Syslog Logging

Last modified 05 Jun 2024 12:36 +02:00

We need to change the logging appender in order to set up syslog logging. The default appender has to be replaced by a syslog appender that sends the data to a syslog server instead of writing them to file. To do that edit the System Configuration Object and locate logging configuration in the logging element. There is probably a lot of configured loggers (usually classLogger elements). The loggers mostly control the granularity of the logging. What we are looking for is appender element. Existing appender element should be replaced by following configuration:

<systemConfiguration>
    ...
    <logging>

        <!-- logger configuration should be here -->

        <appender xsi:type="c:SyslogAppenderConfigurationType" name="MIDPOINT_LOG"
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <syslogHost>syslog.example.com</syslogHost>
            <facility>LOCAL3</facility>
            <suffixPattern>[%X{subsystem}] [%thread] %level \(%logger\): %msg</suffixPattern>
        </appender>

        <rootLoggerAppender>MIDPOINT_LOG</rootLoggerAppender>
        <rootLoggerLevel>INFO</rootLoggerLevel>
        ...
    </logging>


</systemConfiguration>

Make sure that the logger name (MIDPOINT_LOG) matches the definition in the rootLoggerAppender. Such configuration will send data from all the loggers to the syslog appender (unless specified otherwise).

Explanation of individual configuration properties of the syslog appender can be found on LogBack page.

When the system configuration object is saved then midPoint should start logging to the syslog server immediately. If that does not work try restarting the system, however that is usually not necessary.

This configuration will send the vast majority of log entries to the syslog server. However, there is one more thing to have a really complete syslog coverage of all midPoint logging. This logging configuration is stored in system configuration object which is stored in midPoint repository (relational database). There is a period of midPoint system initialization during which the access to the database is not yet initialized. Therefore, the logging configuration stored in the database cannot be applied. MidPoint is using default logging settings during this period, which means that it logs to the midpoint.log file. Once the system is initialized to the point that the system configuration object can be retrieved from the database then the logging setting is applied and midPoint starts logging to syslog.

However, even this early initialization logging can be reconfigured. To route even the initialization logging to the syslog server create a logback.xml file in MidPoint Home Directory. This file is supposed to be in the native LogBack format. For the simple case of syslog logging the file should look roughly like this:

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appender name="MIDPOINT_LOG" class="ch.qos.logback.classic.net.SyslogAppender">
        <syslogHost>syslog.example.com</syslogHost>
        <facility>LOCAL3</facility>
        <suffixPattern>[%X{subsystem}] [%thread] %level \(%logger\): %msg</suffixPattern>
    </appender>

    <logger name="ro.isdc.wro.extensions.processor.css.Less4jProcessor" level="ERROR"/>
    <logger name="org.hibernate.engine.jdbc.spi.SqlExceptionHelper" level="OFF"/>
    <logger name="org.hibernate.engine.jdbc.batch.internal.BatchingBatch" level="OFF"/>
    <logger name="PROFILING" level="INFO"/>
    <logger name="com.evolveum.midpoint" level="INFO" />

    <root level="INFO">
        <appender-ref ref="MIDPOINT_LOG"/>
    </root>
</configuration>

After system restart midPoint should start logging to syslog and even the log entries from early system initialization should be there. In case that you are running midPoint cluster this configuration needs to be applied on all the cluster nodes.

Syslog Logging

See Also