ARTIFACTORY: How can I send logs to Syslog?

Introduction:

Some organizations would like to have the ability to send some of the Artifactory logs into Syslog in order to be able to ship the logs to other monitoring solutions. Follow these steps for Artifactory to send specific logs to the Syslog service. 

Configuration:

1. Edit the $JFROG_HOME/artifactory/var/etc/artifactory/logback.xml file and add the following syslog appender:

<appender name="SYSLOG" class= "ch.qos.logback.classic.net.SyslogAppender">
     <syslogHost>syslog-server-URL</syslogHost>
     <facility>SYSLOG</facility>
     <suffixPattern>[%thread] %logger %msg</suffixPattern>
</appender>

2. Add this additional appender:

<root>
  < level value="debug"/>
  <appender-ref ref="CONSOLE"/>
  <appender-ref ref="FILE"/>
  <appender-ref ref="SYSLOG"/>
</root>

3. Save the file.

The above configuration will send the console.log log entries to Syslog. The Syslog logs can be viewed under the /var/log/messages or the /var/log/syslog files on the machine Syslog is configured on. More information on logback appenders can be found in this external article.

Syslog configuration:

Since logback uses internet sockets, ensure that Syslog can accept them. In modern Linux distributions, the rsyslog daemon is used for the Syslog service. The following lines should be uncommented (if already exist in the file) or added to the /etc/rsyslog.conf file:

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

Below is an example of a working rsyslog.conf file:

# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################
# Provides UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

# Provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

*.=debug;\
  auth,authpriv.none;\
  news.none;mail.none         -/var/log/debug
*.=info;*.=notice;*.=warn;\
  auth,authpriv.none;\
  cron,daemon.none;\
  mail,news.none              -/var/log/messages

More on the Rsyslog configuration options can be found in this external article. 

Sending Artifactory logs to Syslog:

To send specific logs to Syslog, we can add a logger with the relevant class, stating the SYSLOG appender. For instance, to send the artifactory-request.log, we can add the following logger:

<logger name="org.artifactory.traffic.RequestLogger" additivity="false">
        <level value="info" />
        <appender-ref ref="SYSLOG" />
</logger>

To send the artifactory-access.log, we can add the following logger:

<logger name="org.artifactory.security.AccessLogger" additivity="false">
     <level value="info"/>
     <appender-ref ref="SYSLOG"/>
</logger>

To send the artifactory-request-out.log logs, we can add the following logger:

<logger name="org.artifactory.traffic.OutboundRequestLogger" additivity="false">
     <level value="info"/>
     <appender-ref ref="SYSLOG"/>
</logger>