SpringBoot中Log4j2 Syslog Appender无法正常工作求助

我在SpringBoot 1.5.4应用中尝试用Log4j2 Syslog Appender将日志写入syslog，Console和RollingFile Appender工作正常，但/var/log/syslog、local0.log及messages中均无对应日志输出。

Log4j2.xml配置 #

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE XML>
<Configuration name="XMLConfig">
<Properties>
    <Property name="LOG_PATTERN">%d %p %C{1.} [%t] %m%n</Property>
</Properties>
<Appenders>
    <Console name="Console" target="SYSTEM_OUT">
        <PatternLayout pattern="%highlight{%d{HH:mm:ss.SSS} %-5level %logger{36}.%M() @%L - %msg%n%throwable}{FATAL=red blink, ERROR=red, WARN=yellow bold, INFO=black, DEBUG=green bold, TRACE=blue}" />

    </Console >

    <RollingFile name="RollingFile"
                 fileName="/data/storage/log/app.log"
                 filePattern="/data/storage/log/app.%d{yyyy-MM-dd}.%i.Logs.gz">
        <PatternLayout pattern="${LOG_PATTERN}" />
        <Policies>
            <SizeBasedTriggeringPolicy size="100 MB" />
            <TimeBasedTriggeringPolicy />
        </Policies>
        <DefaultRolloverStrategy max ="100">
            <Delete basePath="/data/storage/log/" maxDepth="2">
                <IfFileName glob="*/app*.Logs.gz" />
                <IfLastModified age="P7D" />
            </Delete>
        </DefaultRolloverStrategy>
    </RollingFile>
    <Syslog name="Syslog" format="RFC5424" host="127.0.0.1" port="514"
            protocol="UDP" appName="myApp" enterpriseNumber="25979" facility="LOCAL0" />
</Appenders>

<Loggers>

    <Root level="error">
        <AppenderRef ref="RollingFile" />
        <AppenderRef ref="Console" />
    </Root>
    <Logger name="com.manjosh" level ="error" additivity="false">
        <AppenderRef ref="RollingFile" />
        <AppenderRef ref="Console" />
    </Logger>
    <Logger name="com.manjosh.cms.vnf.util.SyslogUtil" level ="debug" additivity="false">
        <AppenderRef ref="Syslog"/>
    </Logger>
</Loggers>
</Configuration>

服务器rsyslog状态 #

[root@cmsnfv-c_7_1_53_0_standby_karthik ~]# sudo netstat -tulnp | grep 514
udp        0      0 127.0.0.1:514           0.0.0.0:*                           2785/rsyslogd 

Log4j初始化日志 #

2024-09-25 09:05:54,098 main DEBUG Registering MBean org.apache.logging.log4j2:type=33c7353a
2024-09-25 09:05:54,098 main DEBUG Registering MBean org.apache.logging.log4j2:type=33c7353a,component=StatusLogger
2024-09-25 09:05:54,098 main DEBUG Registering MBean org.apache.logging.log4j2:type=33c7353a,component=ContextSelector
2024-09-25 09:05:54,099 main DEBUG Registering MBean org.apache.logging.log4j2:type=33c7353a,component=Loggers,name=
2024-09-25 09:05:54,099 main DEBUG Registering MBean org.apache.logging.log4j2:type=33c7353a,component=Loggers,name=com.manjosh.cms.vnf.util.SyslogUtil
2024-09-25 09:05:54,099 main DEBUG Registering MBean org.apache.logging.log4j2:type=33c7353a,component=Loggers,name=com.manjosh
2024-09-25 09:05:54,099 main DEBUG Registering MBean org.apache.logging.log4j2:type=33c7353a,component=Appenders,name=Console
2024-09-25 09:05:54,099 main DEBUG Registering MBean org.apache.logging.log4j2:type=33c7353a,component=Appenders,name=RollingFile
2024-09-25 09:05:54,099 main DEBUG LoggerContext[name=33c7353a, org.apache.logging.log4j.core.LoggerContext@4524411f] started OK with configuration XmlConfiguration[location=/opt/dist/WebController/conf/log4j2.xml].
2024-09-25 09:05:54,279 main DEBUG AsyncLogger.ThreadNameStrategy=CACHED

Maven依赖 #

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-log4j2</artifactId>
</dependency>

排查建议 #

• 检查rsyslog配置规则：查看/etc/rsyslog.conf或/etc/rsyslog.d/*.conf，确认是否存在local0.* /var/log/local0.log这类匹配LOCAL0设施的规则，没有的话添加后重启rsyslog服务（systemctl restart rsyslog）。
• 抓包验证UDP发送：执行tcpdump udp port 514抓包，确认应用是否真的向127.0.0.1:514发送了UDP数据包。没抓到就是Log4j未触发发送，抓到了但无日志则是rsyslog配置问题。
• 核对日志级别：确认com.manjosh.cms.vnf.util.SyslogUtil类中打印的日志级别是DEBUG及以上，TRACE级别的日志不会被当前配置的Logger捕获。
• 调整Syslog格式：尝试把Syslog Appender的format从RFC5424改为RFC3164（BSD格式），RFC5424格式要求更严格，可能存在兼容性问题。
• 查看rsyslog调试日志：临时启动rsyslog调试模式（rsyslogd -d），查看是否有接收日志时的错误信息，比如格式不兼容、权限不足等。

内容的提问来源于stack exchange，提问作者manjosh