RemoteSyslogAppender

The RemoteSyslogAppender sends log messages to a remote syslog daemon using the BSD syslog protocol over UDP (default port 514). It supports configurable syslog facilities and severity levels, but due to the nature of UDP, messages may be lost or truncated.

This appender does not include timestamp or hostname fields, as the receiving syslog daemon adds them automatically. It also splits log messages at line breaks, sending each line as a separate syslog message.

The following example sends all events with Level WARN or higher to the remote server 192.168.1.100 on the default port with UTF8-Encoding.

<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <encoding>UTF-8</encoding>
  <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date{MM/dd/yyyy HH:mm:ss.fff} [%thread] %-5level %logger - %message%newline" />
  </layout>
  <remoteAddress value="192.168.1.100" />
  <threshold value="WARN" />
</appender>

You can also specify:

Facility (default: user)
Identity (default: application name)

<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <encoding>UTF-8</encoding>
  <facility>Alert</facility>
  <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date{MM/dd/yyyy HH:mm:ss.fff} [%thread] %-5level %logger - %message%newline" />
  </layout>
  <identity>MyApp-Canary</identity>
  <remoteAddress value="192.168.1.100" />
  <threshold value="WARN" />
</appender>

If your log message contains multiple lines, it will be logged as multiple separate syslog entries instead of a single multiline message.

This might lead to confusion when analyzing logs because related lines could appear interleaved with logs from other sources.

Example:

try
{
  throw new InvalidTimeZoneException();
}
catch (InvalidTimeZoneException e)
{
  logger.Error(e, "setting daylight saving time failed")
}

Output (with intermixed messages):

12/21/2024 14:07:41.508 [main] ERROR log4net.Tests - setting daylight saving time failed
Exception of type 'System.InvalidTimeZoneException' was thrown.
12/21/2024 14:07:41.511 [worker] WARN log4net.Tests - some unrelated log message
  at log4net.Tests.Appender.RemoteSyslogAppenderTest.LineBreakTest()
  at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
  at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)