Skip to content

Commit 4adaf7d

Browse files
author
Damien Dallimore
committed
Log4J2 example config for TCP/UDP
1 parent 424339f commit 4adaf7d

File tree

7 files changed

+67
-9
lines changed

7 files changed

+67
-9
lines changed

‎README.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ be deployed.In this case, Splunk Java Logging can be used to forward events to S
3232
Furthermore, in either scenario, you can still utilize the SplunkLogEvent class to construct your log events in best practice
3333
semantic format.
3434

35+
#Log4J2
36+
37+
I have included a sample configuration file for sending events to Splunk over raw TCP and UDP
38+
3539
## Resilience
3640

3741
The HTTP REST and Raw TCP handler/appenders have autonomous socket reconnection logic in case of connection failures.
@@ -49,7 +53,12 @@ definitions for your various target Indexers.
4953

5054
## Load Balancing
5155

52-
Still in the think tank.
56+
If you wish to have load balancing of your log events, then configure your logging appenders to send to a Splunk Universal Forwarder acting
57+
as a load balancing intermediary before you Indexer Cluster.
58+
59+
## Failover
60+
61+
Log4J 2 has a Failover appender you can use : http://logging.apache.org/log4j/2.x/manual/appenders.html#FailoverAppender
5362

5463
## Thread Safety
5564

‎config/log4j2.xml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<!--Example log4j2 configuration using a Splunk Raw TCP and UDP Appender-->
4+
5+
6+
<Configuration status="info" name="MySplunkApp" packages="">
7+
8+
<Appenders>
9+
10+
<Socket name="splunkrawtcp" protocol="TCP" host="ubuntu-splunk" port="5151">
11+
<PatternLayout pattern="%m%n" />
12+
</Socket>
13+
14+
<Socket name="splunkrawudp" protocol="UDP" host="ubuntu-splunk" port="5152">
15+
<PatternLayout pattern="%m%n" />
16+
</Socket>
17+
18+
19+
<Console name="stdout" target="SYSTEM_OUT">
20+
<PatternLayout pattern="%m%n" />
21+
</Console>
22+
</Appenders>
23+
24+
<Loggers>
25+
<Root level="info">
26+
<AppenderRef ref="stdout" />
27+
</Root>
28+
<logger name="splunk.logger" additivity="false" level="INFO">
29+
<appender-ref ref="splunkrawtcp" />
30+
<appender-ref ref="splunkrawudp" />
31+
</logger>
32+
</Loggers>
33+
34+
</Configuration>

‎lib/log4j-api-2.0-beta9.jar

106 KB
Binary file not shown.

‎lib/log4j-core-2.0-beta9.jar

665 KB
Binary file not shown.

‎lib/log4j-slf4j-impl-2.0-beta9.jar

22 KB
Binary file not shown.

‎pom.xml

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
<email>ddallimore@splunk.com</email>
2525
</developer>
2626
</developers>
27-
27+
2828
<prerequisites>
2929
<maven>3.0.4</maven>
3030
</prerequisites>
@@ -41,12 +41,17 @@
4141
<groupId>log4j</groupId>
4242
<artifactId>log4j</artifactId>
4343
<version>1.2.17</version>
44-
</dependency>
44+
</dependency>
4545
<dependency>
4646
<groupId>org.slf4j</groupId>
4747
<artifactId>slf4j-api</artifactId>
4848
<version>1.7.5</version>
4949
</dependency>
50+
<dependency>
51+
<groupId>org.apache.logging.log4j.adapters</groupId>
52+
<artifactId>log4j-slf4j-impl</artifactId>
53+
<version>2.0-beta9</version>
54+
</dependency>
5055
<dependency>
5156
<groupId>org.slf4j</groupId>
5257
<artifactId>slf4j-jdk14</artifactId>
@@ -72,6 +77,16 @@
7277
<artifactId>logback-core</artifactId>
7378
<version>1.0.13</version>
7479
</dependency>
80+
<dependency>
81+
<groupId>org.apache.logging.log4j</groupId>
82+
<artifactId>log4j-api</artifactId>
83+
<version>2.0-beta9</version>
84+
</dependency>
85+
<dependency>
86+
<groupId>org.apache.logging.log4j</groupId>
87+
<artifactId>log4j-core</artifactId>
88+
<version>2.0-beta9</version>
89+
</dependency>
7590
</dependencies>
7691
<repositories>
7792
<repository>
@@ -80,7 +95,7 @@
8095
</repository>
8196
</repositories>
8297
<url>https://github.com/damiendallimore/SplunkJavaLogging</url>
83-
<build>
98+
<build>
8499
<pluginManagement>
85100
<plugins>
86101
<plugin>
@@ -277,9 +292,9 @@
277292
</plugins>
278293
</build>
279294
<scm>
280-
<connection>scm:git:git@github.com:damiendallimore/SplunkJavaLogging.git</connection>
281-
<developerConnection>scm:git:git@github.com:damiendallimore/SplunkJavaLogging.git</developerConnection>
282-
<tag>HEAD</tag>
283-
<url>https://github.com/damiendallimore/SplunkJavaLogging</url>
284-
</scm>
295+
<connection>scm:git:git@github.com:damiendallimore/SplunkJavaLogging.git</connection>
296+
<developerConnection>scm:git:git@github.com:damiendallimore/SplunkJavaLogging.git</developerConnection>
297+
<tag>HEAD</tag>
298+
<url>https://github.com/damiendallimore/SplunkJavaLogging</url>
299+
</scm>
285300
</project>

‎releases/splunklogging-1.0.tar.gz

708 KB
Binary file not shown.

0 commit comments

Comments
 (0)