Introduction

All WSO2 Carbon based products use log4j as the logging API. Users and Developers can alter logging options by changing the log4j.properties file in $CARBON_HOME/lib

There are two ways we can configure Syslog-ng server with WSO2 Carbon products. In the first method user can enable the log4j syslog appender and in the second method user has to configure local syslog server to poll the WSO2 Carbon log file located in $CARBON_HOME/repository/logs/wso2carbon.log.

Applies To

Method 01: Carbon Server logs to a Syslog server using syslog appender

Enable Syslog appender in $CARBON_HOME/repository/etc/log4j.properties. In the default Carbon server configuration Syslog appender is enabled with log level DEBUG.

$CARBON_HOME/repository/etc/log4j.properties

log4j.rootLogger=INFO, CARBON_CONSOLE, CARBON_LOGFILE, CARBON_MEMORY, CARBON_SYS_LOG

log4j.appender.CARBON_SYS_LOG = org.apache.log4j.net.SyslogAppender
log4j.appender.CARBON_SYS_LOG.layout=org.apache.log4j.PatternLayout
log4j.appender.CARBON_SYS_LOG.layout.ConversionPattern=[%d] %5p {%c} - %x %m {%c}%n
log4j.appender.CARBON_SYS_LOG.SyslogHost=localhost
log4j.appender.CARBON_SYS_LOG.Facility=USER
log4j.appender.CARBON_SYS_LOG.threshold=DEBUG

In the default configuration Carbon servers send log messages to locally hosted syslog listening on port 514 via UDP. Log4j supports log facility feature and Carbon uses USER log facility.

Syslog-ng Configuration.

Syslog-ng is a powerful log server and most of the GNU/Linux systems are compatible with Syslog-ng.

/etc/syslog-ng/syslog-ng.conf

#enable syslog UDP server on port 514
source s_net { udp(ip(127.0.0.1)); };

#Create log destination 
destination d_wso2 { file("/var/log/wso2.log"); };

#Filter message comes through USER log facility
filter f_user { facility(user) and not filter(f_debug); };

#log the message received to s_net to d_wso2 after filtering log facility
log { source(s_net); filter(f_user); destination(d_wso2); };

Method 02:
Syslog-ng server poll $CARBON_HOME/repository/logs/wso2carbon.log log file and send the log lines to a different Syslog-ng server

In this setup a syslog server should run in the same machine to collect updated logs lines form wso2carbon.log file. User has to configure the local Syslog-ng server as follows.

Log Collection configuration in the local log reader.

/etc/syslog-ng/syslog-ng.conf

#Log destination
destination d_log_node0_tcp { tcp("remote log collector name/IP" port(5140)); };

#Log source
source s_file {
          file("/WSO2_CARBON_HOME/repository/logs/wso2carbon.log" follow_freq(2) );
};

#Log updated log messages from local log file to network destination
log { source(s_file); destination(d_log_node0_tcp); };

Log writing configuration in the remote log collector / writer

/etc/syslog-ng/syslog-ng.conf.

#listen via TCP
source ts_net { tcp(Log Collector name / IP) port(5140) max-connections(20)); };
#log destination
destination d_carbon_log { file("/PATH/wso2carbon.log" owner(root) group(root) perm(0666)); };
#log received from remote server via port 5140
log { source(ts_net); destination(d_carbon_log); };

Summery

WSO2 product users have number of methods to manage the logs file. Syslog-ng is a popular option among Linux /Unix based deployments.
Log rotation is another important aspect of log management. Log rotation facility available in most Linux /Unix system can be used with Syslog-ng to
achieve log rotation.