AsyncAppender

The AsyncAppender accepts references to other Appenders and causes LogEvents to be written to them on a separate Thread. Note that exceptions while writing to those Appenders will be hidden from the application. The AsyncAppender should be configured after the appenders it references to allow it to shut down properly.

A typical AsyncAppender configuration might look like:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <File name="MyFile" fileName="logs/app.log">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
    </File>
    <Async name="Async">
      <appender-ref ref="MyFile"/>
    </Async>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="Async"/>
    </root>
  </loggers>
</configuration>

ConsoleAppender

As one might expect, the ConsoleAppender writes its output to either System.err or System.out with System.err being the default target. A Layout must be provided to format the LogEvent.

A typical Console configuration might look like:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Console name="STDOUT" target="SYSTEM_OUT">
      <PatternLayout pattern="%m%n"/>
    </Console>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="STDOUT"/>
    </root>
  </loggers>
</configuration>

FailoverAppender

The FailoverAppender wraps a set of appenders. If the primary Appender fails the secondary appenders will be tried in order until one succeeds or there are no more secondaries to try.

A Failover configuration might look like:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <RollingFile name="RollingFile" fileName="logs/app.log"
                 filePattern="logs/app-%d{MM-dd-yyyy}.log.gz">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
      <TimeBasedTriggeringPolicy />
    </RollingFile>
    <Console name="STDOUT" target="SYSTEM_OUT">
      <PatternLayout pattern="%m%n"/>
    </Console>
    <Failover name="Failover" primary="RollingFile" suppressExceptions="false">
      <Failovers>
        <appender-ref ref="Console"/>
      </Failovers>
    </Failover>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="Failover"/>
    </root>
  </loggers>
</configuration>

FastFileAppender

Experimental, may replace FileAppender in a future release.

The FastFileAppender is similar to the standard FileAppender except it is always buffered (this cannot be switched off) and internally it uses a ByteBuffer + RandomAccessFile instead of a BufferedOutputStream. We saw a 20-200% performance improvement compared to FileAppender with "bufferedIO=true" in our measurements. Similar to the FileAppender, FastFileAppender uses a FastFileManager to actually perform the file I/O. While FastFileAppender from different Configurations cannot be shared, the FastFileManagers can be if the Manager is accessible. For example, two web applications in a servlet container can have their own configuration and safely write to the same file if Log4j is in a ClassLoader that is common to both of them.

Here is a sample FastFile configuration:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <FastFile name="MyFile" fileName="logs/app.log">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
    </FastFile>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="MyFile"/>
    </root>
  </loggers>
</configuration>

FastRollingFileAppender

Experimental, may replace RollingFileAppender in a future release.

The FastRollingFileAppender is similar to the standard RollingFileAppender except it is always buffered (this cannot be switched off) and internally it uses a ByteBuffer + RandomAccessFile instead of a BufferedOutputStream. We saw a 20-200% performance improvement compared to RollingFileAppender with "bufferedIO=true" in our measurements. The FastRollingFileAppender writes to the File named in the fileName parameter and rolls the file over according the TriggeringPolicy and the RolloverPolicy. Similar to the RollingFileAppender, FastRollingFileAppender uses a FastRollingFileManager to actually perform the file I/O and perform the rollover. While FastRollingFileAppender from different Configurations cannot be shared, the FastRollingFileManagers can be if the Manager is accessible. For example, two web applications in a servlet container can have their own configuration and safely write to the same file if Log4j is in a ClassLoader that is common to both of them.

A FastRollingFileAppender requires a TriggeringPolicy and a RolloverStrategy. The triggering policy determines if a rollover should be performed while the RolloverStrategy defines how the rollover should be done. If no RolloverStrategy is configured, FastRollingFileAppender will use the DefaultRolloverStrategy.

