All Apps and Add-ons

Java Logging Appenders: Why am I getting error "Could not create an Appender of type [com.splunk.logging.TcpAppender]"?

simone84
New Member

Hi Everyone,

configuring "SplunkJavaLogging(with backlog)" on a server tomcat7, when I restart it I get the following java error:

16:29:20,152 |-ERROR in ch.qos.logback.core.joran.action.AppenderAction - Could not create an Appender of type [com.splunk.logging.TcpAppender]. ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender
at ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassNameAndParameter(OptionHelper.java:73)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassName(OptionHelper.java:48)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassName(OptionHelper.java:35)
at      at ch.qos.logback.core.joran.action.AppenderAction.begin(AppenderAction.java:54)
at      at ch.qos.logback.core.joran.spi.Interpreter.callBeginAction(Interpreter.java:275)
at      at ch.qos.logback.core.joran.spi.Interpreter.startElement(Interpreter.java:147)
at      at ch.qos.logback.core.joran.spi.Interpreter.startElement(Interpreter.java:129)
at      at ch.qos.logback.core.joran.spi.EventPlayer.play(EventPlayer.java:50)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:149)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:135)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:99)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:76)
at      at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:68)
at      at ch.qos.logback.access.tomcat.LogbackValve.startInternal(LogbackValve.java:138)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.StandardPipeline.startInternal(StandardPipeline.java:185)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:1137)
at      at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:816)
at      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1575)
at      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1565)
at      at java.util.concurrent.FutureTask.run(FutureTask.java:262)
at      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at      at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.ClassNotFoundException: com.splunk.logging.TcpAppender
at      at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
at      at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
at      at java.security.AccessController.doPrivileged(Native Method)
at      at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
at      at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
at      at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
at      at ch.qos.logback.core.util.OptionHelper.instantiateByClassNameAndParameter(OptionHelper.java:60)
at      ... 25 common frames omitted
16:29:20,152 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@7:64 - ActionException in Action for tag [appender] ch.qos.logback.core.joran.spi.ActionException: ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type com.splunk.logging.TcpAppender

This is my conf:

logback-access.xml

        <RemoteHost>splunkServer</RemoteHost>
        <Port>5150</Port>
        <layout class="ch.qos.logback.classic.PatternLayout">
        <pattern>%date{ISO8601} [%thread] %level: %msg%n</pattern>
        </layout>
    </appender>

    <logger name="splunk.logger" additivity="false" level="INFO">
        <appender-ref ref="socket"/>
    </logger>

    <root level="INFO">
        <appender-ref ref="socket"/>
    </root>

server.xml

Valve className="ch.qos.logback.access.tomcat.LogbackValve"

LIB:

-rw-r--r-- 1 simoneant simoneant   93525 Apr  2  2014 logback-access-1.1.2.jar
-rw-r--r-- 1 simoneant simoneant  270747 Apr  2  2014 logback-classic-1.1.2.jar
-rw-r--r-- 1 simoneant simoneant  427729 Apr  2  2014 logback-core-1.1.2.jar

Please help me to figure out...

Thanks
Simone

Tags (1)
0 Karma

simone84
New Member

Hi Darmien,

Thanks to helping me to figure out the issue with the logback.
Now during the restart I get these error messages on the console.out:

INFO: Starting Servlet Engine: Apache Tomcat/7.0.59
15:22:37,252 |-INFO in ch.qos.logback.access.tomcat.LogbackValve[localhost] - filename property not set. Assuming [/tomcat7/apache-tomcat-7.0.59/conf/logback-access.xml]
15:22:37,293 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - debug attribute not set
15:22:37,295 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [com.splunk.logging.logback.appender.SplunkRestAppender]
15:22:37,310 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [splunkrawtcp]
15:22:37,600 |-ERROR in com.splunk.logging.logback.appender.SplunkRestAppender[splunkrawtcp] - Couldn't establish REST service for SplunkRestAppender named "splunkrawtcp".
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@31:64 - no applicable action for [logger], current ElementPath is [[configuration][logger]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@32:40 - no applicable action for [appender-ref], current ElementPath is [[configuration][logger][appender-ref]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@36:22 - no applicable action for [root], current ElementPath is [[configuration][root]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@37:33 - no applicable action for [appender-ref], current ElementPath is [[configuration][root][appender-ref]]
15:22:37,606 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - End of configuration.

this is my web.xml. webapps/application/WEB-INF/web.xml

alt text

How to generate events to figure out if Splunk logging is really working?

Thanks
Simone

0 Karma

ppablo
Community Manager
Community Manager

Hi @simone84

Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You typed your response in the "Enter your answer here..." box at the very bottom of the page which, instead, posts a brand new answer when it was really meant as a comment. This will help with a clean continuous flow of the conversation.

Your "answer" can no longer be converted to a comment since it is beyond the character limit. If you have a long response and are hitting a character limit when leaving a comment, just break it up into multiple comments. Just something to keep in mind from here on out. Thanks.

0 Karma

Damien_Dallimor
Ultra Champion
Caused by: java.lang.ClassNotFoundException: com.splunk.logging.TcpAppender

Clearly you do not have the necessary SplunkJavaLogging classes on your classpath

0 Karma

simone84
New Member

Hi Darmien,
Now during the restart I get these error messages on the console.out:
15:22:37,293 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - debug attribute not set
15:22:37,295 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [com.splunk.logging.logback.appender.SplunkRestAppender]
15:22:37,310 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [splunkrawtcp]
15:22:37,600 |-ERROR in com.splunk.logging.logback.appender.SplunkRestAppender[splunkrawtcp] - Couldn't establish REST service for SplunkRestAppender named "splunkrawtcp".
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@31:64 - no applicable action for [logger], current ElementPath is [[configuration][logger]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@32:40 - no applicable action for [appender-ref], current ElementPath is [[configuration][logger][appender-ref]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@36:22 - no applicable action for [root], current ElementPath is [[configuration][root]]
15:22:37,606 |-ERROR in ch.qos.logback.core.joran.spi.Interpreter@37:33 - no applicable action for [appender-ref], current ElementPath is [[configuration][root][appender-ref]]
15:22:37,606 |-INFO in ch.qos.logback.access.joran.action.ConfigurationAction - End of configuration.

How to generate events to figure out if Splunk logging is really working?
Thanks 1000
Simone

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.