RemoteSyslogAppender

The RemoteSyslogAppender sends log messages to a remote syslog daemon using the BSD syslog protocol over UDP (default port 514). It supports configurable syslog facilities and severity levels, but due to the nature of UDP, messages may be lost or truncated.

This appender does not include timestamp or hostname fields, as the receiving syslog daemon adds them automatically. It also splits log messages at line breaks, sending each line as a separate syslog message.

The following example sends all events with Level WARN or higher to the remote server 192.168.1.100 on the default port with UTF8-Encoding.

<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <encoding>UTF-8</encoding>
  <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date{MM/dd/yyyy HH:mm:ss.fff} [%thread] %-5level %logger - %message%newline" />
  </layout>
  <remoteAddress value="192.168.1.100" />
  <threshold value="WARN" />
</appender>

You can also specify:

  • Facility (default: user)

  • Identity (default: application name)

<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <encoding>UTF-8</encoding>
  <facility>Alert</facility>
  <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date{MM/dd/yyyy HH:mm:ss.fff} [%thread] %-5level %logger - %message%newline" />
  </layout>
  <identity>MyApp-Canary</identity>
  <remoteAddress value="192.168.1.100" />
  <threshold value="WARN" />
</appender>

Newline handling

If your log message contains multiple lines, it will be logged as multiple separate syslog entries instead of a single multiline message.

This might lead to confusion when analyzing logs because related lines could appear interleaved with logs from other sources.

Example:

try
{
  throw new InvalidTimeZoneException();
}
catch (InvalidTimeZoneException e)
{
  logger.Error(e, "setting daylight saving time failed")
}

Output (with intermixed messages):

12/21/2024 14:07:41.508 [main] ERROR log4net.Tests - setting daylight saving time failed
Exception of type 'System.InvalidTimeZoneException' was thrown.
12/21/2024 14:07:41.511 [worker] WARN log4net.Tests - some unrelated log message
  at log4net.Tests.Appender.RemoteSyslogAppenderTest.LineBreakTest()
  at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
  at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

Size limits

The RemoteSyslogAppender uses the UDP protocol to send log messages to the syslog server. However, there are size limitations associated with UDP:

  • Message size: Each log message is limited to 64 KB, including both the message content and the headers.

  • Practical size limit: On many networks, such as Ethernet, the practical limit for message size is typically much lower — around 1500 bytes.

  • Message truncation: If a log message exceeds these size limits, it will be truncated, which means some of the message content will be lost.

To avoid truncation, ensure that log messages are kept within the size limits of your network setup.