File locking is not supported by the FastRollingFileAppender.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <FastRollingFile name="FastRollingFile" fileName="logs/app.log"
                 filePattern="logs/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
      <Policies>
        <TimeBasedTriggeringPolicy />
        <SizeBasedTriggeringPolicy size="250 MB"/>
      </Policies>
    </FastRollingFile>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="FastRollingFile"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <FastRollingFile name="FastRollingFile" fileName="logs/app.log"
                 filePattern="logs/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
      <Policies>
        <TimeBasedTriggeringPolicy />
        <SizeBasedTriggeringPolicy size="250 MB"/>
      </Policies>
      <DefaultRolloverStrategy max="20"/>
    </FastRollingFile>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="FastRollingFile"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <FastRollingFile name="FastRollingFile" fileName="logs/app.log"
                 filePattern="logs/$${date:yyyy-MM}/app-%d{yyyy-MM-dd-HH}-%i.log.gz">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
      <Policies>
        <TimeBasedTriggeringPolicy interval="6" modulate="true"/>
        <SizeBasedTriggeringPolicy size="250 MB"/>
      </Policies>
    </FastRollingFile>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="FastRollingFile"/>
    </root>
  </loggers>
</configuration>

FileAppender

The FileAppender is an OutputStreamAppender that writes to the File named in the fileName parameter. The FileAppender uses a FileManager (which extends OutputStreamManager) to actually perform the file I/O. While FileAppenders from different Configurations cannot be shared, the FileManagers can be if the Manager is accessible. For example, two web applications in a servlet container can have their own configuration and safely write to the same file if Log4j is in a ClassLoader that is common to both of them.

Here is a sample File configuration:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <File name="MyFile" fileName="logs/app.log">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
    </File>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="MyFile"/>
    </root>
  </loggers>
</configuration>

FlumeAppender

This is an optional component supplied in a separate jar.

Apache Flume is a distributed, reliable, and available system for efficiently collecting, aggregating, and moving large amounts of log data from many different sources to a centralized data store. The FlumeAppender takes LogEvents and sends them to a Flume agent as serialized Avro events for consumption.

The Flume Appender supports three modes of operation.

1. It can act as a remote Flume client which sends Flume events via Avro to a Flume Agent configured with an Avro Source.
2. It can act as an embedded Flume Agent where Flume events pass directly into Flume for processing.
3. It can persist events to a local BerkeleyDB data store and then asynchronously send the events to Flume, similar to the embedded Flume Agent but without most of the Flume dependencies.

A sample FlumeAppender configuration that is configured with a primary and a secondary agent, compresses the body, and formats the body using the RFC5424Layout:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Flume name="eventLogger" suppressExceptions="false" compress="true">
      <Agent host="192.168.10.101" port="8800"/>
      <Agent host="192.168.10.102" port="8800"/>
      <RFC5424Layout enterpriseNumber="18060" includeMDC="true" appName="MyApp"/>
    </Flume>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="eventLogger"/>
    </root>
  </loggers>
</configuration>

A sample FlumeAppender configuration that is configured with a primary and a secondary agent, compresses the body, formats the body using the RFC5424Layout, and persists encrypted events to disk:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Flume name="eventLogger" suppressExceptions="false" compress="true" type="persistent" dataDir="./logData">
      <Agent host="192.168.10.101" port="8800"/>
      <Agent host="192.168.10.102" port="8800"/>
      <RFC5424Layout enterpriseNumber="18060" includeMDC="true" appName="MyApp"/>
      <Property name="keyProvider">MySecretProvider</Property>
    </Flume>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="eventLogger"/>
    </root>
  </loggers>
</configuration>

A sample FlumeAppender configuration that is configured with a primary and a secondary agent, compresses the body, formats the body using RFC5424Layout and passes the events to an embedded Flume Agent.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Flume name="eventLogger" suppressExceptions="false" compress="true" type="Embedded">
      <Agent host="192.168.10.101" port="8800"/>
      <Agent host="192.168.10.102" port="8800"/>
      <RFC5424Layout enterpriseNumber="18060" includeMDC="true" appName="MyApp"/>
    </Flume>
    <Console name="STDOUT">
      <PatternLayout pattern="%d [%p] %c %m%n"/>
    </Console>
  </appenders>
  <loggers>
    <logger name="EventLogger" level="info">
      <appender-ref ref="eventLogger"/>
    </logger>
    <root level="warn">
      <appender-ref ref="STDOUT"/>
    </root>
  </loggers>
</configuration>

