Apache logging services logo

Apache log4net™ Manual - Introduction


This document is based on Short introduction to log4j by Ceki Gülcü.

The log4net framework is based on Apache log4j™, see http://logging.apache.org/log4j/ for more information on log4j. The log4net framework, source code, binaries, documentation, examples and related materials are published under the terms of the Apache License, Version 2.0, a copy of which has been included with this distribution in the LICENSE.txt file.

This document is an introduction to the log4net API, its unique features and design rationale. Log4net is an open source project based on the work of many authors. It allows the developer to control which log statements are output with arbitrary granularity. It is fully configurable at runtime using external configuration files.

Almost every large application includes its own logging or tracing API. Inserting log statements into code is a low-tech method for debugging it. It may also be the only way because debuggers are not always available or applicable. This is usually the case for multithreaded applications and distributed applications at large.

Once an application has been deployed it may not be possible to utilize development and debugging tools. An administrator can use effective logging systems to diagnose and fix many configuration issues.

Experience indicates that logging is an important component of the development cycle. It offers several advantages. It provides precise context about the execution of the application. Once inserted into the code, the generation of logging output requires no human intervention. Moreover, log output can be saved in persistent medium to be studied at a later time. In addition to its use in the development cycle, a sufficiently rich logging package can also be viewed as an auditing tool.

Logging does have its drawbacks. It can slow down an application. If too verbose, it can cause scrolling blindness. To alleviate these concerns, log4net is designed to be reliable, fast and extensible. Since logging is rarely the main focus of an application, the log4net API strives to be simple to understand and to use.


Log4net is available for several frameworks. For each supported framework an assembly targeting that framework is built:

  • .NET Standard 2.0 via .NET 8.0
  • Microsoft .NET Framework 4.6.2

Not all frameworks are created equal and some features have been excluded from some of the builds. See the Framework Support document for more information.

Loggers and Appenders

Log4net has three main components: loggers, appenders and layouts. These three types of components work together to enable developers to log messages according to message type and level, and to control at runtime how these messages are formatted and where they are reported. These components are helped by filters that control the actions of the appender and object renderers that turn objects into strings.

Logger hierarchy

The first and foremost advantage of any logging API over plain System.Console.WriteLine resides in its ability to disable certain log statements while allowing others to print unhindered. This capability assumes that the logging space, that is, the space of all possible logging statements, is categorized according to some developer-chosen criteria.

Loggers are named entities. Logger names are case-sensitive and they follow the following hierarchical naming rule:

Named Hierarchy

A logger is said to be an ancestor of another logger if its name followed by a dot is a prefix of the descendant logger name. A logger is said to be a parent of a child logger if there are no ancestors between itself and the descendant logger.

The hierarchy works very much in the same way as the namespace and class hierarchy in .NET. This is very convenient as we shall soon see.

For example, the logger named "Foo.Bar" is a parent of the logger named "Foo.Bar.Baz". Similarly, "System" is a parent of "System.Text" and an ancestor of "System.Text.StringBuilder". This naming scheme should be familiar to most developers.

The root logger resides at the top of the logger hierarchy. It is exceptional in three ways:

  1. It always exists
  2. It cannot be retrieved by name
  3. It always has an assigned level

Loggers are retrieved using the static method from the log4net.LogManager class. The GetLogger methods take the name of the desired logger as a parameter. They are listed below:

namespace log4net
    public class LogManager
        public static ILog GetLogger(string name);
        public static ILog GetLogger(Type type);

The GetLogger methods that takes a Type parameter uses the fully qualified type name as the name of the logger to retrieve.

