Log4j SyslogAppender won't log to syslog without daemon restart

Question

Can someone help me understand why Log4j messages meant to get logged in syslog sometimes won't appear until I restart the rsyslog daemon?

On Ubuntu I've got a Java project setup to use Log4j2. I am using Log4j's SyslogAppender to log messages to rsyslog.

When I reference the SyslogAppender in the Root logger inside the log4j2.xml file, my messages get logged to /var/log/syslog every time.

When I reference the SyslogAppender in a logger for a Java object that I created (and remove the reference from the root logger), I see the following behavior every time:

1. Start Java program (log messages)
2. Verify message gets logged to /var/log/syslog (this step is successful)
3. Stop Java program
4. Restart Java program (log messages)
5. Verify messages get logged to /var/log/syslog (step fails)
6. Restart rsyslog: sudo service rsyslog restart
7. The expected message from step-5 then appears in /var/log/syslog

At step 5, I've waited up to 10 minutes. These steps happen like this no matter how long I wait.

Here is my log4j2.xml file:

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="INFO">
    <Appenders>
        <Syslog name="bsd" host="localhost" port="514" protocol="UDP" facility="SYSLOG"/>
        <Console name="Console" target="SYSTEM_OUT">
            <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n" />
        </Console>
    </Appenders>
    <Loggers>
        <Logger name="com.test.SyslogMgr" level="all">
            <AppenderRef ref="bsd"/>
        </Logger>
        <Root level="error">
<!--If I leave this ref to "bsd" in and remove the ref in SyslogMgr, logs always appear.-->
<!--If I remove this "bsd" ref and leave SyslogMgr's in, I get the behavior described above -->
            <AppenderRef ref="bsd"/>
            <AppenderRef ref="Console" />
        </Root>
    </Loggers>
</Configuration>

Here is my Java Class:

public class SyslogMgr {
    private static final org.apache.logging.log4j.Logger logger = LogManager.getLogger(SyslogMgr.class);

    public void addToSyslog(String msg) {
        logger.info(msg);
    }
}

Michael Michael · Accepted Answer · 2017-02-09T00:04:46

So I don't have an answer for why the logs would always work if the Syslog Appender was referenced in the Root Logger (this was a secondary concern), but I figured out that the problem on my system was that I needed to edit the rsyslog config file and turn off RepeatedMsgReduction (this solved my problem):

Changed:

$RepeatedMsgReduction on

To:

$RepeatedMsgReduction off

Then restarted rsyslog

Log4j SyslogAppender won't log to syslog without daemon restart

1 Answers