External apps: Log4JXml target for Sentinel LogViewer

[boexler]

External apps: Log4JXml target for Sentinel LogViewer

Background

Starting with NLog 6, the Log4JXml UDP target is no longer in the core NLog package; it lives in NLog.Targets.Network.

Sentinel LogViewer receives and parses Log4J XML (UDP and files). External applications should be able to stream logs over UDP to the viewer, similar to the test app in this repo.

References in this repository:

• Package: NLog.Targets.Network (e.g. 6.0.0 in Sentinel.LogViewer.TestApp)
• Sample nlog.config: testapp/Sentinel.LogViewer.TestApp/nlog.config (xsi:type="Log4JXml", address="udp://…")
• Programmatic setup: app/Sentinel.LogViewer.TestLogging/NLogTestLoggingConfig.cs

NLog 5 → 6: Many setups used Chainsaw; on NLog 6 use Log4JXml (format remains compatible with the viewer).

Product idea (automation)

We are considering having our own software support this rollout on already deployed systems:

• Discover existing installations that use NLog (or are candidates for LogViewer integration) on a machine or in a defined scope.
• Detect whether the Log4JXml / network logging setup is already present (NLog.Targets.Network, nlog.config target, logger rules, UDP endpoint).
• If missing, apply the necessary changes in a controlled way: add the NuGet package (or equivalent deployment dependency) and extend or update nlog.config (and related config) so the Log4JXml target points at the LogViewer.

This would reduce manual hunting across servers and repos and keep behavior consistent. Details (permissions, idempotency, rollback, NLog 5 vs 6) are still to be defined.

Goal (manual / process track)

1. Find deployments that use NLog and should feed the LogViewer (dev/test/prod).
2. Check whether NLog.Targets.Network is missing (NLog 6 + Log4JXml in config or code).
3. Add the matching package version (aligned with the main NLog package).
4. Update nlog.config (or code-based config): Log4JXml target, UDP address/port (e.g. viewer default), logger rules.

Proposed approach

• Define search criteria: servers, deploy artifacts, repos; signals (NLog, nlog.config, Chainsaw/Log4JXml, NLog version).
• Build an inventory of affected apps and environments.
• Per app: NLog version, current targets, missing dependency?
• Change: PackageReference / packages.config + config snippet (including extensions if required).
• Smoke test: UDP to LogViewer; events visible (level, app name, optional call site).
• One-time ops/dev documentation.
• Automation spike: discovery + “add target if absent” prototype; safety checks and audit log.

Open questions

• Default UDP host/port per environment?
• NLog 6 migration only, or keep NLog 5 (Chainsaw) where it still runs?
• Rollout: manual vs. script/CI vs. built-in installer/updater?
• What may the tool modify (config only vs. binaries/packages)? Admin rights? Backup before change?
• Firewall/permissions for UDP to the viewer?

Success criteria

Affected applications send Log4J XML over UDP; LogViewer shows events without viewer-side changes. Where automation is used, rediscovery does not duplicate targets and failed changes are visible and reversible.