You are viewing a plain text version of this content. The canonical link for it is here.

Posted to log4net-user@logging.apache.org by "Parrish, Ken" <KP...@gomez.com> on 2009/05/20 17:55:36 UTC

Filtering events - all EXCEPT ...

I have a server deployed which is generating 'false positive' log4net ERROR events.  These should be changed to be WARN events so that they can be filtered out by a configuration change.  Unfortunately, deploying a patch to the server at this point in time means moving heaven and earth to get the support needed for QA and deployment.

What I would like to do is to devise a change to the log4net configuration which allows filtering OUT of the specific events that are 'false positive'.  Generally, it seems that the <filter> option on an appender indicates what IS to be included, not what should be excluded.

How can I design an appender with a string filter that excludes all events that contain a particular string, but allows all other events to fall through and be reported.  In the following example, I wish to filter OUT all events that contain the string ="Zero Length Request Received" and  leave everything else.

In the SDK, there is an option named:  AcceptOnMatch.  Can that be incorporated into this type of filter to get the desired effect?

Thanks,

Ken Parrish
Gomez, Inc.

<filter type="log4net.Filter.StringMatchFilter">
    <!-- ??? will this work ???  -->
    <stringToMatch value="Zero Length Request Received" AcceptOnMatch="false" />
</filter>

RE: Filtering events - all EXCEPT ...

Posted by "Parrish, Ken" <KP...@gomez.com>.

Loren,

Thanks for your response.  Unfortunately, I cannot filter by level because of a bug in the source code that I can't change right now.  I have both legitimate errors and 'false positive' errors being generated from the same class with the same level.  The only way to filter is via content.

I believe I have found a solution.  The following seems to produce the right result:

<appender name="ConsoleAppender" type="log4net.Appender.ConsoleAppender">
	<filter type="log4net.Filter.StringMatchFilter" >
		<param name="AcceptOnMatch" value="false" />
		<stringToMatch value="Zero Length Request Received"  />
	</filter>
	<layout type="log4net.Layout.PatternLayout">
		<param name="ConversionPattern" value=". . ." />
	</layout>
</appender>

What took some time to figure out was the syntax for the adding the AcceptOnMatch=false attribute.  Once AcceptOnMatch is set to false, it is important to remove the DenyAllFilter from the processing stream.

For the following test case:

	for (int i = 0; i < 10; i++)
	{
		Log.DebugFormat("Test message 1.");
 		Log.DebugFormat("Test message 2.");
		Log.DebugFormat("Zero Length Request Received");
	}

Now only the "Test message *." events are logged, the others are filtered out.

Thanks,

Ken Parrish
Gomez, Inc.

-----Original Message-----
From: Loren Keagle [mailto:Loren@aps-technology.com] 
Sent: Wednesday, May 20, 2009 12:42 PM
To: Log4NET User
Subject: Re: Filtering events - all EXCEPT ...

If the ERROR events are all coming from a small number of sources, you 
can change the log level of just those loggers to filter out those 
messages.
 From the log4net documentation:

    <!-- Print only messages of level WARN or above in the package Com.Foo -->
    <logger name="Com.Foo">
        <level value="WARN" />
    </logger>

This would cause Com.Foo log events (and possibly Com.Foo.* ???) to not 
be logged if they are below the WARN level.

Setting AcceptOnMatch to "false" means that the result of the filter is 
neutral if the string is found, meaning it just continues on through the 
filter chain, and likely is accepted by default at the end. 
Unfortunately, there is no DenyOnMatch configuration, so I don't see any 
way to use it for your purposes.

~Loren

Parrish, Ken wrote:
>
> I have a server deployed which is generating 'false positive' log4net 
> ERROR events. These should be changed to be WARN events so that they 
> can be filtered out by a configuration change. Unfortunately, 
> deploying a patch to the server at this point in time means moving 
> heaven and earth to get the support needed for QA and deployment.
>
> What I would like to do is to devise a change to the log4net 
> configuration which allows filtering OUT of the specific events that 
> are 'false positive'. Generally, it seems that the <filter> option on 
> an appender indicates what IS to be included, not what should be excluded.
>
> How can I design an appender with a string filter that excludes all 
> events that contain a particular string, but allows all other events 
> to fall through and be reported. In the following example, I wish to 
> filter OUT all events that contain the string ="Zero Length Request 
> Received" and leave everything else.
>
> In the SDK, there is an option named: AcceptOnMatch. Can that be 
> incorporated into this type of filter to get the desired effect?
>
> Thanks,
>
> Ken Parrish
>
> Gomez, Inc.
>
> <filter type="log4net.Filter.StringMatchFilter">
>
> <!-- ??? will this work ??? -->
>
> <stringToMatch value="Zero Length Request Received" 
> AcceptOnMatch="false" />
>
> </filter>
>
> ------------------------------------------------------------------------
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com 
> Version: 8.5.339 / Virus Database: 270.12.35/2124 - Release Date: 05/20/09 06:22:00
>
>

Re: Filtering events - all EXCEPT ...

Posted by Loren Keagle <Lo...@aps-technology.com>.

If the ERROR events are all coming from a small number of sources, you 
can change the log level of just those loggers to filter out those 
messages.
 From the log4net documentation:

    <!-- Print only messages of level WARN or above in the package Com.Foo -->
    <logger name="Com.Foo">
        <level value="WARN" />
    </logger>


This would cause Com.Foo log events (and possibly Com.Foo.* ???) to not 
be logged if they are below the WARN level.

Setting AcceptOnMatch to "false" means that the result of the filter is 
neutral if the string is found, meaning it just continues on through the 
filter chain, and likely is accepted by default at the end. 
Unfortunately, there is no DenyOnMatch configuration, so I don't see any 
way to use it for your purposes.

~Loren


Parrish, Ken wrote:
>
> I have a server deployed which is generating ‘false positive’ log4net 
> ERROR events. These should be changed to be WARN events so that they 
> can be filtered out by a configuration change. Unfortunately, 
> deploying a patch to the server at this point in time means moving 
> heaven and earth to get the support needed for QA and deployment.
>
> What I would like to do is to devise a change to the log4net 
> configuration which allows filtering OUT of the specific events that 
> are ‘false positive’. Generally, it seems that the <filter> option on 
> an appender indicates what IS to be included, not what should be excluded.
>
> How can I design an appender with a string filter that excludes all 
> events that contain a particular string, but allows all other events 
> to fall through and be reported. In the following example, I wish to 
> filter OUT all events that contain the string ="Zero Length Request 
> Received" and leave everything else.
>
> In the SDK, there is an option named: AcceptOnMatch. Can that be 
> incorporated into this type of filter to get the desired effect?
>
> Thanks,
>
> Ken Parrish
>
> Gomez, Inc.
>
> <filter type="log4net.Filter.StringMatchFilter">
>
> <!-- ??? will this work ??? -->
>
> <stringToMatch value="Zero Length Request Received" 
> AcceptOnMatch=”false” />
>
> </filter>
>
> ------------------------------------------------------------------------
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com 
> Version: 8.5.339 / Virus Database: 270.12.35/2124 - Release Date: 05/20/09 06:22:00
>
>