[ https://issues.jboss.org/browse/WFCORE-1647?page=com.atlassian.jira.plugi... ] Jan Tymel updated WFCORE-1647: ------------------------------ Steps to Reproduce: 1. Configure Audit Logging to log into (local) rsyslog and start server {code} <audit-log> <formatters> <json-formatter name="json-formatter"/> </formatters> <handlers> <file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/> <syslog-handler name="syslog-handler" formatter="json-formatter"> <udp host="127.0.0.1" port="514"/> </syslog-handler> </handlers> <logger log-boot="true" log-read-only="false" enabled="true"> <handlers> <handler name="file"/> <handler name="syslog-handler"/> </handlers> </logger> </audit-log> {code} 2. Look into /var/log/messages file Note: the brackets must be escaped, JIRA doesn't allow me to stress it. Brackets {{[, ]}} used in {{grep}} command should be always preceded by a backslash {{sudo grep "WildFly\[Core\]" /var/log/messages}} - there should be a few occurrences {{sudo grep "WildFlyCore\[" /var/log/messages}} - there should be no occurences 3. Stop server, change configuration to use {{app-name}} without space character and start it again {code} <audit-log> <formatters> <json-formatter name="json-formatter"/> </formatters> <handlers> <file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/> <syslog-handler name="syslog-handler" formatter="json-formatter" app-name="WildFlyCore"> <udp host="127.0.0.1" port="514"/> </syslog-handler> </handlers> <logger log-boot="true" log-read-only="false" enabled="true"> <handlers> <handler name="file"/> <handler name="syslog-handler"/> </handlers> </logger> </audit-log> {code} 4. Look into /var/log/messages file again Note: the brackets must be escaped, JIRA doesn't allow me to stress it. Bracket {{[}} used in {{grep}} command should be always preceded by a backslash {{sudo grep "WildFlyCore\[" /var/log/messages}} - there should be a few occurrences (that contains PID) now was: 1. Configure Audit Logging to log into (local) rsyslog and start server {code} <audit-log> <formatters> <json-formatter name="json-formatter"/> </formatters> <handlers> <file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/> <syslog-handler name="syslog-handler" formatter="json-formatter"> <udp host="127.0.0.1" port="514"/> </syslog-handler> </handlers> <logger log-boot="true" log-read-only="false" enabled="true"> <handlers> <handler name="file"/> <handler name="syslog-handler"/> </handlers> </logger> </audit-log> {code} 2. Look into /var/log/messages file Note: the brackets must be escaped, JIRA doesn't allow me to stress it. Brackets {{[, ]}} used in {{grep}} command should be always preceded by a backslash {{sudo grep "WildFly\[Core\]" /var/log/messages}} - there should be a few occurrences {{sudo grep "WildFlyCore\[" /var/log/messages}} - there should be no occurences 3. Stop server, change configuration to use {{app-name}} without space character and start it again {code} <audit-log> <formatters> <json-formatter name="json-formatter"/> </formatters> <handlers> <file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/> <syslog-handler name="syslog-handler" formatter="json-formatter" app-name="WildFlyCore"> <udp host="127.0.0.1" port="514"/> </syslog-handler> </handlers> <logger log-boot="true" log-read-only="false" enabled="true"> <handlers> <handler name="file"/> <handler name="syslog-handler"/> </handlers> </logger> </audit-log> {code} 4. Look into /var/log/messages file again Note: the brackets must be escaped, JIRA doesn't allow me to stress it. Bracket {{[}} used in {{grep}} command should be always preceded by a backslash {{sudo grep "JBossEAP\[" /var/log/messages}} - there should be a few occurrences (that contains PID) now -- This message was sent by Atlassian JIRA (v6.4.11#64026)