All Apps and Add-ons

Java Logging Appenders: Why am I getting error "Could not create an Appender of type [com.splunk.logging.TcpAppender]"?

simone84
New Member

Hi Everyone,

configuring "SplunkJavaLogging(with backlog)" on a server tomcat7, when I restart it I get the following java error:

16:29:20,152 |-ERROR in ch.qos.logback.core.joran.action.AppenderAction - Could not create an Appender of type [com.splunk.logging.TcpAppender]. ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender
at ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassNameAndParameter(OptionHelper.java:73)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassName(OptionHelper.java:48)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassName(OptionHelper.java:35)
at      at ch.qos.logback.core.joran.action.AppenderAction.begin(AppenderAction.java:54)
at      at ch.qos.logback.core.joran.spi.Interpreter.callBeginAction(Interpreter.java:275)
at      at ch.qos.logback.core.joran.spi.Interpreter.startElement(Interpreter.java:147)
at      at ch.qos.logback.core.joran.spi.Interpreter.startElement(Interpreter.java:129)
at      at ch.qos.logback.core.joran.spi.EventPlayer.play(EventPlayer.java:50)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:149)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:135)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:99)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:76)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:68)
at      at ch.qos.logback.access.tomcat.LogbackValve.startInternal(LogbackValve.java:138)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.StandardPipeline.startInternal(StandardPipeline.java:185)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:1137)
at      at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:816)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1575)
at      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1565)
at      at java.util.concurrent.FutureTask.run(FutureTask.java:262)
at      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at      at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.ClassNotFoundException: com.splunk.logging.TcpAppender
at      at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
at      at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
at      at java.security.AccessController.doPrivileged(Native Method)
at      at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
at      at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
at      at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassNameAndParameter(OptionHelper.java:60)
at      ... 25 common frames omitted
16:29:20,152 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@7:64 - ActionException in Action for tag [appender] ch.qos.logback.core.joran.spi.ActionException: ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender

This is my conf:

logback-access.xml

        <RemoteHost>splunkServer</RemoteHost>
        <Port>5150</Port>
        <layout class="ch.qos.logback.classic.PatternLayout">
        <pattern>%date{ISO8601} [%thread] %level: %msg%n</pattern>
        </layout>
    </appender>

    <logger name="splunk.logger" additivity="false" level="INFO">
        <appender-ref ref="socket"/>
    </logger>

    <root level="INFO">
        <appender-ref ref="socket"/>
    </root>

server.xml

Valve className="ch.qos.logback.access.tomcat.LogbackValve"

LIB:

-rw-r--r-- 1 simoneant simoneant   93525 Apr  2  2014 logback-access-1.1.2.jar
-rw-r--r-- 1 simoneant simoneant  270747 Apr  2  2014 logback-classic-1.1.2.jar
-rw-r--r-- 1 simoneant simoneant  427729 Apr  2  2014 logback-core-1.1.2.jar

Please help me to figure out...

Thanks
Simone

Tags (1)
0 Karma

simone84
New Member

Hi Darmien,

Thanks to helping me to figure out the issue with the logback.
Now during the restart I get these error messages on the console.out:

INFO: Starting Servlet Engine: Apache Tomcat/7.0.59
15:22:37,252 |-INFO in ch.qos.logback.access.tomcat.LogbackValve[localhost] - filename property not set. Assuming [/tomcat7/apache-tomcat-7.0.59/conf/logback-access.xml]
15:22:37,293 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - debug attribute not set
15:22:37,295 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [com.splunk.logging.logback.appender.SplunkRestAppender]
15:22:37,310 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [splunkrawtcp]
15:22:37,600 |-ERROR in com.splunk.logging.logback.appender.SplunkRestAppender[splunkrawtcp] - Couldn't establish REST service for SplunkRestAppender named "splunkrawtcp".
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@31:64 - no applicable action for [logger], current ElementPath is [[configuration][logger]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@32:40 - no applicable action for [appender-ref], current ElementPath is [[configuration][logger][appender-ref]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@36:22 - no applicable action for [root], current ElementPath is [[configuration][root]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@37:33 - no applicable action for [appender-ref], current ElementPath is [[configuration][root][appender-ref]]
15:22:37,606 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - End of configuration.

this is my web.xml. webapps/application/WEB-INF/web.xml

alt text

How to generate events to figure out if Splunk logging is really working?

Thanks
Simone

0 Karma

ppablo
Retired

Hi @simone84

Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You typed your response in the "Enter your answer here..." box at the very bottom of the page which, instead, posts a brand new answer when it was really meant as a comment. This will help with a clean continuous flow of the conversation.

Your "answer" can no longer be converted to a comment since it is beyond the character limit. If you have a long response and are hitting a character limit when leaving a comment, just break it up into multiple comments. Just something to keep in mind from here on out. Thanks.

0 Karma

Damien_Dallimor
Ultra Champion
Caused by: java.lang.ClassNotFoundException: com.splunk.logging.TcpAppender

Clearly you do not have the necessary SplunkJavaLogging classes on your classpath

0 Karma

simone84
New Member

Hi Darmien,
Now during the restart I get these error messages on the console.out:
15:22:37,293 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - debug attribute not set
15:22:37,295 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [com.splunk.logging.logback.appender.SplunkRestAppender]
15:22:37,310 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [splunkrawtcp]
15:22:37,600 |-ERROR in com.splunk.logging.logback.appender.SplunkRestAppender[splunkrawtcp] - Couldn't establish REST service for SplunkRestAppender named "splunkrawtcp".
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@31:64 - no applicable action for [logger], current ElementPath is [[configuration][logger]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@32:40 - no applicable action for [appender-ref], current ElementPath is [[configuration][logger][appender-ref]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@36:22 - no applicable action for [root], current ElementPath is [[configuration][root]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@37:33 - no applicable action for [appender-ref], current ElementPath is [[configuration][root][appender-ref]]
15:22:37,606 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - End of configuration.

How to generate events to figure out if Splunk logging is really working?
Thanks 1000
Simone

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...