Splunk Dev

Why isn't the Splunk logger appender terminating? Our Java program keeps running with no exit code.

SNaikwade
Path Finder

We followed the steps in below documentation for "Enable logging to HTTP Event Collector in your Java project".
http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE7M
In our testing, we are seeing that Splunk logger appender is not terminating. Our java program keeps running with no exit code.

Steps to reproduce:
- Import attached code to IntelliJ IDE
- Change http collect token and url in logback.xml
- Run the main java

Unfortunately, I cannot attach files here due to fewer karma points.


here are the files:

test.java

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.splunk.logging.*;

public class test {
    public static void main( String[] args ) {
        System.out.println("This is first");

        Logger logger = LoggerFactory.getLogger("splunk");
        logger.info("This is a test event for Logback test");
        logger.error("This is a test error for Logback test");
        System.out.println("This is second");


    }
}

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <Appender name="http" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
        <url>http://splunkheavyforwarder.dev.aws.away.black:8088</url>
        <token>640D5ED1-4D44-484A-8576-F8BA16746954</token>
        <disableCertificateValidation>true</disableCertificateValidation>
        <layout class="ch.qos.logback.classic.PatternLayout">
            <Pattern>
                %d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n
            </Pattern>
        </layout>
    </Appender>

    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <layout class="ch.qos.logback.classic.PatternLayout">
            <Pattern>
                %d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n
            </Pattern>
        </layout>
    </appender>
    <logger name ="http" level="debug">
        <appender-ref ref="http" />
    </logger>
    <root level="INFO">
        <appender-ref ref="http"/>
    </root>
</configuration>

Let me know in case you need additional information.

Labels (1)
0 Karma
1 Solution

SNaikwade
Path Finder

I found the answer.

The non-exiting nature of Splunk logging libraries is intentional. So it is expected behavior.
So the workaround is to create a custom middleware class like HttpEventCollectorResendMiddleware.java, in which your completed() method can check that statusCode==200 once all events have been sent. This way you can safely exit your application.

View solution in original post

0 Karma

unitedmarsupial
Path Finder

This is a known bug, which affects all of the mechanisms implemented by the splunk-library-javalogging, not just logback. Here, for example, is the Github issue for a log4j2 part. Fixes, such as this one are offered for the HttpEventCollectorResendMiddleware.java, which would fix all logging methods at once too.

No idea, why this still is not in the released JAR 😞

0 Karma

SNaikwade
Path Finder

I found the answer.

The non-exiting nature of Splunk logging libraries is intentional. So it is expected behavior.
So the workaround is to create a custom middleware class like HttpEventCollectorResendMiddleware.java, in which your completed() method can check that statusCode==200 once all events have been sent. This way you can safely exit your application.

0 Karma

althomas
Communicator

I'm not sure if I understand why the Splunk logging libraries don't exit. My work has been completed -- how is it supposed to shut down gracefully?

arash_jalalian
Explorer

How do you check if all events have been sent? Can you please add you code for HttpEventCollectorResendMiddleware?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...