A sample FlumeAppender configuration that is configured with a primary and a secondary agent using Flume configuration properties, compresses the body, formats the body using RFC5424Layout and passes the events to an embedded Flume Agent.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="error" name="MyApp" packages="">
  <appenders>
    <Flume name="eventLogger" suppressExceptions="false" compress="true" type="Embedded">
      <Property name="channels">file</Property>
      <Property name="channels.file.type">file</Property>
      <Property name="channels.file.checkpointDir">target/file-channel/checkpoint</Property>
      <Property name="channels.file.dataDirs">target/file-channel/data</Property>
      <Property name="sinks">agent1 agent2</Property>
      <Property name="sinks.agent1.channel">file</Property>
      <Property name="sinks.agent1.type">avro</Property>
      <Property name="sinks.agent1.hostname">192.168.10.101</Property>
      <Property name="sinks.agent1.port">8800</Property>
      <Property name="sinks.agent1.batch-size">100</Property>
      <Property name="sinks.agent2.channel">file</Property>
      <Property name="sinks.agent2.type">avro</Property>
      <Property name="sinks.agent2.hostname">192.168.10.102</Property>
      <Property name="sinks.agent2.port">8800</Property>
      <Property name="sinks.agent2.batch-size">100</Property>
      <Property name="sinkgroups">group1</Property>
      <Property name="sinkgroups.group1.sinks">agent1 agent2</Property>
      <Property name="sinkgroups.group1.processor.type">failover</Property>
      <Property name="sinkgroups.group1.processor.priority.agent1">10</Property>
      <Property name="sinkgroups.group1.processor.priority.agent2">5</Property>
      <RFC5424Layout enterpriseNumber="18060" includeMDC="true" appName="MyApp"/>
    </Flume>
    <Console name="STDOUT">
      <PatternLayout pattern="%d [%p] %c %m%n"/>
    </Console>
  </appenders>
  <loggers>
    <logger name="EventLogger" level="info">
      <appender-ref ref="eventLogger"/>
    </logger>
    <root level="warn">
      <appender-ref ref="STDOUT"/>
    </root>
  </loggers>
</configuration>

JDBCAppender

The JDBCAppender writes log events to a relational database table using standard JDBC. It can be configured to obtain JDBC connections using the DriverManager, a JNDI DataSource or a custom factory method.

When configuring the JDBCAppender, you must specify a ConnectionSource implementation from which the Appender gets JDBC connections. You must use exactly one of the <DriverManager>, <DataSource>, or <ConnectionFactory> nested elements.

When configuring the JDBCAppender, use the nested <Column> elements to specify which columns in the table should be written to and how to write to them. The JDBCAppender uses this information to formulate a PreparedStatement to insert records without SQL injection vulnerability.

