Introduction
JBoss EAP 6 and 7 has a two different syslog handler:
- syslog-handler
- custom-handler org.jboss.logmanager.handlers.SyslogHandler
syslog-handler
The default syslog-handler only supports UDP.
$ ./jboss-cli.sh -c
/subsystem=logging/syslog-handler=SYSLOG_HANDLER:add()
/subsystem=logging/syslog-handler=SYSLOG_HANDLER:read-resource-description
| attribute |
description |
expressions-allowed |
default |
allowed |
| level |
The log level specifying which message levels will be logged by this logger. Message levels lower than this value will be discarded. |
true |
ALL |
|
| enabled |
If set to true the handler is enabled and functioning as normal, if set to false the handler is ignored when processing log messages. |
true |
true |
|
| server-address |
The address of the syslog server. |
true |
localhost |
|
| port |
The port the syslog server is listening on. |
true |
514 |
|
| facility |
Facility as defined by RFC-5424 (http://tools.ietf.org/html/rfc5424)and RFC-3164 (http://tools.ietf.org/html/rfc3164). |
true |
user-level |
kernel
user-level
mail-system
system-daemons
security
syslogd
line-printer
network-news
uucp
clock-daemon
security2
ftp-daemon
ntp
log-audit
log-alert
clock-daemon2
local-use-0
local-use-1
local-use-2
local-use-3
local-use-4
local-use-5
local-use-6
local-use-7
|
| hostname |
The name of the host the messages are being sent from. For example the name of the host the application server is running on. |
true |
|
|
| app-name |
The app name used when formatting the message in RFC5424 format. By default the app name is \"java\". |
true |
java |
|
| syslog-format |
Formats the log message according to the RFC specification. |
true |
RFC5424 |
RFC5424
RFC3164
|
custom-handler
custom-handler org.jboss.logmanager.handlers.SyslogHandler is located in jboss-logmanager-.jar and supports UDP, TCP and TLS.
- jboss-eap-6.4.0/modules/system/layers/base/org/jboss/logmanager/main/jboss-logmanager-1.5.4.Final-redhat-1.jar
- jboss-eap-7.2.0/modules/system/layers/base/org/jboss/logmanager/main/jboss-logmanager-2.1.5.Final-redhat-00001.jar
| Property |
Description |
Type |
Default
|
| serverHostname |
The address of the syslog server |
String |
localhost |
| port |
The port of the syslog server |
int |
514 |
| facility |
The facility used to calculate the priority of the log message |
CLOCK_DAEMON
CLOCK_DAEMON2
FTP_DAEMON
KERNEL
LINE_PRINTER
LOCAL_USE_0
LOCAL_USE_1
LOCAL_USE_2
LOCAL_USE_3
LOCAL_USE_4
LOCAL_USE_5
LOCAL_USE_6
LOCAL_USE_7
LOG_ALERT
LOG_AUDIT
MAIL_SYSTEM
NETWORK_NEWS
NTP
SECURITY
SECURITY2
SYSLOGD
SYSTEM_DAEMONS
USER_LEVEL
UUCP
|
USER_LEVEL |
| appName |
The name of the application that is logging |
String |
java |
| hostname |
The name of the host the messages are being sent from. |
String |
null |
| syslogType |
The type of the syslog used to format the message |
RFC5424 RFC3164 |
RFC5424 |
| protocol |
The protocol to send the message over |
UDP TCP SSL_TCP
|
UDP |
| delimiter |
The delimiter to use at the end of the message if useDelimiter is set to true |
String |
For UDP null. For TCP or SSL_TCP '\n'.
|
| useDelimiter |
Whether or not the message should be appended with a delimiter |
boolean |
For UDP false. For TCP or SSL_TCP true.
|
| useCountingFraming |
Prefixes the size of the message, mainly used for TCP or SSL_TCP, connections to the message being sent to the syslog server. See http://tools.ietf.org/html/rfc6587
for more details on framing types. |
boolean |
false |
| truncate |
Whether or not a message, including the header, should truncate the message if the length in bytes is
greater than the maximum length. If set to false messages will be split and sent
with the same header values. |
boolean |
true |
| maxLength |
The maximum length a log message, including the header, is allowed to be. |
int |
For RFC3164 1024 (1k). For RFC5424 2048 (2k) . |
Example
<custom-handler name="SYSLOG" class="org.jboss.logmanager.handlers.SyslogHandler" module="org.jboss.logmanager">
<encoding value="UTF-8"/>
<formatter>
<pattern-formatter pattern="%s%E%n"/>
</formatter>
<properties>
<property name="serverHostname" value="192.168.122.43"/>
<property name="port" value="514"/>
<property name="facility" value="LOCAL_USE_6"/>
<property name="appName" value="JBossEAP"/>
<property name="hostname" value="localhost.localdomain"/>
<property name="syslogType" value="RFC3164"/>
<property name="protocol" value="TCP"/>
<property name="truncate" value="false"/>
<property name="maxLength" value="4096"/>
</properties>
</custom-handler>