These GetLogger methods return an ILog interface. That is the representation of the Logger passed back to the developer. The ILog interface is defined below:

namespace log4net
    public interface ILog
        /* Test if a level is enabled for logging */
        bool IsDebugEnabled { get; }
        bool IsInfoEnabled { get; }
        bool IsWarnEnabled { get; }
        bool IsErrorEnabled { get; }
        bool IsFatalEnabled { get; }

        /* Log a message object */
        void Debug(object message);
        void Info(object message);
        void Warn(object message);
        void Error(object message);
        void Fatal(object message);

        /* Log a message object and exception */
        void Debug(object message, Exception t);
        void Info(object message, Exception t);
        void Warn(object message, Exception t);
        void Error(object message, Exception t);
        void Fatal(object message, Exception t);

        /* Log a message string using the System.String.Format syntax */
        void DebugFormat(string format, params object[] args);
        void InfoFormat(string format, params object[] args);
        void WarnFormat(string format, params object[] args);
        void ErrorFormat(string format, params object[] args);
        void FatalFormat(string format, params object[] args);

        /* Log a message string using the System.String.Format syntax */
        void DebugFormat(IFormatProvider provider, string format, params object[] args);
        void InfoFormat(IFormatProvider provider, string format, params object[] args);
        void WarnFormat(IFormatProvider provider, string format, params object[] args);
        void ErrorFormat(IFormatProvider provider, string format, params object[] args);
        void FatalFormat(IFormatProvider provider, string format, params object[] args);

Loggers may be assigned levels. Levels are instances of the log4net.Core.Level class. The following levels are defined in order of increasing priority:

  • ALL
  • INFO
  • WARN
  • OFF

If a given logger is not assigned a level, then it inherits one from its closest ancestor with an assigned level. More formally:

Level Inheritance

The inherited level for a given logger X, is equal to the first non-null level in the logger hierarchy, starting at X and proceeding upwards in the hierarchy towards the root logger.

To ensure that all loggers can eventually inherit a level, the root logger always has an assigned level. The default value for the root logger is DEBUG.

Below are four tables with various assigned level values and the resulting inherited levels according to the above rule.

Logger name Assigned level Inherited level
root Proot Proot
X none Proot
X.Y none Proot
X.Y.Z none Proot

In Example 1 above, only the root logger is assigned a level. This level value, Proot, is inherited by the other loggers X, X.Y and X.Y.Z.

Logger name Assigned level Inherited level
root Proot Proot
X Px Px
X.Y Pxy Pxy
X.Y.Z Pxyz Pxyz

In Example 2 above, all loggers have an assigned level value. There is no need for level inheritance.

Logger name Assigned level Inherited level
root Proot Proot
X Px Px
X.Y none Px
X.Y.Z Pxyz Pxyz

In Example 3 above, the loggers root, X and X.Y.Z are assigned the levels Proot, Px and Pxyz respectively. The logger X.Y inherits its level value from its parent X.

Logger name Assigned level Inherited level
root Proot Proot
X Px Px
X.Y none Px
X.Y.Z none Px

In Example 4 above, the loggers root and X and are assigned the levels Proot and Px respectively. The loggers X.Y and X.Y.Z inherits their level value from their nearest parent X having an assigned level.

Logging requests are made by invoking one of the printing methods of a logger instance (through the log4net.ILog). These printing methods are Debug, Info, Warn, Error, and Fatal.

By definition, the printing method determines the level of a logging request. For example, if log is a logger instance, then the statement log.Info("..") is a logging request of level INFO.

A logging request is said to be enabled if its level is higher than or equal to the level of its logger. Otherwise, the request is said to be disabled. A logger without an assigned level will inherit one from the hierarchy. This rule is summarized below.

Basic Selection Rule

A log request of level L in a logger with (either assigned or inherited, whichever is appropriate) level K, is enabled if L >= K.

This rule is at the heart of log4net. It assumes that levels are ordered. For the standard levels, we have DEBUG < INFO < WARN < ERROR < FATAL.

Calling the log4net.LogManager.GetLogger method with the same name will always return a reference to the exact same logger object.

For example, in:

ILog x = LogManager.GetLogger("wombat");
ILog y = LogManager.GetLogger("wombat");

x and y refer to exactly the same logger object.

Thus, it is possible to configure a logger and then to retrieve the same instance somewhere else in the code without passing around references. In fundamental contradiction to biological parenthood, where parents always precede their children, log4net loggers can be created and configured in any order. In particular, a "parent" logger will find and link to its descendants even if it is instantiated after them.