Here are a few sample configurations for the JDBCAppender:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="error">
  <appenders>
    <Jdbc name="databaseAppender" tableName="application_log">
      <DriverManager url="jdbc:mysql://example.org:3306/exampleDb" username="logging" password="abc123" />
      <Column name="eventDate" isEventTimestamp="true" />
      <Column name="level" pattern="%level" />
      <Column name="logger" pattern="%logger" />
      <Column name="message" pattern="%message" />
      <Column name="exception" pattern="%ex{full}" />
    </Jdbc>
  </appenders>
  <loggers>
    <root level="warn">
      <appender-ref ref="databaseAppender"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="error">
  <appenders>
    <Jdbc name="databaseAppender" tableName="dbo.application_log">
      <DataSource jndiName="java:/comp/env/jdbc/LoggingDataSource" />
      <Column name="eventDate" isEventTimestamp="true" />
      <Column name="level" pattern="%level" />
      <Column name="logger" pattern="%logger" />
      <Column name="message" pattern="%message" />
      <Column name="exception" pattern="%ex{full}" />
    </Jdbc>
  </appenders>
  <loggers>
    <root level="warn">
      <appender-ref ref="databaseAppender"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="error">
  <appenders>
    <Jdbc name="databaseAppender" tableName="LOGGING.APPLICATION_LOG">
      <ConnectionFactory class="net.example.db.ConnectionFactory" method="getNewDatabaseConnection" />
      <Column name="EVENT_ID" literal="LOGGING.APPLICATION_LOG_SEQUENCE.NEXTVAL" />
      <Column name="EVENT_DATE" isEventTimestamp="true" />
      <Column name="LEVEL" pattern="%level" />
      <Column name="LOGGER" pattern="%logger" />
      <Column name="MESSAGE" pattern="%message" />
      <Column name="THROWABLE" pattern="%ex{full}" />
    </Jdbc>
  </appenders>
  <loggers>
    <root level="warn">
      <appender-ref ref="databaseAppender"/>
    </root>
  </loggers>
</configuration>

JMSQueueAppender

The JMSQueueAppender sends the formatted log event to a JMS Queue.

Here is a sample JMSQueueAppender configuration:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <JMSQueue name="jmsQueue" queueBindingName="MyQueue"
              factoryBindingName="MyQueueConnectionFactory"/>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="jmsQueue"/>
    </root>
  </loggers>
</configuration>

JMSTopicAppender

The JMSTopicAppender sends the formatted log event to a JMS Topic.

Here is a sample JMSTopicAppender configuration:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <JMSTopic name="jmsTopic" topicBindingName="MyTopic"
              factoryBindingName="MyTopicConnectionFactory"/>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="jmsQueue"/>
    </root>
  </loggers>
</configuration>

JPAAppender

The JPAAppender writes log events to a relational database table using the Java Persistence API 2.1. It requires the API and a provider implementation be on the classpath. It also requires a decorated entity configured to persist to the table desired. The entity should either extend org.apache.logging.log4j.core.appender.db.jpa.BasicLogEventEntity (if you mostly want to use the default mappings) or org.apache.logging.log4j.core.appender.db.jpa.AbstractLogEventWrapperEntity (if you want to significantly customize the mappings). See the Javadoc for these two classes for more information. You can also consult the source code of these two classes as an example of how to implement the entity.

Here is a sample configuration for the JPAAppender. The first XML sample is the Log4j configuration file, the second is the persistence.xml file. EclipseLink is assumed here, but any JPA provider will do. You should always create a separate persistence unit for logging, for two reasons. First, <shared-cache-mode> must be set to "NONE," which is usually not desired in normal JPA usage. Also, for performance reasons the logging entity should be isolated in its own persistence unit away from all other entities.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="error">
  <appenders>
    <Jpa name="databaseAppender" persistenceUnitName="loggingPersistenceUnit"
         entityClassName="com.example.logging.JpaLogEntity" />
  </appenders>
  <loggers>
    <root level="warn">
      <appender-ref ref="databaseAppender"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<persistence xmlns="http://xmlns.jcp.org/xml/ns/persistence"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/persistence
                                 http://xmlns.jcp.org/xml/ns/persistence/persistence_2_1.xsd"
             version="2.1">

  <persistence-unit name="loggingPersistenceUnit">
    <provider>org.eclipse.persistence.jpa.PersistenceProvider</provider>
    <non-jta-data-source>jdbc/LoggingDataSource</non-jta-data-source>
    <class>com.example.logging.JpaLogEntity</class>
    <shared-cache-mode>NONE</shared-cache-mode>
  </persistence-unit>

