Building for the Splunk Platform

How to trace and Exception that is being logged without a message or data

buftucker
Engager

Hi,

I'm running a .NET C# MVC project and using Log4Net to log errors with splunk. In the DEV environment the splunk logs contain all the information from the Exception - exception type, inner exceptions, stack trace etc.. However in PROD environment i'm seeing many events in splunk that are being generated by Log4Net, but there is seemingly no useful information that could help me determine how or where these errors are originating from. None of the logs appear the same as these that are appearing in the PROD environment and I am struggling to reproduce this kind of log in DEV.

As shown in the attached image, these logs say '#### HTTP REQUEST' #### and a regular log looks like the one entry that describes the exception type. Is it possible to glean more information about these mysterious entries?

Splunk events

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Make your system write more useful logs. For example, talk to the people running your production environments about what logging configuration they use compared to the logging configuration you used in development. Find a reasonable middle ground.

Sounds obvious, but that's what it is - you can't pull information from where there is none.

martin_mueller
SplunkTrust
SplunkTrust

Sounds more like a Log4Net problem than a Splunk problem - I can't help you there 😞

buftucker
Engager

Thanks for the reply - unfortunately I am part of the team running the production environment, that's the thing really, my task is trying to find out why we are getting these uninformative logs.

We use Log4Net in prodution and out own Logger in dev an test - we also only use Splunk in production and Logz.io in dev and test. So my first thought was to swap out the dev config with the production config and try to reproduce the log in dev. When I used Log4Net and splunk in dev environment I get the full information from any exception - name, innner message and stack trace etc... So that makes me wonder if the log is even from an exception in the first place.

I have been through the code to look at every place an exception is generated caught and logged but can't seem to track anything that would cause this particular log to get logged.

0 Karma

buftucker
Engager

p.s not all the log events are devoid of information in the production environment - some do contain ample data, so it seems to be coming from a particular case

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...