Question

I need some idea to implement the following requirement in the web application .

I am using log4net in a custom dll to log the errors. I completed the log4net implementation and its working fine.[aspx errors are logged in EventLog and the asp errors are logged in FileAppender] .All the loggerError() methods are in the custom dll.

Now i want to monitor the logging,suppose if there is a situation like the loggerError() method is called more than 20 times in just 5 mins bse of Fatal error or database is down,then i want to track that and send email to admin.

My ideas,

1.Set a timer and count variable to track the number of hits .

2.After each hit check the number of hits and the secs.

3.If it exceeds the threshold limit .then trigger the email…

Not sure how this will work or is there any other way to achieve it.

Thanks in advance

Answer 1

I would suggest writing your own Appender to house this logic. The Appender could be used as a wrapper for another Appender (maybe the SmtpAppender?). The ForwardingAppender looks like a good example of a “wrapper” Appender. As each log message comes in, apply your timing and severity logic. If your criteria are met, forward the message to the “wrapped” Appender.

Alternatively this Appender could contain its own logic for generating and sending email (or whatever notification scheme you would like to use).

This Appender could be configured via the standard log4net configuration mechanism (app.config, separate config, etc) so the time span, error level, error count, could be configurable.

Here is an idea for how something like this might be implemented as an Appender:

public class MultiThresholdNotifyingAppender : AppenderSkeleton
{
  private Queue<LoggingEvent> loggingEventQueue = new Queue<LoggingEvent>();

  private DateTime windowStart;

  public Level LevelThreshold { get; set; }
  public TimeSpan WindowLength { get; set; }
  public int HitThreshold { get; set; }

  public void Append(LoggingEvent loggingEvent)
  {
    if (loggingEvent.Level < LevelThreshold) 
    {
      if (loggingEventQueue.Count == 0) return;

      if (loggingEvent.TimeStamp - windowStart) >= WindowLength)
      {
        //Error level is less than threshold and the time window has elapsed.  Remove any queued LoggingEvents
        //until all LoggingEvents in the queue fall within the time window.
        while (loggingEventQueue.Count > 0 && loggingEventQueue.Peek().TimeStamp - windowStart >= WindowLength)
        {
          loggingEventQueue.Dequeue();
        }

        windowStart = loggingEventQueue.Peek().TimeStamp;

        return;
      }
    }

    //If we got here, then the Error level is >= the threshold.  We want to save the LoggingEvent and we MIGHT
    //want to notify the administrator if the other criteria are met (number of errors within time window).
    loggingEventQueue.Enqueue(loggingEvent);

    //If this is the first error in the queue, start the time window.
    if (loggingEventQueue.Count == 1) windowStart = loggingEvent.TimeStamp;

    //Too few messages to qualify for notification.
    if (loggingEventQueue.Count < HitThreshold - 1) return; 

    //Now we're talking!  A lot of error messages in a short period of time.    
    if (loggingEvent.TimeStamp - windowStart >= WindowLength)
    {
      //Build a notification message for the administrator by concatenating the "rendered" version of each LoggingEvent.
      string message = string.Join(Enviroment.NewLine, loggingEventQueue.Select(le => le.RenderedMessage));
      SendTheMessage(message);
    }

    //After sending the message, clear the LoggingEvents and reset the time window.
    loggingEventQueue.Clear();      
    windowStart = loggingEvent.TimeStamp;
  }

  public void Append(LoggingEvent[] loggingEvents)
  {
    foreach (var le in loggingEvents)
    {
      Append(le);
    }
  }
}

The idea is to configure your threshold (maybe along with your notification method) values on the appender. Configure your loggers to send their messages to this appender, in addition to any other appenders you want to send them to (EventLog, File, etc). As each logging message comes through, this appender can examine it in the context of the configured threshold values and send the notification as necessary.

There could very well be threading issues in this code (unless log4net handles that for you), so you might need a lock when accessing the queue.

Note that this code has not been compiled nor has it been tested.

See this link for some sample custom Appenders in the log4net repository:

http://svn.apache.org/viewvc/logging/log4net/trunk/examples/net/2.0/Appenders/