</persistence>

package com.example.logging;
...
@Entity
@Table(name="application_log", schema="dbo")
public class JpaLogEntity extends AbstractLogEventWrapperEntity {
    private static final long serialVersionUID = 1L;
    private long id = 0L;

    public TestEntity() {
        super(null);
    }
    public TestEntity(LogEvent wrappedEvent) {
        super(wrappedEvent);
    }

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Column(name = "id")
    public long getId() {
        return this.id;
    }

    public void setId(long id) {
        this.id = id;
    }

    @Override
    @Enumerated(EnumType.STRING)
    @Column(name = "level")
    public Level getLevel() {
        return getWrappedEvent().getLevel();
    }

    @Override
    @Basic
    @Column(name = "logger")
    public String getLoggerName() {
        return getWrappedEvent().getLoggerName();
    }
    ...
}

NoSQLAppender

The NoSQLAppender writes log events to a NoSQL database using an internal lightweight provider interface. Provider implementations currently exist for MongoDB and Apache CouchDB, and writing a custom provider is quite simple.

You specify which NoSQL provider to use by specifying the appropriate configuration element within the <NoSql> element. The types currently supported are <MongoDb> and <CouchDb>. To create your own custom provider, read the JavaDoc for the NoSQLProvider, NoSQLConnection, and NoSQLObject classes and the documentation about creating Log4j plugins. We recommend you review the source code for the MongoDB and CouchDB providers as a guide for creating your own provider.

Here are a few sample configurations for the NoSQLAppender:

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="error">
  <appenders>
    <NoSql name="databaseAppender">
      <MongoDb databaseName="applicationDb" collectionName="applicationLog" server="mongo.example.org"
               username="loggingUser" password="abc123" />
    </NoSql>
  </appenders>
  <loggers>
    <root level="warn">
      <appender-ref ref="databaseAppender"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="error">
  <appenders>
    <NoSql name="databaseAppender">
      <MongoDb collectionName="applicationLog" factoryClassName="org.example.db.ConnectionFactory"
               factoryMethodName="getNewMongoClient" />
    </NoSql>
  </appenders>
  <loggers>
    <root level="warn">
      <appender-ref ref="databaseAppender"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="error">
  <appenders>
    <NoSql name="databaseAppender">
      <CouchDb databaseName="applicationDb" protocol="https" server="couch.example.org"
               username="loggingUser" password="abc123" />
    </NoSql>
  </appenders>
  <loggers>
    <root level="warn">
      <appender-ref ref="databaseAppender"/>
    </root>
  </loggers>
</configuration>

The following example demonstrates how log events are persisted in NoSQL databases if represented in a JSON format:

{
    "level": "WARN",
    "loggerName": "com.example.application.MyClass",
    "message": "Something happened that you might want to know about.",
    "source": {
        "className": "com.example.application.MyClass",
        "methodName": "exampleMethod",
        "fileName": "MyClass.java",
        "lineNumber": 81
    },
    "marker": {
        "name": "SomeMarker",
        "parent" {
            "name": "SomeParentMarker"
        }
    },
    "threadName": "Thread-1",
    "millis": 1368844166761,
    "date": "2013-05-18T02:29:26.761Z",
    "thrown": {
        "type": "java.sql.SQLException",
        "message": "Could not insert record. Connection lost.",
        "stackTrace": [
                { "className": "org.example.sql.driver.PreparedStatement$1", "methodName": "responder", "fileName": "PreparedStatement.java", "lineNumber": 1049 },
                { "className": "org.example.sql.driver.PreparedStatement", "methodName": "executeUpdate", "fileName": "PreparedStatement.java", "lineNumber": 738 },
                { "className": "com.example.application.MyClass", "methodName": "exampleMethod", "fileName": "MyClass.java", "lineNumber": 81 },
                { "className": "com.example.application.MainClass", "methodName": "main", "fileName": "MainClass.java", "lineNumber": 52 }
        ],
        "cause": {
            "type": "java.io.IOException",
            "message": "Connection lost.",
            "stackTrace": [
                { "className": "java.nio.channels.SocketChannel", "methodName": "write", "fileName": null, "lineNumber": -1 },
                { "className": "org.example.sql.driver.PreparedStatement$1", "methodName": "responder", "fileName": "PreparedStatement.java", "lineNumber": 1032 },
                { "className": "org.example.sql.driver.PreparedStatement", "methodName": "executeUpdate", "fileName": "PreparedStatement.java", "lineNumber": 738 },
                { "className": "com.example.application.MyClass", "methodName": "exampleMethod", "fileName": "MyClass.java", "lineNumber": 81 },
                { "className": "com.example.application.MainClass", "methodName": "main", "fileName": "MainClass.java", "lineNumber": 52 }
            ]
        }
    },
    "contextMap": {
        "ID": "86c3a497-4e67-4eed-9d6a-2e5797324d7b",
        "username": "JohnDoe"
    },
    "contextStack": [
        "topItem",
        "anotherItem",
        "bottomItem"
    ]
}

