////
    Licensed to the Apache Software Foundation (ASF) under one or more
    contributor license agreements.  See the NOTICE file distributed with
    this work for additional information regarding copyright ownership.
    The ASF licenses this file to You under the Apache License, Version 2.0
    (the "License"); you may not use this file except in compliance with
    the License.  You may obtain a copy of the License at

         http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
////

[#remotesyslogappender]
= RemoteSyslogAppender

The `RemoteSyslogAppender` sends log messages to a remote syslog daemon using the BSD syslog protocol over UDP (default port 514).
It supports configurable syslog facilities and severity levels, but due to the nature of UDP, messages may be lost or truncated.

This appender does not include timestamp or hostname fields, as the receiving syslog daemon adds them automatically.
It also splits log messages at line breaks, sending each line as a separate syslog message.

The following example sends all events with Level WARN or higher to the remote server 192.168.1.100 on the default port with UTF8-Encoding.

[source,xml]
----
<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <encoding>UTF-8</encoding>
  <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date{MM/dd/yyyy HH:mm:ss.fff} [%thread] %-5level %logger - %message%newline" />
  </layout>
  <remoteAddress value="192.168.1.100" />
  <threshold value="WARN" />
</appender>
----

You can also specify:

* Facility (default: user)
* Identity (default: application name)

[source,xml]
----
<appender name="RemoteSyslogAppender" type="log4net.Appender.RemoteSyslogAppender">
  <encoding>UTF-8</encoding>
  <facility>Alert</facility>
  <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date{MM/dd/yyyy HH:mm:ss.fff} [%thread] %-5level %logger - %message%newline" />
  </layout>
  <identity>MyApp-Canary</identity>
  <remoteAddress value="192.168.1.100" />
  <threshold value="WARN" />
</appender>
----

If your log message contains multiple lines, it will be logged as multiple separate syslog entries instead of a single multiline message.

This might lead to confusion when analyzing logs because related lines could appear interleaved with logs from other sources.

Example:

[source,csharp]
----
try
{
  throw new InvalidTimeZoneException();
}
catch (InvalidTimeZoneException e)
{
  logger.Error(e, "setting daylight saving time failed")
}
----

Output (with intermixed messages):

[source,log]
----
12/21/2024 14:07:41.508 [main] ERROR log4net.Tests - setting daylight saving time failed
Exception of type 'System.InvalidTimeZoneException' was thrown.
12/21/2024 14:07:41.511 [worker] WARN log4net.Tests - some unrelated log message
  at log4net.Tests.Appender.RemoteSyslogAppenderTest.LineBreakTest()
  at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
  at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
----