Am Dienstag, 7. Februar 2017, 00:10:23 schrieb Jochen Schalanda: > This shows that the appender mechanism itself is working but that either > the Syslog appender doesn't work or that you have configured it wrong. > > Try starting with the absolute minimum configuration for the Syslog > appender...
I was abled to solve the problem. It was an error in the configuration though Log4j isn't very specific about what's right and what is the absolute minimum. Messages from Log4j are written to stderr instead of the log file, so I overlooked them at first: ... Caused by: java.lang.$llegalArgumentException: No structured id name was supplied ... main ERROR Null object returned for Syslog in Appenders. main ERROR Unable to locate appender "RFC5424" for logger config "root" Knowing that message it was an easy google to find the issue of Log4j having the mdcId parameter without a default (https://issues.apache.org/jira/browse/LOG4J2-922). A parameter nobody even cared to document (https://logging.apache.org/log4j/2.x/manual/appenders.html#SyslogAppender). If you really want to find out something about mdcId you have to go to https://logging.apache.org/log4j/2.0/log4j-core/apidocs/org/apache/logging/log4j/core/layout/Rfc5424Layout.html#createLayout%28org.apache.logging.log4j.core.net.Facility, %20java.lang.String,%20int,%20boolean,%20java.lang.String,%20java.lang.String, %20java.lang.String,%20boolean,%20java.lang.String,%20java.lang.String, %20java.lang.String,%20java.lang.String,%20java.lang.String, %20java.lang.String,%20java.lang.String,%20boolean, %20org.apache.logging.log4j.core.layout.LoggerFields[], %20org.apache.logging.log4j.core.config.Configuration%29 (yes, that's a link). Point is the mdcId parameter needs a value and doesn't have one. Log4j does not care what value it is, even an empty string is fine. So the minimum config for a RFC5424 syslog appender is: <Syslog name="RFC5424" format="RFC5424" host="127.0.0.1" port="8514" protocol="UDP" mdcId="mdc"/> Greetings Frank -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/10857472.ASFgAvzGMa%40studio.engler.invalid. For more options, visit https://groups.google.com/d/optout.
