Send Jira log to a remote syslog server (Graylog)

[Jérôme Brandt]

Hi,

Does-it possible to send jira log to a syslog remote server ?

We use Graylog and we would like to receive Jira messages

Thanks,

[james-d-elliott]

For those looking this can be done with a few steps. To be clear I've not tested this with changing log settings inside jira itself, I suspect it will overwrite settings configured here. To what extent I am unsure. Additionally this does not disable the file logger, it only adds an additional log4j appender (output source).

Step 1 is to add the java appender library that supports log4j 1.2 to your <app install>/lib folder.

Step 2 is to edit <app install>/atlassian-jira/WEB-INF/classes/log4j.properties. You will need to do two things, add the appender config, then add the appender to each log4j.logging.* line you wish to send to the appender. In my example the appender is called gelf (log4j.appender.gelf.*).

You will need to add an appender (logstash-gelf seems to work well with jira and will be what I use as an example, so if you use something else you will have to adapt your configuration to the developers specifications).

Example logger configuration for minimal logs (these lines exist already, I just add gelf to the end):

log4j.rootLogger=WARN, fi
lelog, gelf
log4j.logger.com.atlassian.jira.util.log.LogMarker = INFO, console, filelog, httpaccesslog, httpdumplog, sqllog, querydsllog, slowquerylog, slowsqlquerylog, xsrflog, securitylog, outgoingmaillog, incomingmaillog, remoteappssecurity, apdexlog, gelf


Appender:

#appender name linked to the library
log4j.appender.gelf=biz.paluch.logging.gelf.log4j.GelfLogAppender
#appender config
log4j.appender.gelf.Threshold=INFO
log4j.appender.gelf.Host=udp:<udp gelf log server> OR tcp:<tcp gelf log server>
log4j.appender.gelf.Port=<log port>
log4j.appender.gelf.Version=1.1
log4j.appender.gelf.Facility=jira
log4j.appender.gelf.ExtractStackTrace=true
log4j.appender.gelf.FilterStackTrace=true
log4j.appender.gelf.MdcProfiling=true
log4j.appender.gelf.TimestampPattern=yyyy-MM-dd HH:mm:ss,SSS
log4j.appender.gelf.MaximumMessageSize=8192

[james-d-elliott]

For those looking this can also be done with a few steps over GELF instead of Syslog. To be clear I've not tested this with changing log settings inside jira itself, I suspect it will overwrite settings configured here. To what extent I am unsure. Additionally this does not disable the file logger, it only adds an additional log4j appender (output source).

Step 1 is to add the java appender library that supports log4j 1.2 to your <app install>/lib folder.

Step 2 is to edit <app install>/atlassian-jira/WEB-INF/classes/log4j.properties. You will need to do two things, add the appender config, then add the appender to each log4j.logging.* line you wish to send to the appender. In my example the appender is called gelf (log4j.appender.gelf.*).

You will need to add an appender (logstash-gelf seems to work well with jira and will be what I use as an example, so if you use something else you will have to adapt your configuration to the developers specifications).

Example logger configuration for minimal logs (these lines exist already, I just add gelf to the end):

log4j.rootLogger=WARN, filelog, gelf
log4j.logger.com.atlassian.jira.util.log.LogMarker = INFO, console, filelog, httpaccesslog, httpdumplog, sqllog, querydsllog, slowquerylog, slowsqlquerylog, xsrflog, securitylog, outgoingmaillog, incomingmaillog, remoteappssecurity, apdexlog, gelf


Appender:

#appender name linked to the library
log4j.appender.gelf=biz.paluch.logging.gelf.log4j.GelfLogAppender
#appender config
log4j.appender.gelf.Threshold=INFO
log4j.appender.gelf.Host=udp:<udp gelf log server> OR tcp:<tcp gelf log server>
log4j.appender.gelf.Port=<log port>
log4j.appender.gelf.Version=1.1
log4j.appender.gelf.Facility=jira
log4j.appender.gelf.ExtractStackTrace=true
log4j.appender.gelf.FilterStackTrace=true
log4j.appender.gelf.MdcProfiling=true
log4j.appender.gelf.TimestampPattern=yyyy-MM-dd HH:mm:ss,SSS
log4j.appender.gelf.MaximumMessageSize=8192

[Justin Evans]

It is definitely possible with many log management applications. I've sent JIRA logs to both Splunk and ELK. JIRA logs in log4j format. It looks like there's a GELF add-on for this format for Graylog so I imagine it should be possible.

[Jérôme Brandt]

Hi, thanks,

Could you telle me, how to configure log4j to send Jira's log to my syslog server ?

Thank you,