<div dir="ltr"><div>Please also make sure that the hostname can be resolved.<br><br></div>Try running 'hostname' as unprivileged user to make sure the machine can resolve the local host name.<br><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 11, 2016 at 3:29 AM, Fabrice Bacchella <span dir="ltr"><<a href="mailto:fabrice.bacchella@orange.fr" target="_blank">fabrice.bacchella@orange.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">You're showing a logstash parsing, extracted from a message formatted using syslog. All the magic should be in the pattern line (log4j.appender.myappender.layout.ConversionPattern=[%c] %m%).<br>
And logstash failed to parse the line anyway (see the _grokparsefailure).<br>
<br>
Did you try to send native log4j event to logstash, using custom appenders like my own : <a href="https://github.com/fbacchella/ZMQAppender" rel="noreferrer" target="_blank">https://github.com/fbacchella/ZMQAppender</a><br>
<div class="HOEnZb"><div class="h5"><br>
<br>
> Le 11 mai 2016 à 08:20, Dominique Taffin <<a href="mailto:dominique.taffin@1und1.de">dominique.taffin@1und1.de</a>> a écrit :<br>
><br>
> Hello!<br>
><br>
> Thank you for your reply. Unfortunately, it does not include the hostname with header=true.<br>
> The following is received by the logserver:<br>
><br>
> {<br>
> "_index": "ovirt-2016.05.11",<br>
> "_type": "syslog",<br>
> "_id": "AVSedM6EH9SU2r3j0ihk",<br>
> "_score": null,<br>
> "_source": {<br>
> "message": "<14>[org.ovirt.engine.core.vdsbroker.HostDevListByCapsVDSCommand] START, HostDevListByCapsVDSCommand(HostName = onodeXXX.some.domain, VdsIdAndVdsVDSCommandParametersBase:{runAsync='true', hostId='XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXXXXX', vds='Host[onodeXXX.some.domain,XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXXXXX]'}), log id: 689d5b30\n",<br>
> "@version": "1",<br>
> "@timestamp": "2016-05-11T08:15:35.729+02:00",<br>
> "type": "syslog",<br>
> "host": "10.XXX.XXX.XXX",<br>
> "tags": [<br>
> "_grokparsefailure"<br>
> ],<br>
> "syslog_severity_code": 5,<br>
> "syslog_facility_code": 1,<br>
> "syslog_facility": "user-level",<br>
> "syslog_severity": "notice"<br>
> },<br>
> "sort": [<br>
> 1462947335729,<br>
> 1462947335729<br>
> ]<br>
> }<br>
><br>
> is it possible to have the IP in the "host" filed have resolved from log4j so that the hostname will be displayed there? Or have it convinced to use the appender.Application field?<br>
><br>
> thank you and best,<br>
> Dominique<br>
><br>
</div></div><div class="HOEnZb"><div class="h5">> Von: Ravi Nori <<a href="mailto:rnori@redhat.com">rnori@redhat.com</a>><br>
> Gesendet: Dienstag, 10. Mai 2016 19:04<br>
> An: Dominique Taffin<br>
> Cc: users@oVirt.org<br>
> Betreff: Re: [ovirt-users] Log4j hostname<br>
><br>
> Hi Dominique,<br>
><br>
> Add<br>
><br>
> log4j.appender.myappender.header = true<br>
><br>
> and see if you get the hostname<br>
><br>
> Ravi<br>
><br>
><br>
> On Mon, May 9, 2016 at 9:37 AM, Dominique Taffin <<a href="mailto:dominique.taffin@1und1.de">dominique.taffin@1und1.de</a>> wrote:<br>
> Hello!<br>
><br>
> We are using the log4j extension to send ovirt logs to a logstash server.<br>
> As we do have several engine hosts and only one logging backend, we do need to filter logs by hostname. So far I am unable to provide a hostname in<br>
> Log4jLogger.properties. All Log4j configurations we have in other applications/servers to honor the log4j.Application property. I tried setting it up by:<br>
><br>
><br>
><br>
> <a href="http://ovirt.engine.extension.name" rel="noreferrer" target="_blank">ovirt.engine.extension.name</a> = Log4j<br>
> ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.logger.Logger<br>
> ovirt.engine.extension.bindings.method = jbossmodule<br>
> ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.logger.log4j<br>
> ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.logger.log4j.Log4jLogger<br>
> log4j.rootLogger=DEBUG, myappender<br>
><br>
> log4j.appender.myappender = org.apache.log4j.net.SyslogAppender<br>
> log4j.appender.myappender.SyslogHost = logstash-server.something<br>
> log4j.appender.myappender.Port = 5544<br>
> log4j.appender.myappender.ReconnectionDelay = 60000<br>
> log4j.appender.myappender.Application = ovirthostname<br>
> log4j.appender.myappender.LocationInfo = true<br>
> log4j.appender.myappender.Threshold = DEBUG<br>
> log4j.appender.myappender.layout = org.apache.log4j.PatternLayout<br>
> log4j.appender.myappender.layout.ConversionPattern=[%c] %m%n<br>
><br>
><br>
><br>
> Logs do arrive, but no hostname. Can anyone point me out on how to include the hostname in the logs?<br>
><br>
> thank you and best,<br>
> Dominique<br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
> <a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
><br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
> <a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
<br>
</div></div></blockquote></div><br></div>