logging-log4net-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Nicko Cadell" <ni...@neoworks.com>
Subject RE: Threshold vs. Filter vs. Evaluator
Date Sat, 10 Sep 2005 18:05:33 GMT
 
> Nicko, what is the difference between threshold and evaluator?
> 
>  <evaluator type="log4net.Core.LevelEvaluator">
>   <threshold value="ERROR"/>
>  </evaluator>
> 
>  <threshold value="ERROR" />
> 
> Does one discard messages sooner than the other?

The threshold is different to the evaluator.

<threshold value="ERROR" />

The Threshold is implemented in the AppenderSkeleton and therefore supported by almost all
appenders. It is just a simple test that is used to ignore logging events that have a level
below the threshold. The threshold is checked early and as a simple test is very performant.

There is another way to specify the same behaviour as the threshold using filters. Filters
are very much more flexible and as they are pluggable you can also develop your own custom
logic and insert it into the filter chain.

<filter type="log4net.Filter.LevelRangeFilter">
    <levelMin value="ERROR" />
    <levelMax value="OFF" />
</filter>

Like the Threshold check Filters are implemented in the AppenderSkelton base class and are
supported by almost all appenders. The above filter has the same effect as <threshold value="ERROR"
/>. It is a LevelRangeFilter that will allow through any events with a level in the range
ERROR to OFF (inclusive). Note that OFF is the name of the highest level, conversely ALL is
the name of the lowest level.

Filters have a great deal of flexibility because multiple filters can be chained together
to provide fine grained control over the events that are output. Because of this they also
have a higher cost in terms of performance, each filter in the chain is an object and is asked
to decide on the correct course of action. In the simple case of the threshold filtering the
Threshold property should be used in preference to a filter.


The Evaluator is implemented by the BufferingAppenderSkeleton and is therefore only supported
by appenders that extend this base class and provide support for buffering. The SmtpAppender
is one such appender.

The Evaluator is a pluggable object that is used by the BufferingAppenderSkeleton to determine
if a logging event should not be buffered, but instead written/sent immediately. If the Evaluator
decides that the event is important then the whole contents of the current buffer will be
sent along with the event. The evaluator does not function like the threshold or a filter
in that it does not discard events. 

Typically an SmtpAppender will be setup to buffer events before sending as the cost of sending
an email may be relatively high. If an important event arrives, say an ERROR, we would like
this to be delivered immediately rather than waiting for the buffer to become full. This is
where the Evaluator comes in as it allows us to say: "when an important event arrives don't
worry about buffering, just send over everything you have right now".

How an important event is identified is customisable. The only built-in implementation is
the log4net.Core.LevelEvaluator that check the level value.


The BufferingAppenderSkeleton has various properties that allow more complex behaviour. Principally
the Lossy flag. This tells the appender what to do when the buffer is full. 
If Lossy is false then the appender will send the contents of the buffer once it becomes full.
In this mode the appender is essentially buffering.
If Lossy is true and the buffer is full then the appender will discard the oldest event in
the buffer when a new event is received. In this mode the appender is functioning as a leaky
bucket for events. How is this useful? Well the Evaluator still functions and when an important
event arrives the whole of the current buffer is sent, for example you can set this up to
capture the events that precede an error. If the evaluator is triggered by an Error event
then the buffer would be filled with all the lower level events received before the Error
(up to the BufferSize). This can be very useful in diagnosing an error condition and also
prevents your logs from becoming too big.


Cheers,
Nicko


> 
> --- Shireesh Thanneru <thanneru@yahoo.com> wrote:
> 
> > Try using the applying the following level filter to achieve that:
> > 
> > <filter type="log4net.Filter.LevelRangeFilter">
> >     <levelMin value="ERROR" />
> >     <levelMax value="FATAL" />
> > </filter>
> > 
> > Use the above filter filter element in your SmtpAppender 
> configuration 
> > and see.
> > 
> > Thanks,
> > 
> > Shireesh Thanneru
> > 
> > --- Farid LAOUFI <faridlaoufi@gmail.com> wrote:
> > 
> > > Hello,
> > > I'm doing a windows service which uses a SmtpAppender and an 
> > > EventLogAppender. The EventLogAppender logs all messages which
> > level
> > > is
> > > greater or equal to DEBUG, the SmtpAppender all messages which
> > level
> > > is
> > > greater or equal to ERROR. Now if I try this :
> > > 
> > > ILog logger = LogManager.GetLogger(this.GetType());
> > > logger.Info("Info 1");
> > > logger.Info("Info 2");
> > > logger.Error("ERROR !!!!!!!");
> > > 
> > > I receive a mail message which contains :
> > > 
> > > Info 1
> > > Info 2
> > > ERROR !!!!!!!
> > > 
> > > but I'd like only :
> > > 
> > > ERROR !!!!!!!
> > > 
> > > Can you help me please ? Here a part of my App.config :
> > > 
> > > <!-- Informations requises par log4net. --> <log4net>
> > > 
> > > <appender name="EventLogAppender"
> > > type="log4net.Appender.EventLogAppender" > <applicationName 
> > > value="Serveur AP+" /> <logName value="APPlus" /> <layout 
> > > type="log4net.Layout.PatternLayout">
> > > <conversionPattern value="%message%newline%exception" /> 
> </layout> 
> > > </appender>
> > > 
> > > <appender name="SmtpAppender" 
> type="log4net.Appender.SmtpAppender">
> > > <to value="*************" /> <!-- Liste des adresses e-mail 
> > > (séparateur :
> > > point-virgule) auxquelles seront envoyées les erreurs survenues.
> > -->
> > > <from value="*************" />
> > > <subject value="[AP+] Une erreur est survenue" /> <smtpHost 
> > > value="*************" /> <bufferSize value="512" /> <lossy 
> > > value="false" /> <evaluator type="log4net.Core.LevelEvaluator">
> > > <threshold value="ERROR"/>
> > > </evaluator>
> > > <layout type="log4net.Layout.PatternLayout">
> > > <conversionPattern value="%message%newline%exception" /> 
> </layout> 
> > > </appender>
> > > 
> > > <root>
> > > <level value="DEBUG" />
> > > <appender-ref ref="EventLogAppender" /> <appender-ref 
> > > ref="SmtpAppender" /> </root>
> > > 
> > > <!-- Ceci permet de désactiver le logging des messages 
> provenant de
> > 
> > > NHibernate. -->
> > > <logger name="NHibernate">
> > > <level value="OFF" />
> > > </logger>
> > > 
> > > </log4net>
> > > 
> > 
> > 
> 
> 
> 

Mime
View raw message