Configuration of the log4net environment is typically done at application initialization. The preferred way is by reading a configuration file. This approach will be discussed shortly.

Log4net makes it easy to name loggers by software component. This can be accomplished by statically instantiating a logger in each class, with the logger name equal to the fully qualified name of the class. This is a useful and straightforward method of defining loggers. As the log output bears the name of the generating logger, this naming strategy makes it easy to identify the origin of a log message. However, this is only one possible, albeit common, strategy for naming loggers. Log4net does not restrict the possible set of loggers. The developer is free to name the loggers as desired.

Nevertheless, naming loggers after the class where they are located seems to be the best strategy known so far. It is simple an obvious to the developers where each log message came from. Most importantly it leverages the design of the application to produce the design of the logger hierarchy. Hopefully some thought has gone into the design of the application.


The ability to selectively enable or disable logging requests based on their logger is only part of the picture. Log4net allows logging requests to print to multiple destinations. In log4net speak, an output destination is called an appender. Appenders must implement the log4net.Appenders.IAppender interface.

The following appenders are defined in the log4net package:

Type Description
log4net.Appender.AdoNetAppender Writes logging events to a database using either prepared statements or stored procedures.
log4net.Appender.AnsiColorTerminalAppender Writes color highlighted logging events to a an ANSI terminal window.
log4net.Appender.AspNetTraceAppender Writes logging events to the ASP trace context. These can then be rendered at the end of the ASP page or on the ASP trace page.
log4net.Appender.BufferingForwardingAppender Buffers logging events before forwarding them to child appenders.
log4net.Appender.ColoredConsoleAppender Writes logging events to the application's Console. The events may go to either the standard our stream or the standard error stream. The events may have configurable text and background colors defined for each level.
log4net.Appender.ConsoleAppender Writes logging events to the application's Console. The events may go to either the standard our stream or the standard error stream.
log4net.Appender.DebugAppender Writes logging events to the .NET debug system.
log4net.Appender.EventLogAppender Writes logging events to the Windows Event Log.
log4net.Appender.FileAppender Writes logging events to a file in the file system.
log4net.Appender.ForwardingAppender Forwards logging events to child appenders.
log4net.Appender.LocalSyslogAppender Writes logging events to the local syslog service (UNIX only).
log4net.Appender.MemoryAppender Stores logging events in an in memory buffer.
log4net.Appender.NetSendAppender Writes logging events to the Windows Messenger service. These messages are displayed in a dialog on a users terminal.
log4net.Appender.OutputDebugStringAppender Writes logging events to the debugger. If the application has no debugger, the system debugger displays the string. If the application has no debugger and the system debugger is not active, the message is ignored.
log4net.Appender.RemoteSyslogAppender Writes logging events to a remote syslog service using UDP networking.
log4net.Appender.RemotingAppender Writes logging events to a remoting sink using .NET remoting.
log4net.Appender.RollingFileAppender Writes logging events to a file in the file system. The RollingFileAppender can be configured to log to multiple files based upon date or file size constraints.
log4net.Appender.SmtpAppender Sends logging events to an email address.
log4net.Appender.SmtpPickupDirAppender Writes SMTP messages as files into a pickup directory. These files can then be read and sent by an SMTP agent such as the IIS SMTP agent.
log4net.Appender.TelnetAppender Clients connect via Telnet to receive logging events.
log4net.Appender.TraceAppender Writes logging events to the .NET trace system.
log4net.Appender.UdpAppender Sends logging events as connectionless UDP datagrams to a remote host or a multicast group using a UdpClient.

More than one appender can be attached to a logger.

Each enabled logging request for a given logger will be forwarded to all the appenders in that logger as well as the appenders higher in the hierarchy. In other words, appenders are inherited additively from the logger hierarchy. For example, if a console appender is added to the root logger, then all enabled logging requests will at least print on the console. If in addition a file appender is added to a logger, say X, then enabled logging requests for X and X's children will print on a file and on the console. It is possible to override this default behavior so that appender accumulation is no longer additive by setting the additivity flag on the logger to false.

