Skip to content

logback.xml settings reference

logback.xml controls log output behavior for AlpinePKI runtime processes.

Runtime file in packaged distributions:

resources/logback.xml

Syslog appender (SYSLOG)

Setting Default value Description
class ch.qos.logback.classic.net.SyslogAppender Sends logs to a syslog endpoint.
syslogHost 127.0.0.1 Syslog target host. Default sends to local machine.
port 514 Syslog target port.
facility LOCAL0 Syslog facility tag used by downstream rules.
suffixPattern [%thread] %logger{36} [%X{traceId:-}-%X{spanId:-}] - %msg Message payload format appended to each syslog event.

Async appender wrapper (ASYNC_STDOUT)

Setting Default value Description
class ch.qos.logback.classic.AsyncAppender Makes log delivery asynchronous.
queueSize 8192 Max queue depth before pressure handling applies.
discardingThreshold 0 Disables discarding by threshold.
neverBlock true Logging threads do not block when queue is full.
appender-ref SYSLOG Forwards async output to the syslog appender.

Root logger

Setting Default value Description
root level INFO Minimum log level emitted by root logger.
appender-ref ASYNC_STDOUT Binds root logger to async pipeline.

Enable syslog listener on port 514 if disabled

The default appender sends to 127.0.0.1:514. If your syslog daemon is not listening on port 514, enable the listener first.

Example for rsyslog (UDP 514):

sudo tee /etc/rsyslog.d/10-alpine-pki.conf >/dev/null <<'EOF'
module(load="imudp")
input(type="imudp" port="514")
EOF
sudo systemctl restart rsyslog
sudo ss -lun | grep ':514'

Optional TCP listener:

sudo tee /etc/rsyslog.d/10-alpine-pki-tcp.conf >/dev/null <<'EOF'
module(load="imtcp")
input(type="imtcp" port="514")
EOF
sudo systemctl restart rsyslog
sudo ss -ltn | grep ':514'

After changing logback.xml or syslog daemon settings, restart affected AlpinePKI processes.

FAQ

Can I override logback.xml values with CONFIG_FORCE_*?

No. CONFIG_FORCE_* applies to HOCON configuration keys, not Logback XML settings.

Which protocol should I enable on syslog port 514?

Enable UDP first for the default SyslogAppender behavior, then add TCP if your logging policy requires it.