log4j配置syslog记录日志

应用场景：需要把log输出到syslog中

1. log4j的配置

log4j.rootLogger=INFO, A1, syslog

log4j.appender.A1=org.apache.log4j.ConsoleAppender

log4j.appender.A1.layout=org.apache.log4j.PatternLayout
log4j.appender.A1.layout.ConversionPattern=%-4r [%t] %-5p %c %x - %m%n

# 下面是在log4j中配置syslog的内容,其中HostIP 配置成你希望输出syslog机器的ip地址，local5可以换成你自定义的facility，但必 # 须和syslog.conf 中的一致,Threshold设置输出级别，等于和高于这个基本的log被输出
log4j.appender.syslog=org.apache.log4j.net.SyslogAppender
log4j.appender.syslog.SyslogHost= HostIP

log4j.appender.syslog.Facility=local5
log4j.appender.syslog.Threshold=FATAL
log4j.appender.syslog.layout=org.apache.log4j.PatternLayout
log4j.appender.syslog.layout.ConversionPattern=%d %p [%F] [%t] [%L] [%c] - %m%n

2. 配置/etc/syslog.conf

例如：

local5. *  /home/my/test.log

3. Stop syslog service - /etc/rc.d/init.d/syslog stop

4. Start syslog service - /sbin/syslogd -r Make sure we need to add '-r' if 514 port is not opened. By default system will not open 514 port.

5.可以用下面的语句检测syslog的改动是否生效：

 /usr/bin/logger –p local5.warning “test sentence to make sure if the syslog is worked”  

至此，如果你系统中有大于log4j中threshold中定义级别的log，那么就会被输出到syslog.conf中定义的文件里了，便于下一步分析.

Reference:

1.鸟哥的linux私房菜 http://linux.vbird.org/linux_basic/0570syslog.php

2.syslog overview http://www.precision-guesswork.com/sage-guide/syslog-overview.html

3. log4j笔记 http://www.infomall.cn/cgi-bin/mallgate/20031008/http://hedong.3322.org/archives/000193.html