OutputStreamAppender

RewriteAppender

The RewriteAppender allows the LogEvent to manipulated before it is processed by another Appender. This can be used to mask sensitive information such as passwords or to inject information into each event. The RewriteAppender must be configured with a RewritePolicy. The RewriteAppender should be configured after any Appenders it references to allow it to shut down properly.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Console name="STDOUT" target="SYSTEM_OUT">
      <PatternLayout pattern="%m%n"/>
    </Console>
    <Rewrite name="rewrite">
      <appender-ref ref="STDOUT"/>
      <MapRewritePolicy mode="Add">
        <KeyValuePair key="product" value="TestProduct"/>
      </MapRewritePolicy>
    </Rewrite>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="Rewrite"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Console name="STDOUT" target="SYSTEM_OUT">
      <PatternLayout pattern="%m%n"/>
    </Console>
    <Rewrite name="rewrite">
      <appender-ref ref="STDOUT"/>
      <PropertiesRewritePolicy>
        <Property key="user">${sys:user.name}</Property>
        <Property key="env">${sys:environment}</Property>
      </PropertiesRewritePolicy>
    </Rewrite>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="Rewrite"/>
    </root>
  </loggers>
</configuration>

RollingFileAppender

The RollingFileAppender is an OutputStreamAppender that writes to the File named in the fileName parameter and rolls the file over according the TriggeringPolicy and the RolloverPolicy. The RollingFileAppender uses a RollingFileManager (which extends OutputStreamManager) to actually perform the file I/O and perform the rollover. While RolloverFileAppenders from different Configurations cannot be shared, the RollingFileManagers can be if the Manager is accessible. For example, two web applications in a servlet container can have their own configuration and safely write to the same file if Log4j is in a ClassLoader that is common to both of them.

A RollingFileAppender requires a TriggeringPolicy and a RolloverStrategy. The triggering policy determines if a rollover should be performed while the RolloverStrategy defines how the rollover should be done. If no RolloverStrategy is configured, RollingFileAppender will use the DefaultRolloverStrategy.

File locking is not supported by the RollingFileAppender.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <RollingFile name="RollingFile" fileName="logs/app.log"
                 filePattern="logs/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
      <Policies>
        <TimeBasedTriggeringPolicy />
        <SizeBasedTriggeringPolicy size="250 MB"/>
      </Policies>
    </RollingFile>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="RollingFile"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <RollingFile name="RollingFile" fileName="logs/app.log"
                 filePattern="logs/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
      <Policies>
        <TimeBasedTriggeringPolicy />
        <SizeBasedTriggeringPolicy size="250 MB"/>
      </Policies>
      <DefaultRolloverStrategy max="20"/>
    </RollingFile>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="RollingFile"/>
    </root>
  </loggers>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <RollingFile name="RollingFile" fileName="logs/app.log"
                 filePattern="logs/$${date:yyyy-MM}/app-%d{yyyy-MM-dd-HH}-%i.log.gz">
      <PatternLayout>
        <pattern>%d %p %c{1.} [%t] %m%n</pattern>
      </PatternLayout>
      <Policies>
        <TimeBasedTriggeringPolicy interval="6" modulate="true"/>
        <SizeBasedTriggeringPolicy size="250 MB"/>
      </Policies>
    </RollingFile>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="RollingFile"/>
    </root>
  </loggers>
</configuration>

