LocalSyslogAppender

LocalSyslogAppender writes messages to the local syslog service on Unix-like operating systems. It uses the system’s native syslog daemon and does not support remote logging.

The following example shows how to configure the LocalSyslogAppender. It sends all events with Level WARN or higher.

<appender name="LocalSyslogAppender" type="log4net.Appender.LocalSyslogAppender">
  <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date{MM/dd/yyyy HH:mm:ss.fff} [%thread] %-5level %logger - %message%newline" />
  </layout>
  <threshold value="WARN" />
</appender>

You can also specify:

  • Facility (default: user)

  • Identity (default: application name)

  • NewLineHandling (default: Escape), one of Escape, Split or Keep

A newline in logged content ends the record for a syslog daemon that writes the message through to a line oriented log, so content can otherwise forge a second, authentic looking entry. Escape writes them as \r and \n, Split sends one record per line, and Keep passes them through for a daemon that handles multiline messages itself. Note that syslog(3) does no escaping of its own: whatever escaping you see on a mainstream Linux comes from the daemon, not from libc.

<appender name="LocalSyslogAppender" type="log4net.Appender.LocalSyslogAppender">
  <facility>Alert</facility>
  <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date{MM/dd/yyyy HH:mm:ss.fff} [%thread] %-5level %logger - %message%newline" />
  </layout>
  <identity>MyApp-Canary</identity>
  <threshold value="WARN" />
</appender>