The rules governing appender additivity are summarized below.

Appender Additivity

The output of a log statement of logger X will go to all the appenders in X and its ancestors. This is the meaning of the term "appender additivity".

However, if an ancestor of logger X, say Y, has the additivity flag set to false, then X's output will be directed to all the appenders in X and it's ancestors up to and including Y but not the appenders in any of the ancestors of Y.

Loggers have their additivity flag set to true by default.

The table below shows an example:

Logger Name Added Appenders Additivity Flag Output Targets Comment
root A1 not applicable A1 There is no default appender attached to root.
x A-x1, A-x2 true A1, A-x1, A-x2 Appenders of "x" and root.
x.y none true A1, A-x1, A-x2 Appenders of "x" and root.
x.y.z A-xyz1 true A1, A-x1, A-x2, A-xyz1 Appenders in "x.y.z", "x" and root.
security A-sec false A-sec No appender accumulation since the additivity flag is set to false.
security.access none true A-sec Only appenders of "security" because the additivity flag in "security" is set to false.


Appenders can filter the events that are delivered to them. The filters can be specified in the configuration to allow fine control of the events that are logged through different appenders.

The simplest form of control is to specify a Threshold on the appender. This works by logging only the events that have a level that is greater than or equal to the threshold.

More complex and custom event filtering can be done using the filter chain defined on each appender. Filters must implement the log4net.Filter.IFilter interface.

The following filters are defined in the log4net package:

Type Description
log4net.Filter.DenyAllFilter Drops all logging events.
log4net.Filter.LevelMatchFilter An exact match to the event's level.
log4net.Filter.LevelRangeFilter Matches against a range of levels.
log4net.Filter.LoggerMatchFilter Matches against a the start of the logger name.
log4net.Filter.PropertyFilter Matches a substring from a specific property value.
log4net.Filter.StringMatchFilter Matches a substring from the event's message.

The filters can be configured to either accept or reject the event based upon the match.


More often than not, users wish to customize not only the output destination but also the output format. This is accomplished by associating a layout with an appender. The layout is responsible for formatting the logging request according to the user's wishes, whereas an appender takes care of sending the formatted output to its destination. The PatternLayout, part of the standard log4net distribution, lets the user specify the output format according to conversion patterns similar to the C language printf function.

For example, the PatternLayout with the conversion pattern "%timestamp [%thread] %-5level %logger - %message%newline" will output something akin to:

176 [main] INFO  Com.Foo.Bar - Located nearest gas station.

The first field is the number of milliseconds elapsed since the start of the program. The second field is the thread making the log request. The third field is the level of the log statement. The fourth field is the name of the logger associated with the log request. The text after the '-' is the message of the statement.

The following layouts are included in the log4net package:

Type Description
log4net.Layout.ExceptionLayout Renders the exception text from the logging event.
log4net.Layout.PatternLayout Formats the logging event according to a flexible set of formatting flags.
log4net.Layout.RawTimeStampLayout Extracts the timestamp from the logging event.
log4net.Layout.RawUtcTimeStampLayout Extracts the timestamp from the logging event in Universal Time.
log4net.Layout.SimpleLayout Formats the logging event very simply: [level] - [message]
log4net.Layout.XmlLayout Formats the logging event as an XML element.
log4net.Layout.XmlLayoutSchemaLog4j Formats the logging event as an XML element that complies with the log4j event dtd.

Object Renderers

Just as importantly, log4net will render the content of the log message according to user specified criteria. For example, if you frequently need to log Oranges, an object type used in your current project, then you can register an OrangeRenderer that will be invoked whenever an orange needs to be logged.

Object rendering follows the class hierarchy. For example, assuming oranges are fruits, if you register an FruitRenderer, all fruits including oranges will be rendered by the FruitRenderer, unless of course you registered an orange specific OrangeRenderer.

Object renderers have to implement the log4net.ObjectRenderer.IObjectRenderer interface.

Please note that ObjectRenderers are not used by the DebugFormat, InfoFormat, WarnFormat, ErrorFormat and FatalFormat methods.