Send Log4j 2 events to a syslog receiver

Log4j 2's Syslog appender sends events to a network receiver at a host and port. It does not write directly to the Unix-domain socket /dev/log. A local syslog daemon can accept a loopback TCP or UDP connection if you enable the corresponding listener.

1. Add matching Log4j dependencies

Use the same compatible, maintained version of Log4j API and Core. Define log4j2.version in your dependency management or project properties:

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-api</artifactId>
    <version>${log4j2.version}</version>
</dependency>
<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>${log4j2.version}</version>
</dependency>

This version property is a placeholder you must define, not an automatically supplied Maven value. Review the supported Java version and security updates when selecting the release.

2. Configure the Syslog appender

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN">
  <Appenders>
    <Syslog name="Syslog" host="127.0.0.1" port="514"
            protocol="TCP" facility="LOCAL0"
            format="RFC5424" appName="order-service"
            newLine="true" charset="UTF-8"/>
    <Console name="Console" target="SYSTEM_OUT">
      <PatternLayout pattern="%d{HH:mm:ss} %-5p %c - %m%n"/>
    </Console>
  </Appenders>
  <Loggers>
    <Root level="info">
      <AppenderRef ref="Console"/>
      <AppenderRef ref="Syslog"/>
    </Root>
  </Loggers>
</Configuration>

The important choices are:

• host and port: the actual syslog listener, local or remote.
• protocol: TCP, UDP, or the supported SSL transport with its required configuration. This example is plain TCP.
• facility: application-defined facilities commonly use LOCAL0 through LOCAL7.
• appName: the application identifier in the syslog message.
• format and framing: the receiver must accept the emitted RFC5424 records and their boundaries. newLine="true" selects newline termination for this example.

3. Configure and test the receiving path

For rsyslog, enable the TCP input if it is not already enabled. For example, a modern configuration can contain:

module(load="imtcp")
input(type="imtcp" port="514")

Do not load the module twice if another included file already does so. Validate the configuration and configure listener access appropriate to your environment.

On Linux with util-linux logger, a preliminary transport test is:

logger -p local0.info -n 127.0.0.1 -P 514 -T "test"

Those flags are not portable to every logger implementation. Then send a real Log4j event as well: a successful logger command does not prove the appender's layout, framing, and field parsing are correct.

TCP provides ordered transport and retransmission, but it does not prove durable receipt. The appender does not implement RELP. Audit requirements may need a durable local spool, a collector or relay with the required protocol, and verified receiver storage. Asynchronous logging can reduce caller-thread I/O, but its queues and overflow policy must be configured and tested; it is not an unconditional throughput guarantee.

For a DataKit receiver, configure TCP or UDP log collection with a matching address and protocol. Verify raw text, timestamp, severity, and application identity before forwarding normal traffic.

Frequently asked questions

Does Log4j 1.x have a syslog appender?

Yes, but Log4j 1.x is end-of-life and has known security issues. Plan migration to a maintained version.

Why are non-ASCII messages garbled?

Check the layout's encoding and the receiver's decoding. This example requests UTF-8; verify the actual bytes and parsed output instead of changing the message text to hide an encoding mismatch.

Can the same logger write a file and syslog?

Yes, by attaching multiple appender references. They are not completely isolated: slow synchronous destinations, filtering, error policies, and asynchronous queues can affect behavior. Test each destination and failure mode.

See Log4j network appenders and rsyslog TCP input.