Logging

This section describes how logging works in the solution.

The solution uses the Log4j2 library to manage logging. Each component of the solution has different loggers. The configuration file is located in the [installation directory]/etc folder and is called log4j2.xml.

Server Logging

For the server, by default, the application comes with several loggers:

• wrapper-log : logger that captures the application console messages.
• server-log : logger that writes what happens on the server.
• extension-log : logger that writes what happens during the execution of various extensions.
• audit-log : logger that writes different audit events.
• transfer-log : logger that writes file transfers.
• task-log : logger that writes the current state of the task scheduler.
• configurator-log : logger that writes the administration console events.

Gateway Logging

For the gateway, by default, the application comes with several loggers:

• gateway-log : logger that writes what happens on the gateway.
• gui-log : logger that writes what happens in the web interface.

Using the Elastic Common Schema (ECS) Format

Starting from version 4.20.7 of the solution, it is possible to use the ECS (Elastic Common Schema) format. This improvement is designed to modernize how logs are collected, analyzed, and used, providing you with better visibility into your application's performance and events. Note that it is entirely possible to use both the traditional logging system and the new ECS-based system in parallel.

What is the ECS format?

The ECS format is an open specification that provides a common set of data fields for logging. By relying on this standardized schema, all types of log data (application logs, metrics, security events) can be structured consistently.

The benefits:

Simplified analysis and correlation: The ECS format eliminates the complexity of log analysis by ensuring that critical data such as timestamps, severity levels, messages, and exception information are always located at the same standard positions. This facilitates aggregation, search, and analysis of your logs, regardless of their type or source.

Seamless integration with the Elastic ecosystem: If you use tools like Elasticsearch, Kibana, or Elastic Stack, adopting the ECS format will allow you to benefit from almost instant plug-and-play integration. You will thus be able to use advanced visualization, search, and analysis features without having to configure complex ingestion pipelines.

Improved visibility and problem resolution: By normalizing the structure of your logs, it becomes much simpler to correlate events that come from different parts of your system. For example, you can quickly link a security event to a specific application log or performance trace, thus accelerating problem detection and resolution.

Here is an example of a Log4j.xml file that allows generating logs in ECS format:

<?xml version="1.0" encoding="UTF-8"?>
<Configuration monitorinterval="30" status="info" strict="true">
    <Appenders>
        <RollingFile name="server-log" fileName="logs/server.jsonl" filePattern="logs/server-%d{yyyy-MM-dd}.jsonl">
            <JsonTemplateLayout eventTemplateUri="classpath:sfiler-ecs-layout.json"/>
            <Policies>
                <SizeBasedTriggeringPolicy size="256MB"/>
            </Policies>
            <DefaultRolloverStrategy max="10"/>
        </RollingFile>

        <!-- The logger for the Task Logger. This is a dedicated logger to have a view over the pending Tasks to be executed. -->
        <RollingFile name="task-log" fileName="logs/tasks.log" filePattern="logs/tasks-%d{yyyy-MM-dd}.log">
            <ThresholdFilter level="DEBUG"/>
            <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss},%m%n"/>
            <Policies>
                <SizeBasedTriggeringPolicy size="1000KB"/>
            </Policies>
            <DefaultRolloverStrategy max="100"/>
        </RollingFile>
    </Appenders>
    <Loggers>
        <Root level="INFO">
            <AppenderRef ref="server-log"/>
        </Root>

        <!-- Common loggers used in S-Filer that may have levels different than the root -->
        <Logger name="extlogger" level="INFO"/>

        <Logger name="AUDIT" level="INFO"/>

        <!-- The logger for the TransferLogging extension. It was previously defined in its own configuration file in the etc/extension folder. -->
        <Logger name="com.sfiler.extension.commons.TransferLoggingExtension" level="INFO"/>

        <!-- The logger for the Task Logger. This is a dedicated logger to have a view over the pending Tasks to be executed. -->
        <Logger name="task-log" level="DEBUG" additivity="false">
            <AppenderRef ref="task-log"/>
        </Logger>

        <!-- log4jdbc2 logger -->
        <logger name="log4jdbc.log4j2" level="OFF">
            <MarkerFilter marker="LOG4JDBC_OTHER" onMatch="DENY" onMismatch="NEUTRAL"/>
        </logger>

        <!-- other loggers -->
        <Logger name="org.apache.axis.enterprise" level="INFO"/>
        <Logger name="net.sf.jasperreports.engine.util.JRStyledTextParser" level="OFF"/>
        <logger name="liquibase.executor.jvm.JdbcExecutor" level="OFF"/>
        <Logger name="com.azure.core.util.serializer.SerializerEncoding" level="OFF"/>

    </Loggers>
</Configuration>

References

• Log4j2 RollingFile Appender
• ECS