topic Re: Java Logging Appenders: Why am I getting error "Could not create an Appender of type [com.splunk.logging.TcpAppender]"? in All Apps and Add-ons

Java Logging Appenders: Why am I getting error "Could not create an Appender of type [com.splunk.logging.TcpAppender]"?

simone84 — Thu, 05 Mar 2015 00:46:19 GMT

Hi Everyone,

configuring "SplunkJavaLogging(with backlog)" on a server tomcat7, when I restart it I get the following java error:

16:29:20,152 |-ERROR in ch.qos.logback.core.joran.action.AppenderAction - Could not create an Appender of type [com.splunk.logging.TcpAppender]. ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender
at ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassNameAndParameter(OptionHelper.java:73)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassName(OptionHelper.java:48)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassName(OptionHelper.java:35)
at      at ch.qos.logback.core.joran.action.AppenderAction.begin(AppenderAction.java:54)
at      at ch.qos.logback.core.joran.spi.Interpreter.callBeginAction(Interpreter.java:275)
at      at ch.qos.logback.core.joran.spi.Interpreter.startElement(Interpreter.java:147)
at      at ch.qos.logback.core.joran.spi.Interpreter.startElement(Interpreter.java:129)
at      at ch.qos.logback.core.joran.spi.EventPlayer.play(EventPlayer.java:50)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:149)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:135)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:99)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:76)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:68)
at      at ch.qos.logback.access.tomcat.LogbackValve.startInternal(LogbackValve.java:138)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.StandardPipeline.startInternal(StandardPipeline.java:185)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:1137)
at      at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:816)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1575)
at      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1565)
at      at java.util.concurrent.FutureTask.run(FutureTask.java:262)
at      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at      at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.ClassNotFoundException: com.splunk.logging.TcpAppender
at      at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
at      at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
at      at java.security.AccessController.doPrivileged(Native Method)
at      at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
at      at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
at      at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassNameAndParameter(OptionHelper.java:60)
at      ... 25 common frames omitted
16:29:20,152 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@7:64 - ActionException in Action for tag [appender] ch.qos.logback.core.joran.spi.ActionException: ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender

This is my conf:

logback-access.xml

        <RemoteHost>splunkServer</RemoteHost>
        <Port>5150</Port>
        <layout class="ch.qos.logback.classic.PatternLayout">
        <pattern>%date{ISO8601} [%thread] %level: %msg%n</pattern>
        </layout>
    </appender>

    <logger name="splunk.logger" additivity="false" level="INFO">
        <appender-ref ref="socket"/>
    </logger>

    <root level="INFO">
        <appender-ref ref="socket"/>
    </root>

server.xml

Valve className="ch.qos.logback.access.tomcat.LogbackValve"

LIB:

-rw-r--r-- 1 simoneant simoneant   93525 Apr  2  2014 logback-access-1.1.2.jar
-rw-r--r-- 1 simoneant simoneant  270747 Apr  2  2014 logback-classic-1.1.2.jar
-rw-r--r-- 1 simoneant simoneant  427729 Apr  2  2014 logback-core-1.1.2.jar

Please help me to figure out...

Thanks
Simone

Re: Java Logging Appenders: Why am I getting error "Could not create an Appender of type [com.splunk.logging.TcpAppender]"?

Damien_Dallimor — Thu, 05 Mar 2015 05:47:41 GMT

Caused by: java.lang.ClassNotFoundException: com.splunk.logging.TcpAppender

Clearly you do not have the necessary SplunkJavaLogging classes on your classpath

Re: Java Logging Appenders: Why am I getting error "Could not create an Appender of type [com.splunk.logging.TcpAppender]"?

simone84 — Fri, 06 Mar 2015 23:35:41 GMT

Hi Darmien,

Thanks to helping me to figure out the issue with the logback.
Now during the restart I get these error messages on the console.out:

INFO: Starting Servlet Engine: Apache Tomcat/7.0.59
15:22:37,252 |-INFO in ch.qos.logback.access.tomcat.LogbackValve[localhost] - filename property not set. Assuming [/tomcat7/apache-tomcat-7.0.59/conf/logback-access.xml]
15:22:37,293 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - debug attribute not set
15:22:37,295 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [com.splunk.logging.logback.appender.SplunkRestAppender]
15:22:37,310 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [splunkrawtcp]
15:22:37,600 |-ERROR in com.splunk.logging.logback.appender.SplunkRestAppender[splunkrawtcp] - Couldn't establish REST service for SplunkRestAppender named "splunkrawtcp".
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@31:64 - no applicable action for [logger], current ElementPath is [[configuration][logger]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@32:40 - no applicable action for [appender-ref], current ElementPath is [[configuration][logger][appender-ref]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@36:22 - no applicable action for [root], current ElementPath is [[configuration][root]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@37:33 - no applicable action for [appender-ref], current ElementPath is [[configuration][root][appender-ref]]
15:22:37,606 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - End of configuration.

this is my web.xml. webapps/application/WEB-INF/web.xml

How to generate events to figure out if Splunk logging is really working?

Thanks
Simone

Re: Java Logging Appenders: Why am I getting error "Could not create an Appender of type [com.splunk.logging.TcpAppender]"?

ppablo — Wed, 11 Mar 2015 01:41:39 GMT

Hi @simone84

Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You typed your response in the "Enter your answer here..." box at the very bottom of the page which, instead, posts a brand new answer when it was really meant as a comment. This will help with a clean continuous flow of the conversation.

Your "answer" can no longer be converted to a comment since it is beyond the character limit. If you have a long response and are hitting a character limit when leaving a comment, just break it up into multiple comments. Just something to keep in mind from here on out. Thanks.

Re: Java Logging Appenders: Why am I getting error "Could not create an Appender of type [com.splunk.logging.TcpAppender]"?

simone84 — Wed, 11 Mar 2015 15:17:31 GMT

Hi Darmien,
Now during the restart I get these error messages on the console.out:
15:22:37,293 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - debug attribute not set
15:22:37,295 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [com.splunk.logging.logback.appender.SplunkRestAppender]
15:22:37,310 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [splunkrawtcp]
15:22:37,600 |-ERROR in com.splunk.logging.logback.appender.SplunkRestAppender[splunkrawtcp] - Couldn't establish REST service for SplunkRestAppender named "splunkrawtcp".
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@31:64 - no applicable action for [logger], current ElementPath is [[configuration][logger]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@32:40 - no applicable action for [appender-ref], current ElementPath is [[configuration][logger][appender-ref]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@36:22 - no applicable action for [root], current ElementPath is [[configuration][root]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@37:33 - no applicable action for [appender-ref], current ElementPath is [[configuration][root][appender-ref]]
15:22:37,606 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - End of configuration.

How to generate events to figure out if Splunk logging is really working?
Thanks 1000
Simone