MonitorWare Knowledge Base

I've got a tomcat server with individual webapps setup to use a syslogAppender to send their logs over syslog to a host I have running rsyslog.

log4j.properties (trimmed) from the sending server

Code: Select all

# log to syslog
log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.Threshold=DEBUG
log4j.appender.SYSLOG.syslogHost=syslog.ourdomain.tld
log4j.appender.SYSLOG.Facility=local5
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.ConversionPattern=%d [%t] %-5p %c - %m%n


rsyslog.conf (trimmed) from the recieving server

Code: Select all

# Using local5 for tomcat
$template Dyntomcat, "/var/log/rsyslog/%HOSTNAME%/tomcat.log"
local5.* ?Dyntomcat


The version of rsyslog is the one available via redhat's upstream packages: rsyslog-2.0.0-11.el5

Here's my problem... sometimes it works, sometimes the %HOSTNAME% field cannot be determined and instead I just get a new directory named after whatever showed up first in the log line. e.g. /var/log/rsyslog/2008-12-15/tomcat.log

The wierd thing is, its not all or nothing. If I load my webapp and submit bogus info to a form so that I know it will cause an error I get *some* lines in /var/log/rsyslog/myhostsname/tomcat.log and *some* lines in /var/log/rsyslog/whateverstringcamefirst/tomcat.log

Is this a log4j bug for not putting the hostname in the log line? A configuration error on my part? A known issue with this older version of rsyslog?

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

please let it run in debug mode and post or mail the output. It may be lengthy...