How to setup log4j Syslog Appender in JBoss EAP 6

This solution only works for JBoss EAP 6.0.1 and higher

JBoss ships with a own logging framework and which is used via the org.jboss.logging.Logger class. I myself tend to like to use standardized solution, which is for me - log4j.

Log4j ships with some Appenders, but one especially useful for a Linux environment is SyslogAppender. Here I will show you how to setup log4j org.apache.log4j.net.SyslogAppender with JBoss EAP 6.0.1.

Log4j already is shipped with JBoss, so binaries are required for installation. The configuration is either done in standalone.xml or domain.xml.

        <subsystem xmlns="urn:jboss:domain:logging:1.1">
            ...
            <custom-handler name="SYSLOG" class="org.apache.log4j.net.SyslogAppender" module="org.apache.log4j">
              <level name="INFO"/>
              <formatter>
                <pattern-formatter pattern="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n"/>
              </formatter>
              <properties>
                <property name="syslogHost" value="localhost:514"/>
                <property name="facility" value="LOCAL1"/>
                <property name="facilityPrinting" value="false"/>
              </properties>
            </custom-handler>
            ...
            <root-logger>
                <level name="INFO"/>
                <handlers>
                    ...
                    <handler name="SYSLOG"/>
                </handlers>
            </root-logger>
        </subsystem>

In the above configuration I'm using a local rsyslog server listening on UDP port 514. The log4j does not have a Syslog Appender that supports TCP. To test this configuration I'm using RHEL 6 and in a default installed RHEL an UDP listener is not default configured. To activate it, open /etc/rsyslog.conf and uncomment the below.

$ Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

Now restart rsyslog with:

$ service rsyslog restart

Now start JBoss and watch logging messages in the default log rsyslog message file.

$ less /var/log/messages

After verified the Syslog Appender, you probably want to separate JBoss logging to a separate file. How to configure that is out of the scoop for this blog, but a simplistic configuration in /etc/rsyslog.conf is:

local1.*                                                /var/log/local0.log

After modification, restart rsyslog and rsyslog will automatically create the new log file.