.NET6应用中Serilog UdpSysLog日志丢失问题排查与解决

我在.NET 6控制台/Web应用中使用Serilog的UdpSysLog实现日志记录时，遇到了日志丢失的问题：短时间内发送大量日志（比如处理文件时生成最多4000条差异日志）时，每次都会随机丢失部分日志。本地文件写入日志完全正常，换成log4net后该问题就不再出现。

更新结论：
并非Serilog组件本身的问题。改用TCP协议后问题依然存在，最终定位是日志服务器CPU占用过高导致日志丢失。log4net因为采用阻塞模式限制了日志发送速率，所以没有出现该问题，解决方案是升级日志服务器配置。

csproj依赖配置 #

<PackageReference Include="Serilog" Version="2.11.0" />
<PackageReference Include="Serilog.Sinks.SyslogMessages" Version="2.0.6" />
<PackageReference Include="Serilog.Enrichers.Environment" Version="2.2.0" />
<PackageReference Include="Serilog.Enrichers.Thread" Version="3.2.0-dev-00752" />
<PackageReference Include="Serilog.AspNetCore" Version="6.0.0-dev-00265" />

appsettings.json配置 #

"Serilog": {
  "WriteTo": [
    {
      "Name": "File",
      "Args": {
        "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff}||{Level:u3}||{Product}||{Application}||{EnvironmentName}||{MachineName}||{ThreadId}||{CorrelationId}||{SourceContext}||{Message}{Exception}{NewLine}",
        "path": "d:/loggingapp-.txt",
        "retainedFileCountLimit": 7,
        "rollingInterval": "Day"
      }
    },
    {
      "Name": "UdpSyslog",
      "Args": {
        "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff}||{Level:u3}||{Product}||{Application}||{EnvironmentName}||{MachineName}||{ThreadId}||{CorrelationId}||{SourceContext}||{Message}{Exception}{NewLine}",
        "host": "hostname",
        "port": 514
      }
    }
  ]
}

Project.cs中的Serilog配置 #

var _builder = new ConfigurationBuilder();

_builder.SetBasePath(Directory.GetCurrentDirectory())
                    .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)
                    .AddEnvironmentVariables();

Log.Logger = new LoggerConfiguration()
    .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
    .MinimumLevel.Override("Microsoft.Hosting.Lifetime", LogEventLevel.Information)
    .MinimumLevel.Override("Microsoft.AspNetCore", LogEventLevel.Warning)
    .Filter.ByExcluding(Matching.WithProperty("RequestPath", "/healthz"))
    .Enrich.WithProperty("Application", "Serilog")
    .Enrich.WithProperty("Product", "LoggingTestApp")
    .Enrich.WithEnvironmentName()
    .Enrich.WithMachineName()
    .Enrich.WithThreadId()
    .Enrich.FromLogContext()
    .ReadFrom.Configuration(_builder.Build())
    .CreateLogger();

var _host = Host.CreateDefaultBuilder()
            .ConfigureServices((context, services) => {
                services.AddTransient<LoggingTestApp.IWorkflow, LoggingTestApp.Workflow>();
            })
            .UseSerilog()
            .Build();

内容的提问来源于stack exchange，提问作者Mahoney0101