mountaindude
commented
6 months ago Looks like the sample XML Log4net appender file for Engine service is slightly incorrect.
Current file looks like this:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<!-- Generic appender for detecting warnings and errors -->
<appender name="LogEvent" type="log4net.Appender.UdpAppender">
<param name="threshold" value="warn" />
<param name="remoteAddress" value="FQDN or IP of server where Butler SOS is running" />
<param name="remotePort" value="9996" />
<param name="encoding" value="utf-8" />
<layout type="log4net.Layout.PatternLayout">
<converter>
<param name="name" value="rownum" />
<param name="type" value="Qlik.Sense.Logging.log4net.Layout.Pattern.CounterPatternConverter" />
</converter>
<converter>
<param name="name" value="hostname" />
<param name="type" value="Qlik.Sense.Logging.log4net.Layout.Pattern.HostNamePatternConverter" />
</converter>
<converter>
<param name="name" value="longIso8601date" />
<param name="type" value="Qlik.Sense.Logging.log4net.Layout.Pattern.Iso8601TimeOffsetPatternConverter" />
</converter>
<converter>
<param name="name" value="user" />
<param name="type" value="Qlik.Sense.Logging.log4net.Layout.Pattern.ServiceUserNameCachedPatternConverter" />
</converter>
<converter>
<param name="name" value="encodedmessage" />
<param name="type" value="Qlik.Sense.Logging.log4net.Layout.Pattern.EncodedMessagePatternConverter" />
</converter>
<param name="conversionpattern" value="/qseow-engine/;%rownum{9999};%longIso8601date;%date;%level;%hostname;%logger;%user;%encodedmessage;%property{ProxySessionId};%property{ActiveUserDirectory};%property{ActiveUserId};%property{EngineTimestamp};%property{ProcessId};%property{Exe Version};%property{Server Started};%property{Entry Type};%property{SessionId};%property{AppId}" />
</layout>
</appender>
<!-- Send UDP message to Butler SOS on warnings and errors -->
<logger name="Performance">
<appender-ref ref="LogEvent" />
</logger>
<logger name="System">
<appender-ref ref="LogEvent" />
</logger>
<logger name="Session">
<appender-ref ref="LogEvent" />
</logger>
</configuration>Those last lines (for example <logger name="System"> will capture all log events emitted from the System service.
In this context we're however only interested in System.Engine messages.
Changing this will reduce load on Butler SOS somewhat (fewer - but more relevant - messages will be sent from QS server).
Also add code in Butler SOS verifying that fields that are supposed to be UUIDs are in fact that, fields that are supposed to be numeric only are in fact that etc, when creating the InfluxDB datapoints.
What version of Butler SOS are you using?
10.0.0 alfa
What version of Node.js are you using? Not applicable if you use the standalone version of Butler SOS.
20
What command did you use to start Butler SOS?
-
What operating system are you using?
Linux
What CPU architecture are you using?
x86_64
What Qlik Sense versions are you using?
2024-May IR
Describe the Bug
Error
The Log4Net log appenders deployed in Sense server picks up and forwards a log message to Butler SOS that causes errors when written to InfluxDB.
This has not been observed before, so it could be something that is related to a recent upgrade to 2024-May IR. But that is not confirmed. Doesn't really matter, the parsing of incoming UDP messages could use a bit more robustness so they also handle new kinds of messages created by QS Server.
After Butler SOS has parsed the incoming log UDP message from QS server we get this:
Results in Butler SOS error when trying to write the datapoint to InfluxDB:
error: LOG EVENT INFLUXDB 1: Error saving log event to InfluxDB! Error: A 400 Bad Request error occurred: {"error":"unable to parse 'Possible causes
app_idtag is parsed very incorrectly.raw_eventfield may also be too complex for InfluxDB to handle, contain some invalid char (from an InfluxDB perspective) or similar.****Expected Behavior
No response
To Reproduce
No response