How to get milliseconds in SysLog?

Help
1

Enonic version: XP 7.1
OS: Red Hat

We don´t get ms in the logs from Enonic to our logstash service.

We use this appender:
<appender name=“SYSLOG” class=“ch.qos.logback.classic.net.SyslogAppender”>

Other apps in NAV are using this class to get ms:
<appender name=“syslog” class=“com.spotify.logging.logback.MillisecondPrecisionSyslogAppender”>

Is Enonic bundled with a SysLogAppender that supports ms?
Anyone with the same problem that have solved this?

2

No, there is no SysLogAppender which would report milliseconds bundled in XP. logback SysLogAppender follows rfc3164#section-4.1.2 where fractions of seconds are not supported.

rfc5424#section-6.2.3 with fractions of seconds was never fully implemented due to lack of interest. you can follow
https://jira.qos.ch/browse/LOGBACK-588

MillisecondPrecisionSyslogAppender is more a hack than a robust solution. It follows neither rfc3164 nor rfc5424.

There is a workaround: add a desired timestamp into suffixPattern and parse the value later in logstash (splunk, loggly, etc…).

   <appender name="SYSLOG" class="ch.qos.logback.classic.net.SyslogAppender">
    <syslogHost>localhost</syslogHost>
    <facility>AUTH</facility>
    <suffixPattern>%d{ISO8601,UTC} [%thread] %logger %msg</suffixPattern>
  </appender>
1 Like