Monday, May 21, 2012
 
The best way to analyze your logs! Minimize
 Log4Net Mail archive   

The Log4Net mailing list is a great source of information about using log4Net, in this forum we collect all the messages in the log4net user list and some selected threads from the developer list.

Subject: Filtering events - all EXCEPT ...
Prev Next
You are not authorized to post a reply.

Author Messages
Parrish, Ken

05/20/2009 5:55 PM  

I have a server deployed which is generating ‘false positive’ log4net ERROR events.  These should be changed to be WARN events so that they can be filtered out by a configuration change.  Unfortunately, deploying a patch to the server at this point in time means moving heaven and earth to get the support needed for QA and deployment.

 

What I would like to do is to devise a change to the log4net configuration which allows filtering OUT of the specific events that are ‘false positive’.  Generally, it seems that the <filter> option on an appender indicates what IS to be included, not what should be excluded.

 

How can I design an appender with a string filter that excludes all events that contain a particular string, but allows all other events to fall through and be reported.  In the following example, I wish to filter OUT all events that contain the string ="Zero Length Request Received" and  leave everything else.

 

In the SDK, there is an option named:  AcceptOnMatch.  Can that be incorporated into this type of filter to get the desired effect?

 

Thanks,

 

Ken Parrish

Gomez, Inc.

 

<filter type="log4net.Filter.StringMatchFilter">

    <!-- ??? will this work ???  -->

    <stringToMatch value="Zero Length Request Received" AcceptOnMatch=”false” />

</filter>

 

Loren Keagle

05/20/2009 6:42 PM  

If the ERROR events are all coming from a small number of sources, you
can change the log level of just those loggers to filter out those
messages.
 From the log4net documentation:

    <!-- Print only messages of level WARN or above in the package Com.Foo -->
    <logger name="Com.Foo">
        <level value="WARN" />
    </logger>


This would cause Com.Foo log events (and possibly Com.Foo.* ???) to not
be logged if they are below the WARN level.

Setting AcceptOnMatch to "false" means that the result of the filter is
neutral if the string is found, meaning it just continues on through the
filter chain, and likely is accepted by default at the end.
Unfortunately, there is no DenyOnMatch configuration, so I don't see any
way to use it for your purposes.

~Loren

Parrish, Ken

05/20/2009 7:57 PM  

Loren,

Thanks for your response.  Unfortunately, I cannot filter by level because of a bug in the source code that I can't change right now.  I have both legitimate errors and 'false positive' errors being generated from the same class with the same level.  The only way to filter is via content.

I believe I have found a solution.  The following seems to produce the right result:

<appender name="ConsoleAppender" type="log4net.Appender.ConsoleAppender">
        <filter type="log4net.Filter.StringMatchFilter" >
                <param name="AcceptOnMatch" value="false" />
                <stringToMatch value="Zero Length Request Received"  />
        </filter>
        <layout type="log4net.Layout.PatternLayout">
                <param name="ConversionPattern" value=". . ." />
        </layout>
</appender>


What took some time to figure out was the syntax for the adding the AcceptOnMatch=false attribute.  Once AcceptOnMatch is set to false, it is important to remove the DenyAllFilter from the processing stream.

For the following test case:

        for (int i = 0; i < 10; i++)
        {
                Log.DebugFormat("Test message 1.");
                Log.DebugFormat("Test message 2.");
                Log.DebugFormat("Zero Length Request Received");
        }

Now only the "Test message *." events are logged, the others are filtered out.

Thanks,

Ken Parrish
Gomez, Inc.

You are not authorized to post a reply.
Forums > Log4Net > Log4Net Mail archive > Filtering events - all EXCEPT ...



ActiveForums 3.7

 

 

 

 

 

 

 

 

Log4Net Dashboard

Log analysis and monitoring made easy!

Log4Net Dashboard is a log viewer that can read log statements from a variety of logging output targets.

You can download a free developer version.

  

Check it out!

On the demonstration site you can try it  with live data.demo.l4ndash.com - Try Log4Net Dashboard with live data

The mail archive is a copy of all the mail sent to the mail address: log4net-user@logging.apache.org, organized as a forum.

If you would like to participate in the mail list, send a mail to log4net-user-subscribe@logging.apache.org.

More information about the mailing list is available on: http://logging.apache.org/log4net/support.html

 

A complete topic list is available and can be viewed here (warning, it takes some time to load)

 

Copyright 2005-2008 by FaktNet AS Terms Of Use Privacy Statement