Splunk Dev

Why isn't the Splunk logger appender terminating? Our Java program keeps running with no exit code.

SNaikwade
Path Finder

We followed the steps in below documentation for "Enable logging to HTTP Event Collector in your Java project".
http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE7M
In our testing, we are seeing that Splunk logger appender is not terminating. Our java program keeps running with no exit code.

Steps to reproduce:
- Import attached code to IntelliJ IDE
- Change http collect token and url in logback.xml
- Run the main java

Unfortunately, I cannot attach files here due to fewer karma points.


here are the files:

test.java

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.splunk.logging.*;

public class test {
    public static void main( String[] args ) {
        System.out.println("This is first");

        Logger logger = LoggerFactory.getLogger("splunk");
        logger.info("This is a test event for Logback test");
        logger.error("This is a test error for Logback test");
        System.out.println("This is second");


    }
}

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <Appender name="http" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
        <url>http://splunkheavyforwarder.dev.aws.away.black:8088</url>
        <token>640D5ED1-4D44-484A-8576-F8BA16746954</token>
        <disableCertificateValidation>true</disableCertificateValidation>
        <layout class="ch.qos.logback.classic.PatternLayout">
            <Pattern>
                %d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n
            </Pattern>
        </layout>
    </Appender>

    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <layout class="ch.qos.logback.classic.PatternLayout">
            <Pattern>
                %d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n
            </Pattern>
        </layout>
    </appender>
    <logger name ="http" level="debug">
        <appender-ref ref="http" />
    </logger>
    <root level="INFO">
        <appender-ref ref="http"/>
    </root>
</configuration>

Let me know in case you need additional information.

Labels (1)
0 Karma
1 Solution

SNaikwade
Path Finder

I found the answer.

The non-exiting nature of Splunk logging libraries is intentional. So it is expected behavior.
So the workaround is to create a custom middleware class like HttpEventCollectorResendMiddleware.java, in which your completed() method can check that statusCode==200 once all events have been sent. This way you can safely exit your application.

View solution in original post

0 Karma

unitedmarsupial
Path Finder

This is a known bug, which affects all of the mechanisms implemented by the splunk-library-javalogging, not just logback. Here, for example, is the Github issue for a log4j2 part. Fixes, such as this one are offered for the HttpEventCollectorResendMiddleware.java, which would fix all logging methods at once too.

No idea, why this still is not in the released JAR 😞

0 Karma

SNaikwade
Path Finder

I found the answer.

The non-exiting nature of Splunk logging libraries is intentional. So it is expected behavior.
So the workaround is to create a custom middleware class like HttpEventCollectorResendMiddleware.java, in which your completed() method can check that statusCode==200 once all events have been sent. This way you can safely exit your application.

0 Karma

althomas
Communicator

I'm not sure if I understand why the Splunk logging libraries don't exit. My work has been completed -- how is it supposed to shut down gracefully?

arash_jalalian
Explorer

How do you check if all events have been sent? Can you please add you code for HttpEventCollectorResendMiddleware?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...