March 26, 2019

Syslog Handler in JBoss EAP 6 and 7

Introduction

JBoss EAP 6 and 7 has a two different syslog handler:

  • syslog-handler
  • custom-handler org.jboss.logmanager.handlers.SyslogHandler

syslog-handler

The default syslog-handler only supports UDP.


$ ./jboss-cli.sh -c

/subsystem=logging/syslog-handler=SYSLOG_HANDLER:add()

/subsystem=logging/syslog-handler=SYSLOG_HANDLER:read-resource-description


attribute description expressions-allowed default allowed
level The log level specifying which message levels will be logged by this logger. Message levels lower than this value will be discarded. true ALL  
enabled If set to true the handler is enabled and functioning as normal, if set to false the handler is ignored when processing log messages. true true  
server-address The address of the syslog server. true localhost  
port The port the syslog server is listening on. true 514  
facility Facility as defined by RFC-5424 (http://tools.ietf.org/html/rfc5424)and RFC-3164 (http://tools.ietf.org/html/rfc3164). true user-level kernel
user-level
mail-system
system-daemons
security
syslogd
line-printer
network-news
uucp
clock-daemon
security2
ftp-daemon
ntp
log-audit
log-alert
clock-daemon2
local-use-0
local-use-1
local-use-2
local-use-3
local-use-4
local-use-5
local-use-6
local-use-7
hostname The name of the host the messages are being sent from. For example the name of the host the application server is running on. true    
app-name The app name used when formatting the message in RFC5424 format. By default the app name is \"java\". true java  
syslog-format Formats the log message according to the RFC specification. true RFC5424 RFC5424
RFC3164


custom-handler

custom-handler org.jboss.logmanager.handlers.SyslogHandler is located in jboss-logmanager-.jar and supports UDP, TCP and TLS.

  • jboss-eap-6.4.0/modules/system/layers/base/org/jboss/logmanager/main/jboss-logmanager-1.5.4.Final-redhat-1.jar
  • jboss-eap-7.2.0/modules/system/layers/base/org/jboss/logmanager/main/jboss-logmanager-2.1.5.Final-redhat-00001.jar
Property Description Type Default
serverHostname The address of the syslog server String localhost
port The port of the syslog server int 514
facility The facility used to calculate the priority of the log message CLOCK_DAEMON
CLOCK_DAEMON2
FTP_DAEMON
KERNEL
LINE_PRINTER
LOCAL_USE_0
LOCAL_USE_1
LOCAL_USE_2
LOCAL_USE_3
LOCAL_USE_4
LOCAL_USE_5
LOCAL_USE_6
LOCAL_USE_7
LOG_ALERT
LOG_AUDIT
MAIL_SYSTEM
NETWORK_NEWS
NTP
SECURITY
SECURITY2
SYSLOGD
SYSTEM_DAEMONS
USER_LEVEL
UUCP
USER_LEVEL
appName The name of the application that is logging String java
hostname The name of the host the messages are being sent from. String null
syslogType The type of the syslog used to format the message RFC5424
RFC3164
RFC5424
protocol The protocol to send the message over UDP
TCP
SSL_TCP
UDP
delimiter The delimiter to use at the end of the message if useDelimiter is set to true String For UDP null.
For TCP or SSL_TCP '\n'.
useDelimiter Whether or not the message should be appended with a delimiter boolean For UDP false.
For TCP or SSL_TCP true.
useCountingFraming Prefixes the size of the message, mainly used for TCP or SSL_TCP, connections to the message being sent to the syslog server. See http://tools.ietf.org/html/rfc6587 for more details on framing types. boolean false
truncate Whether or not a message, including the header, should truncate the message if the length in bytes is greater than the maximum length. If set to false messages will be split and sent with the same header values. boolean true
maxLength The maximum length a log message, including the header, is allowed to be. int For RFC3164 1024 (1k).
For RFC5424 2048 (2k)
.


Example


<custom-handler name="SYSLOG" class="org.jboss.logmanager.handlers.SyslogHandler" module="org.jboss.logmanager">
    <encoding value="UTF-8"/>
    <formatter>
        <pattern-formatter pattern="%s%E%n"/>
    </formatter>
    <properties>
        <property name="serverHostname" value="192.168.122.43"/>
        <property name="port" value="514"/>
        <property name="facility" value="LOCAL_USE_6"/>
        <property name="appName" value="JBossEAP"/>
        <property name="hostname" value="localhost.localdomain"/>
        <property name="syslogType" value="RFC3164"/>
        <property name="protocol" value="TCP"/>
        <property name="truncate" value="false"/>
        <property name="maxLength" value="4096"/>
    </properties>
</custom-handler>

No comments: