Syslog Handler in JBoss EAP 6 and 7

Introduction

JBoss EAP 6 and 7 has a two different syslog handler:

• syslog-handler
• custom-handler org.jboss.logmanager.handlers.SyslogHandler

syslog-handler

The default syslog-handler only supports UDP.

$ ./jboss-cli.sh -c

/subsystem=logging/syslog-handler=SYSLOG_HANDLER:add()

/subsystem=logging/syslog-handler=SYSLOG_HANDLER:read-resource-description

attribute	description	expressions-allowed	default	allowed
level	The log level specifying which message levels will be logged by this logger. Message levels lower than this value will be discarded.	true	ALL
enabled	If set to true the handler is enabled and functioning as normal, if set to false the handler is ignored when processing log messages.	true	true
server-address	The address of the syslog server.	true	localhost
port	The port the syslog server is listening on.	true	514
facility	Facility as defined by RFC-5424 (http://tools.ietf.org/html/rfc5424)and RFC-3164 (http://tools.ietf.org/html/rfc3164).	true	user-level	kernel user-level mail-system system-daemons security syslogd line-printer network-news uucp clock-daemon security2 ftp-daemon ntp log-audit log-alert clock-daemon2 local-use-0 local-use-1 local-use-2 local-use-3 local-use-4 local-use-5 local-use-6 local-use-7
hostname	The name of the host the messages are being sent from. For example the name of the host the application server is running on.	true
app-name	The app name used when formatting the message in RFC5424 format. By default the app name is \"java\".	true	java
syslog-format	Formats the log message according to the RFC specification.	true	RFC5424	RFC5424 RFC3164

custom-handler

custom-handler org.jboss.logmanager.handlers.SyslogHandler is located in jboss-logmanager-.jar and supports UDP, TCP and TLS.

• jboss-eap-6.4.0/modules/system/layers/base/org/jboss/logmanager/main/jboss-logmanager-1.5.4.Final-redhat-1.jar
• jboss-eap-7.2.0/modules/system/layers/base/org/jboss/logmanager/main/jboss-logmanager-2.1.5.Final-redhat-00001.jar

Property	Description	Type	Default
serverHostname	The address of the syslog server	String	localhost
port	The port of the syslog server	int	514
facility	The facility used to calculate the priority of the log message	CLOCK_DAEMON CLOCK_DAEMON2 FTP_DAEMON KERNEL LINE_PRINTER LOCAL_USE_0 LOCAL_USE_1 LOCAL_USE_2 LOCAL_USE_3 LOCAL_USE_4 LOCAL_USE_5 LOCAL_USE_6 LOCAL_USE_7 LOG_ALERT LOG_AUDIT MAIL_SYSTEM NETWORK_NEWS NTP SECURITY SECURITY2 SYSLOGD SYSTEM_DAEMONS USER_LEVEL UUCP	USER_LEVEL
appName	The name of the application that is logging	String	java
hostname	The name of the host the messages are being sent from.	String	null
syslogType	The type of the syslog used to format the message	RFC5424 RFC3164	RFC5424
protocol	The protocol to send the message over	UDP TCP SSL_TCP	UDP
delimiter	The delimiter to use at the end of the message if useDelimiter is set to true	String	For UDP null. For TCP or SSL_TCP '\n'.
useDelimiter	Whether or not the message should be appended with a delimiter	boolean	For UDP false. For TCP or SSL_TCP true.
useCountingFraming	Prefixes the size of the message, mainly used for TCP or SSL_TCP, connections to the message being sent to the syslog server. See http://tools.ietf.org/html/rfc6587 for more details on framing types.	boolean	false
truncate	Whether or not a message, including the header, should truncate the message if the length in bytes is greater than the maximum length. If set to false messages will be split and sent with the same header values.	boolean	true
maxLength	The maximum length a log message, including the header, is allowed to be.	int	For RFC3164 1024 (1k). For RFC5424 2048 (2k) .

Example

<custom-handler name="SYSLOG" class="org.jboss.logmanager.handlers.SyslogHandler" module="org.jboss.logmanager">
    <encoding value="UTF-8"/>
    <formatter>
        <pattern-formatter pattern="%s%E%n"/>
    </formatter>
    <properties>
        <property name="serverHostname" value="192.168.122.43"/>
        <property name="port" value="514"/>
        <property name="facility" value="LOCAL_USE_6"/>
        <property name="appName" value="JBossEAP"/>
        <property name="hostname" value="localhost.localdomain"/>
        <property name="syslogType" value="RFC3164"/>
        <property name="protocol" value="TCP"/>
        <property name="truncate" value="false"/>
        <property name="maxLength" value="4096"/>
    </properties>
</custom-handler>