Default `protocol` to UDP in the Log4j 1 `SyslogAppender` builder

[ppkarwasz]

SyslogAppenderBuilder currently defaults protocol to TCP. Log4j 1's org.a.l.net.SyslogAppender only ever supported UDP, and protocol has no counterpart in the Log4j 1 configuration format: it is a bridge extension.

This matters beyond fidelity. Over UDP the datagram boundary is the record boundary, so no character in the message requires escaping. Over TCP with RFC 6587 non transparent framing, LF is the record delimiter, and Log4j1SyslogLayout provides no mechanism to escape it. Defaulting to TCP therefore silently places legacy configurations on a transport the ported layout was never written for.

Proposed changes:

• Default protocol to UDP when the appender is built from a Log4j 1 configuration, matching Log4j 1 behaviour.
• Document protocol explicitly as a log4j-1.2-api extension, and note that non-UDP values are not recommended because Log4j1SyslogLayout does not escape newlines.
• Consider emitting a status logger warning when protocol is set to a stream transport.

All users should migrate away from a Log4j 1 configuration, but in particular users needing structured syslog over a framed transport should migrate to a Log4j 2 configuration and Rfc5424Layout, which implements newline escaping.

This was reported by @August829.

[DragonFSKY]

Hi, I’d like to work on this. I’ll update the XML and properties defaults to UDP, keep explicit protocol handling unchanged, and add focused regression coverage and migration documentation.

[ppkarwasz]

Hi @DragonFSKY, the issue is yours, thanks!