Splunk4Net

An appender library for log4net which forward-stores and logs to Splunk

Example app.config:

If you trust the environment your app is deployed to, you can configure splunk4net entirely in your app.config or web.config:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>
    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler,log4net"/>
  </configSections>
  <startup> 
      <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
  </startup>
  <log4net debug="true">
    <appender name="SplunkAppender" type="splunk4net.SplunkAppender,splunk4net">
      <index>splunk4net-test</index>
	  <!-- all config is optional here; however if you don't configure here or
			in code at runtime, you obviously can't expect logging to work -->
	  <!-- configured for a local splunk instance; your url should be different -->
      <remoteUrl>https://localhost:8089</remoteUrl>
      <login>SomeUser</login>
      <password>SomePassword</password>
      <!-- optional: default is true. Forward-stored logs are buffered to a sqlite
			database until they are sent. Disable if you don't care and don't
			want a sqlite database to be generated. The generated database lives
			under ApplicationData\LogBuffer with a name generated by hashing the
			path to your application's entry point -->
      <storeForward>true</storeForward>
      <!-- the buffer store is trimmed when it reaches this size, with older
            items being evicted first. It will only reach this size if log items
            cannot be sent to Splunk: when everything is working as expected, the
            store should be empty between logging times -->
      <maxStore>1024</maxStore>
    </appender>
    <root>
      <level value="DEBUG"/>
      <appender-ref ref="SplunkAppender" />
    </root>
  </log4net>
</configuration>

Example (partial) configuration in code

Sometimes you don't want to leave logins and passwords on deployment machines. So we could configure just the remoteUrl above and, in code:

class Program
{
    static void Main(string[] args)
    {
        ServicePointManager.ServerCertificateValidationCallback = (sender, certificate, chain, errors) => true;

        XmlConfigurator.Configure();
        ManuallyConfigureSplunkAppender();

        // start application logic here
    }

    private static void ManuallyConfigureSplunkAppender()
    {
        // you probably don't want to put sensitive data in some app configs (eg,
        //  on a client app), so you can configure with logic similar to this:
        var heirachy = (Hierarchy) LogManager.GetRepository();
        foreach (var appender in heirachy.Root.Appenders)
        {
            if (appender.Name == "SplunkAppender")
            {
                appender.SetProperty<string>("Login", "admin");
                appender.SetProperty<string>("Password", "P4$$w0rd");
            }
        }
    }
}

public static class ObjectExtensions
{
    public static void SetProperty<T>(this object obj, string propertyName, object value)
    {
        var propInfo = obj.GetType().GetProperty(propertyName);
        if (propInfo == null)
            return;
        if (!typeof (T).IsAssignableFrom(propInfo.PropertyType))
            return;
        propInfo.SetValue(obj, value);
    }
}

Note that the above usage still allows your app to not have to actually reference splunk4net or any of its dependencies. Log4Net will attempt to load it and the dependencies at startup. You will need to ensure that the following assemblies are available in your applications folder:

• splunk4net.dll
• Newtonsoft.Json.dll
• Splunk.Client.dll
• System.Data.Sqlite.dll
• x86/Sqlite.Interop.dll
• x64/Sqlite.Interop.dll

The interop dlls are platform-specific, so if you know for certain your deployment platform, you can include just the one you need. I recommend both though, especially if you compile "AnyCPU"

Storing-forward caveats

Log4Net appears to only configure an appender when it is first required, although the appender is instantiated much earlier. The result of this is that posting to Splunk won't work for appenders configured from app.config until the first log to hit the appender, meaning that any logs buffered from the last session can only be sent to Splunk once at least one log has been attempted in the current session. Even if you configure from code (as above), you still need to kick things off with an initial log. I'd suggest some kind of "the app has just started" log which is a useful thing to see anyway.

Building from source

• If you have Visual Studio, just load up and build.
• If you don't or would prefer to build from the CLI
  • NodeJS (splunk4net uses gulp for the build system)
  • msbuild.exe in your path
  • Nuget.exe in your path