RoutingAppender

The RoutingAppender evaluates LogEvents and then routes them to a subordinate Appender. The target Appender may be an appender previously configured and may be referenced by its name or the Appender can be dynamically created as needed. The RoutingAppender should be configured after any Appenders it references to allow it to shut down properly.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Flume name="AuditLogger" suppressExceptions="false" compress="true">
      <Agent host="192.168.10.101" port="8800"/>
      <Agent host="192.168.10.102" port="8800"/>
      <RFC5424Layout enterpriseNumber="18060" includeMDC="true" appName="MyApp"/>
    </Flume>
    <Routing name="Routing">
      <Routes pattern="$${sd:type}">
        <Route>
          <RollingFile name="Rolling-${sd:type}" fileName="${sd:type}.log"
                       filePattern="${sd:type}.%i.log.gz">
            <PatternLayout>
              <pattern>%d %p %c{1.} [%t] %m%n</pattern>
            </PatternLayout>
            <SizeBasedTriggeringPolicy size="500" />
          </RollingFile>
        </Route>
        <Route appender-ref="AuditLogger" key="Audit"/>
      </Routes>
    </Routing>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="Routing"/>
    </root>
  </loggers>
</configuration>

SMTPAppender

Sends an e-mail when a specific logging event occurs, typically on errors or fatal errors.

The number of logging events delivered in this e-mail depend on the value of BufferSize option. The SMTPAppender keeps only the last BufferSize logging events in its cyclic buffer. This keeps memory requirements at a reasonable level while still delivering useful application context.

The default behavior is to trigger sending an email whenever an ERROR or higher severity event is logged and to format it as HTML. The circumstances on when the email is sent can be controlled by setting one or more filters on the Appender. As with other Appenders, the formatting can be controlled by specifying a Layout for the Appender.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <SMTP name="Mail" suppressExceptions="false" subject="Error Log" to="errors@logging.apache.org"
      from="test@logging.apache.org" smtpHost="localhost" smtpPort="25" bufferSize="50">
    </SMTP>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="Mail"/>
    </root>
  </loggers>
</configuration>

SocketAppender

The SocketAppender is an OutputStreamAppender that writes its output to a remote destination specified by a host and port. The data can be sent over either TCP or UDP and can be sent in any format. The default format is to send a Serialized LogEvent. Log4j 2 contains a SocketServer which is capable of receiving serialized LogEvents and routing them through the logging system on the server.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Socket name="socket" host="localhost" port="9500">
      <SerializedLayout />
    </Socket>
  </appenders>
  <loggers>
    <root level="error">
      <appender-ref ref="socket"/>
    </root>
  </loggers>
</configuration>

SyslogAppender

The SyslogAppender is a SocketAppender that writes its output to a remote destination specified by a host and port in a format that conforms with either the BSD Syslog format or the RFC 5424 format. The data can be sent over either TCP or UDP.

A sample syslogAppender configuration that is configured with two SyslogAppenders, one using the BSD format and one using RFC 5424.

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="warn" name="MyApp" packages="">
  <appenders>
    <Syslog name="bsd" host="localhost" port="514" protocol="TCP"/>
    <Syslog name="RFC5424" format="RFC5424" host="localhost" port="8514"
            protocol="TCP" appName="MyApp" includeMDC="true"
            facility="LOCAL0" enterpriseNumber="18060" newLine="true"
            messageId="Audit" id="App"/>
  </appenders>
  <loggers>
    <logger name="com.mycorp" level="error">
      <appender-ref ref="RFC5424"/>
    </logger>
    <root level="error">
      <appender-ref ref="bsd"/>
    </root>
  </loggers>
</configuration>