How can I view log events remotely using Log4J and Apache Chainsaw?

Question

I have a Java web application that currently uses Log4J for logging. I'd like to use Apache Chainsaw to view and parse the logs remotely. So far, I've had trouble understanding how to setup both the client side (the Chainsaw client) and the server side (the log4j config in my webapp) to successfully enable remote logging.

Here is what I have tried so far.

Server side log4j config

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">
<log4j:configuration debug="true">

   <appender name="myRFA" class="org.apache.log4j.RollingFileAppender">
      <param name="File" value="/logs}/my.log"/>
      <param name="Append" value="false" />
      <param name="MaxFileSize" value="10MB"/>
      <param name="MaxBackupIndex" value="10"/>
      <layout class="org.apache.log4j.PatternLayout">
         <param name="ConversionPattern"
            value="%d{ISO8601} %p - [%X{LoggingId}] - %t - %c - %m%n"/>
      </layout>
   </appender>

   <appender name="SOCKET" class="org.apache.log4j.net.SocketAppender">
      <param name="Port" value="4445"/>
      <param name="RemoteHost" value="localhost"/>
      <param name="ReconnectionDelay" value="60000"/>
      <param name="Threshold" value="DEBUG"/>
   </appender>

   <logger name="com" additivity="false">
      <level value="warn"/>
      <appender-ref ref="myRFA"/>
   </logger>

   <logger name="org" additivity="false">
      <level value="warn"/>
      <appender-ref ref="myRFA"/>
   </logger>

</log4j:configuration>

Client side Chainsaw config

I created a new receiver with the following properties

name=SOCKET
port=4445

I will admit that I don't really understand how it is all supposed to work. Is Chainsaw polling the remote server? Is the remote server connecting to Chainsaw and pushing events to it?

Guidance, links to simple tutorials, or alternate tools would all be welcome.

Answer 1

I think you need to add your SOCKET appender to each logger:

   <logger name="com" additivity="false">
      <level value="warn"/>
      <appender-ref ref="myRFA"/>
      <appender-ref ref="SOCKET"/>
   </logger>

   <logger name="org" additivity="false">
      <level value="warn"/>
      <appender-ref ref="myRFA"/>
      <appender-ref ref="SOCKET"/>
   </logger>

Answer 2

Chainsaw has a bunch or receivers to which you application appenders push the logs. One can call Chainsaw a "log server", but it's a very simplistic tool, in most of situations pretty useless. Few examples - if you close the chainsaw, you loose everything, if you decide to move it to another host/port - you will have to reconfigure your applications. Besides, simple socket appenders will cause problems when chainsaw is unavailable and affect your application performance.

Guidance, links to simple tutorials, or alternate tools would all be welcome.

Try logFaces as an alternative for centralized logging and remote access to your logs in real time or through database. It's not a free tool, but will save you the cost of re-inventing the wheel implementing proper "chainsaw" yourself. It has an excellent log viewer and magnitude of features: