How to log error and info messages separately into syslog with log4j?

Question

log4j.properties:

# configure the root logger
log4j.rootLogger=INFO, SYSLOG

# configure Syslog facility LOCAL6 appender
log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.threshold=INFO
log4j.appender.SYSLOG.syslogHost=localhost
log4j.appender.SYSLOG.facility=LOCAL6
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.conversionPattern="MyApp: %d\{ISO8601\}%m\n"

logger class

import org.apache.log4j.Logger;

public class Log4jAuditLogger {
    private static Logger LOG = Logger.getLogger(Log4jAuditLogger.class);

    public static void log(String message) {
        LOG.info(message);
    }
}

I want to log info (these are audit messages, i don't want to log error messages here) messages into SYSLOG LOCAL6, and to log error messages(these are internal error messages of the java program) into SYSLOG LOCAL7.

How should I extend this class and configuration file to do this?

I use log4j 1.2.

Answer 1

Add to your log4j.properties another appender:

# configure the root logger
log4j.rootLogger=INFO, SYSLOG, SYSLOG7

# configure Syslog facility LOCAL6 appender
log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.threshold=INFO
log4j.appender.SYSLOG.syslogHost=localhost
log4j.appender.SYSLOG.facility=LOCAL6
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.conversionPattern="MyApp: %d\{ISO8601\}%m\n"

# configure Syslog facility LOCAL7 appender
log4j.appender.SYSLOG7=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG7.threshold=ERROR
#                                  vv change to whatever the host is
log4j.appender.SYSLOG7.syslogHost=localhost 
log4j.appender.SYSLOG7.facility=LOCAL7
log4j.appender.SYSLOG7.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG7.layout.conversionPattern="MyApp: %d\{ISO8601\}%m\n"

Edit regarding comment:

If SYSLOG7 shall only log ERROR (and higher): set the threshold to ERROR level. All messages logged with a lower level won't show.

Tricky part is to show only low levels in Syslog:

You can use a filter to log only messages "lower" than eg ERROR level.

In log4j 2 : The filter is not supported by PropertyConfigurator. So you must change to XML config to use it . See log4j-Wiki about filters .

Example "specific level"

<appender name="info-out" class="org.apache.log4j.FileAppender"> 
            <param name="File" value="info.log"/> 
            <layout class="org.apache.log4j.PatternLayout"> 
                    <param name="ConversionPattern" value="%m%n"/> 
            </layout> 
            <filter class="org.apache.log4j.varia.LevelMatchFilter">
                    <param name="LevelToMatch" value="info" />
                    <param name="AcceptOnMatch" value="true"/>
            </filter>
            <filter class="org.apache.log4j.varia.DenyAllFilter" />
</appender> 

Or "Level range"

<appender name="info-out" class="org.apache.log4j.FileAppender"> 
            <param name="File" value="info.log"/> 
            <layout class="org.apache.log4j.PatternLayout"> 
                    <param name="ConversionPattern" value="%m%n"/> 
            </layout> 
            <filter class="org.apache.log4j.varia.LevelRangeFilter">
                    <param name="LevelMax" value="info"/>
                    <param name="LevelMin" value="info"/>
                    <param name="AcceptOnMatch" value="true"/>
            </filter>
</appender>

Answer 2

In log4j 1.2 we can use filters in the property file. For full separation and better customization I think it's advised to define more loggers.

My example:

log4j.properties:

# configure the root logger
log4j.rootLogger=INFO
log4j.logger.auditLogger=INFO,SYSAUDIT
log4j.logger.appLogger=INFO,SYSAPPINFO,SYSAPPERR

log4j.additivity.auditLogger=false
log4j.additivity.appLogger=false

# SYSAUDIT appender
log4j.appender.SYSAUDIT=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSAUDIT.threshold=INFO
log4j.appender.SYSAUDIT.syslogHost=localhost
log4j.appender.SYSAUDIT.facility=LOCAL6
log4j.appender.SYSAUDIT.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSAUDIT.layout.conversionPattern=Audit Info: %d\{ISO8601\} %m\n
log4j.appender.SYSAUDIT.filter.a=org.apache.log4j.varia.LevelRangeFilter
log4j.appender.SYSAUDIT.filter.a.LevelMin=INFO
log4j.appender.SYSAUDIT.filter.a.LevelMax=INFO

# SYSAPPINFO appender
log4j.appender.SYSAPPINFO=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSAPPINFO.threshold=INFO
log4j.appender.SYSAPPINFO.syslogHost=localhost
log4j.appender.SYSAPPINFO.facility=LOCAL5
log4j.appender.SYSAPPINFO.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSAPPINFO.layout.conversionPattern=App Info: %d\{ISO8601\} %m\n
log4j.appender.SYSAPPINFO.filter.a=org.apache.log4j.varia.LevelRangeFilter
log4j.appender.SYSAPPINFO.filter.a.LevelMin=INFO
log4j.appender.SYSAPPINFO.filter.a.LevelMax=INFO

# SYSAPPERR appender
log4j.appender.SYSAPPERR=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSAPPERR.threshold=ERROR
log4j.appender.SYSAPPERR.syslogHost=localhost
log4j.appender.SYSAPPERR.facility=LOCAL5
log4j.appender.SYSAPPERR.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSAPPERR.layout.conversionPattern=App Error: %d\{ISO8601\} %m\n
log4j.appender.SYSAPPERR.filter.a=org.apache.log4j.varia.LevelRangeFilter
log4j.appender.SYSAPPERR.filter.a.LevelMin=ERROR
log4j.appender.SYSAPPERR.filter.a.LevelMax=ERROR

Log4jLogger class:

public class Log4jLogger {
    private static Logger AUDITLOGGER = Logger.getLogger("auditLogger");
    private static Logger APPLOGGER = Logger.getLogger("appLogger");

    public static void audit(String message)
    {
        AUDITLOGGER.info(message);
    }

    public static void error(String message)
    {
        APPLOGGER.error(message);
    }

    public static void info(String message)
    {
        APPLOGGER.info(message);
    }
}