Implementation of unified log management based on log4j

Background:
General operating system-level alarms have related software, but our application-level logs often can not be unified monitoring, analysis. Because the recent project is a relatively large platform, there are eight subsystem, WebLogic Domain also has four. If the user can monitor the application-level fatal Exception Log in real time, such as OutOfMemory, the thread hangs dead, the application interface cannot be linked, and so on. Then we monitor the maintenance staff work greatly simplified, otherwise to see all the domain log information, just focus on one place, the system fault can be resolved faster, return to normal.
The user's requirement is to require us to export the log to a third-party manufacturer's log server.

Idea:
The log output of the WebLogic platform domain is configurable, and in $bea/weblogic/common/lib/workshoplogcfg.xml, all log outputs of the original project are configured in this file. Other middleware I am rarely used, I believe there are similar functions, log4j Log Framework supports the Unified log management function, simple implementation principle (start a socketserver, handle each client machine connection socket input,
Each application print log prints the contents of the log to the Socketserver end using the socket method. If important middleware exception logs and application exception logs can be applied to the unified log server, real-time analysis, so that the day-to-day monitoring, a bit similar to the function of equipment alarm, if the development of the relevant log analysis software, personal feel will be a platform-level product of a bright spot, as the "Shaolin football" said a bit of play.

Practice:
Practice has proved that the reality and ideals have a certain gap, hehe. The following description of validation, learning experience:
First, describe how log4j implements the Unified log management feature.
Core classes:
First, Org.apache.log4j.net.SocketServer
Main function:
1, start Socketserver
2. Accept Socket Request
3, initialization of the corresponding socket log output configuration, if not, the use of general configuration
4, a separate thread processing client socket and server-side interaction
A more standard multithreaded processing implementation.
Starting server requires three running parameters: Port number, log4j configuration file, client log output profile directory on server side
Run the command as follows:
Java-classpath.. /lib/log4j-1.2.8.jar;.; Test.logserver.FixSocketServer 8088 server.properties d:/temp
Description
A, the client log $ip the server-side output configuration file naming rules. LCF, such as 10.21.11.10.LCF
The class should have a bug in the code that resolves the configuration file (version 1.2.9)
Code 176 line String key = S.substring (0,i), change to: String key = S.substring (i+1);
b, the configuration file content and general log4j configuration content is identical, categories, appenders, layouts
Second, Org.apache.log4j.net.SocketAppender
This class inherits from Appenderskeleton, and if we need a custom appender, we can inherit the Appenderskeleton class and implement the method: protected void Append (Loggingevent event);

Main function:
1, connect to Socketserver, and create an object output instance to Socketserver
2. If the connection fails, a daemon thread is started and reconnected every 30 seconds
3, log output, the Log event object output to Socketserver
Log configuration corresponding to:
Log4j.appender.mysocket = Test.logserver.SocketAppender
Log4j.appender.mysocket.RemoteHost = 10.243. 17.85
Log4j.appender.mysocket.Port = 8088
Log4j.appender.mysocket.LocationInfo = True
Log4j.appender.mysocket.layout = Org.apache.log4j.PatternLayout
Log4j.appender.myConsole.layout.ConversionPattern =% 5p [% t] (% F:% L)-% m% n

Third, Org.apache.log4j.net.SocketNode
This class is relatively simple, and a thread class
Main function:
Responsible for receiving the client corresponding output object, according to the corresponding configuration, output related log.

Can be seen through the object transmission, if the third party is not in the Java language, the actual solution only need to rewrite the Socketappender append method, output log content can be. The other side realizes the Socketserver function (the programming language basically supports this function).

Unfortunately, in the WebLogic general server domain I did not find a way to change the log output (last seen in the weblogic9.0 log service, do not know can not change), so the actual gap is relatively large, on performance issues, because it is an important log (warning, Error, fetal) only output, the use of socket method should not be small.

Digression:
See the code inadvertently found LOG4J framework part of the source code are some people donated. Although the code is not complex, but the feeling for their favorite frame is very enthusiastic, hope it becomes more and more good, really hope that we can have some excellent open source projects, and everyone to support it, develop it.
Actually I use log4j in the project uses some basic functions, to its design, the structure is not very clear, who has the related study document, please give me a, not very grateful (use manual already has).