Bug 1309615

Summary: TCP Syslog handler cannot log some messages after reconnect
Product: [JBoss] JBoss Enterprise Application Platform 6 Reporter: Ondrej Lukas <olukas>
Component: LoggingAssignee: jboss-set
Status: CLOSED NOTABUG QA Contact: Nikoleta Hlavickova <nziakova>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.4.0CC: brian.stansberry, jperkins
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-02-19 08:03:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
logging-deployment none

Description Ondrej Lukas 2016-02-18 09:59:34 UTC
In case when logging to syslog through TCP protocol is configured and syslog port becomes unreachable then after syslog restart some messages can be thrown away. 

It seems syslog handler needs to another two logs for correct closing original TCP connection. In case when syslog is restarted and:
 
- no message is logged during syslog is unreachable then the first two messages will not be logged to syslog after syslog is running again

- one message is attempted to be logged during syslog is unreachable then the first message will not be logged to syslog after syslog is running again

- two and more messages are attempted to be logged during syslog is unreachable then everything is logged correctly after syslog is running again

How to reproduce:
1) Configure EAP to log some category to syslog through TCP:
            <custom-handler name="SYSLOG_TCP_HANDLER" class="org.jboss.logmanager.handlers.SyslogHandler" module="org.jboss.logmanager">
                <encoding value="ISO-8859-1"/>
                <formatter>
                    <pattern-formatter pattern="%-5p [%c] (%t) %s%E%n"/>
                </formatter>
                <properties>
                    <property name="appName" value="JBossEAP"/>
                    <property name="facility" value="LOCAL_USE_5"/>
                    <property name="serverHostname" value="127.0.0.1"/>
                    <property name="hostname" value="-"/>
                    <property name="port" value="10514"/>
                    <property name="syslogType" value="RFC5424"/>
                    <property name="protocol" value="TCP"/>
                    <property name="messageDelimiter" value="-"/>
                    <property name="useMessageDelimiter" value="true"/>
                </properties>
            </custom-handler>
...
            <logger category="org.jboss.as.test.integration.logging.operations">
                <level name="INFO"/>
                <handlers>
                    <handler name="SYSLOG_TCP_HANDLER"/>
                </handlers>
            </logger>
2) Start application server and syslog server.
3) Deploy logging servlet (see attachements) which makes one log when is accessed.
4) Access http://127.0.0.1:8080/logging-deployment/logger -> message is logged to syslog
5) Restart Syslog server
6) Access http://127.0.0.1:8080/logging-deployment/logger three times -> first and second message are thrown away, only third message is logged
7) Stop Syslog server
8) Access http://127.0.0.1:8080/logging-deployment/logger twice (messages are not logged to syslog since it is down)
9) Start Syslog server
10) Access http://127.0.0.1:8080/logging-deployment/logger -> message is logged to syslog

Comment 1 Ondrej Lukas 2016-02-18 10:00:09 UTC
Created attachment 1128172 [details]
logging-deployment

Comment 2 Ondrej Lukas 2016-02-19 08:03:04 UTC
According to https://issues.jboss.org/browse/WFCORE-1401 this is expected behavior -> CLOSED as NOTABUG.