blob/master/src/main/java/com/cloudbees/syslog/sender/TcpSyslogMessageSender.java#L94

The result is our RSYSLOG instance is receiving the message, and then an extra \r\n, thus forwarding on blank log entries.

I'm not sure that adding +2 to the size would fix it, because then the problem would be that every log entry ends in \r\n.

Setting the keystore and trustore path

Hello,

Thanks for your great work ! I just wanted to know if it was possible to set the path of the client's keystore and trustore when using the syslog appender. I'm trying to communicate to a server that uses two-way authentication and I need to specify both a trustore and a keystore file for the client. I didn't see that option, but maybe i'm wrong.

Best Regards,

Mathieu

no longer on maven repositories ?

Hi

one of my projects was using your library, but i noticed the build is failing on Gihtub Actions recently, and the reason is that
it couldn't find it on Maven repo

Could not find syslogappender.jar (com.github.serioussam:syslogappender:1.0.0).
Searched in the following locations:
https://jcenter.bintray.com/com/github/serioussam/syslogappender/1.0.0/syslogappender-1.0.0.jar