properties - log4j2.properties 系统日志不工作

Question

我的 java 应用程序问题是 log4j2 系统日志不是写在 'local1.log' 中而是'消息'。我的/etc/rsyslog.conf 在/etc/rsyslog.conf 中配置为 'local1.*/var/log/local1.log'。

但奇怪的是，当我从 log4j2.properties 中删除“appender.syslog.layout.type”和“appender.syslog.layout.pattern”时，syslog 开始正确写入/var/log/local1.log。

我的配置不正确吗？

系统日志中是否没有应用布局属性？

[/etc/rsyslog.conf]

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none;local1.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

...

local1.*                                                /var/log/local1.log

[使用了 log4j2 库]

log4j-api-2.17.2.jar
log4j-core-2.17.2.jar

[log4j2.properties]

status = warn
name = Test

# Console appender configuration
appender.console.type = Console
appender.console.name = consoleLogger
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = %d{HH:mm:ss} %5p (%c{1} - %M:%L) - %m%n

appender.syslog.type = Syslog
appender.syslog.name = sysLogger
appender.syslog.host = localhost
appender.syslog.port = 514
appender.syslog.protocol = UDP
appender.syslog.facility = LOCAL1
appender.syslog.layout.type = PatternLayout
appender.syslog.layout.pattern = %c{1} (%M:%L) %m\n

# Root logger level
rootLogger.level = debug
rootLogger.appenderRefs = consoleLogger, sysLogger
rootLogger.appenderRef.stdout.ref = consoleLogger
rootLogger.appenderRef.syslog.ref = sysLogger

Answer 1

Log4j2 的系统日志布局用于格式化整个 系统日志消息，因此必须是SyslogLayout 之一。 (传统的 BSD 系统日志格式)或 Rfc5424Layout (现代系统日志布局)。使用任何其他布局将导致无效消息，并且 RSyslog 将不得不猜测消息的元数据。最值得注意的是，设施将设置为 USER。

如果您想向 syslog 发送额外的数据，超出 %m，您应该使用 RFC5424 格式并将额外信息发送为 structured data .例如，您可以使用(XML 格式):

<Syslog name="sysLogger" host="localhost" port="514" protocol="UDP">
  <Rfc5424Layout appName="MyApp" facility="LOCAL1">
    <LoggerFields enterpriseId="32473" sdId="location">
      <KeyValuePair key="logger" value="%c" />
      <KeyValuePair key="class" value="%C" />
      <KeyValuePair key="method" value="%M" />
      <KeyValuePair key="line" value="%L" />
    </LoggerFields>
  </Rfc5424Layout>
</Syslog>

转换为属性格式为:

appender.syslog.type = Syslog
appender.syslog.name = sysLogger
appender.syslog.host = localhost
appender.syslog.port = 514
appender.syslog.protocol = UDP
appender.syslog.layout.type = Rfc5424Layout
appender.syslog.layout.facility = LOCAL1
appender.syslog.layout.appName = MyApp
appender.syslog.layout.fields.type = LoggerFields
appender.syslog.layout.fields.enterpriseId = 32473
appender.syslog.layout.fields.sdId = location
appender.syslog.layout.fields.0.type = KeyValuePair
appender.syslog.layout.fields.0.key = logger
appender.syslog.layout.fields.0.value = %c
...

几乎所有现代系统日志服务器都可以解释结构化数据。对于 RSyslog，您需要:

1. 启用结构化数据解析:

   module(load="mmpstrucdata")
   action(type="mmpstrucdata")
   

2. 创建一个模板来格式化您的消息:

   template(name="MyAppFormat" type="list") {
       property(name="timereported" dateFormat="rfc3339")
       constant(value=" ")
       property(name="hostname")
       constant(value=" ")
       property(name="syslogtag")
       constant(value=" ")
       property(name="$!rfc5424-sd!location@32473!class")
       constant(value=" (")
       property(name="$!rfc5424-sd!location@32473!method")
       constant(value=":")
       property(name="$!rfc5424-sd!location@32473!line")
       constant(value=") ")
       property(name="msg" droplastlf="on")
       constant(value="\n")
   }
   

3. 对来自“MyApp”的消息使用模板:

   :app-name, isequal, "MyApp" {
       /var/log/myapp.log;MyAppFormat
       stop
   }