search

serilog-contrib / serilog-sinks-splunk

A Serilog sink that writes to Splunk
https://splunk.com
Apache License 2.0
46 stars 47 forks source link

.Net core 3.1 support #118

Closed ghost closed 3 years ago

ghost commented 4 years ago

Hi,

I am having trouble when using .net core 3.1. There is no error messages or exceptions anywhere that i can see but the logs does not appear in my splunk index. Same setup works fine in .net core 2.1. Any ideas?

Regards Mathias

merbla commented 4 years ago

Hi @mathiasmarin,

An update to target some of the latest framework is ongoing. Is there a particular message of error you are getting.

As mentioned in #117, I have yet to test the sink out with 3.1

If you have some more detail that would be great.

What Splunk Stack are you targeting?

ghost commented 4 years ago

Thanks for your fast reply @merbla.

After further debugging my guess is that it has nothing to do with the actual sink but something else. When i download your package and debug it, the post-request returns HTTP 503 Service Unavailable. I get the same HTTP error when manually creating a httpclient in my own code and doing a post and same error when using curl in the command prompt. Do not understand why it works fine in .Net core 2.1 applications though.

arievansomeren commented 4 years ago

Any news on this? I'm trying to get this working on .net core 3.1 but no luck so far.

HakanL commented 4 years ago

We're using the latest Splunk sink under .NET Core 3.1 and it's working fine sending data to Splunk Cloud. Can you add more details on what the differences are, maybe run fiddler to capture the requests and compare?

shlomysh commented 4 years ago

I have the same issue with core 3.1. and Splunk on Docker (both ubuntu and windows 10) not able to log anything from Serilog.

amedriveroperez1984 commented 4 years ago

Hi, Any progress on this? I have a .NET Core 2.2 API that logs properly to splunk cloud, But using same configuration and setup in .NET Core 3.1 it doesn't show logs in my index.

I'm using WireShark to trace my network and effectively there are some communication between Splunk and my App. But no error, message or nothing that helps to troubleshoot.

HakanL commented 4 years ago

@amedriveroperez1984 Can you compare the wireshark traces between .NET Core 2.2 and 3.1? Maybe attach it here unless it's sensitive? Obviously Splunk doesn't know that you're running 3.1, so there must be some difference in the HTTP request that makes Splunk reject the requests.

amedriveroperez1984 commented 4 years ago

HI Working on it to find does traces. Question: When I use this setup: .WriteTo.EventCollector. How data is sent to Splunk(universal fowarder, HEC Token)?

HakanL commented 4 years ago

@amedriveroperez1984 It should be based on the endpoint you pass in.

amedriveroperez1984 commented 4 years ago

@amedriveroperez1984 Can you compare the wireshark traces between .NET Core 2.2 and 3.1? Maybe attach it here unless it's sensitive? Obviously Splunk doesn't know that you're running 3.1, so there must be some difference in the HTTP request that makes Splunk reject the requests.

I've compared both and looks similar. Unfortunately I can't share the traces. Keep working and let you know if find a solution

amedriveroperez1984 commented 4 years ago

FYI - It wasn't an issue. Was a miss-configuration.

prac92 commented 3 years ago

Hi,

I am having trouble when using .net core 3.1. There is no error messages or exceptions anywhere that I can see but the logs does not appear in my splunk index. Any ideas?

prac92 commented 3 years ago

@amedriveroperez1984 , I am having trouble when using .net core 3.1. There is no error messages or exceptions anywhere that I can see but the logs does not appear in my splunk index. can you please share the issue resolution?

merbla commented 3 years ago

Closing as a part of larger Serilog contrib reorg

Checkout https://github.com/serilog/serilog/issues/1627