configuration-log4net.tex

\subsection{Log4Net Output Configuration}\label{sec:log4net_out}

The Log4Net configuration is typically limited to modifying the \texttt{cxanalytics.log4net} file to modify the output paths of the
data output files.  The \href{https://logging.apache.org/log4net/release/manual/configuration.html}{Log4Net Manual} explains
how to modify the \texttt{cxanalytix.log4net} file to change how logging output is handled.

\noindent\\One use of Log4Net is for CxAnalytix operational logging output.  This log output is used for monitoring and troubleshooting
how CxAnalytix is operating.  Another use for Log4Net is when the Log4Net Output module is used to write output data to local files.
This is often used with the Splunk Universal Forwarder to integrate with \hyperref[sec:splunk]{Splunk} or another log aggregation
and analysis system.  Appendix section \ref{sec:splunk} describes how Log4Net is configured so that the record name maps configured
as part of the \hyperref[sec:runtime_config]{runtime configuration} write record data to the correct output log file.

\noindent\\The \texttt{CxLogOutput} optional configuration can be used to periodically purge the files created by CxAnalytix As
scans are crawled over time.  It is presumed that the files created are being forwarded for storage, thus can be purged periodically.

\begin{xml}{CxLogOutput}{}{}
<CxLogOutput DataRetentionDays="14" OutputRoot="logs\">
    <PurgeSpecs>
        <spec MatchSpec="*.log.*" />
    </PurgeSpecs>
</CxLogOutput>
\end{xml}
            
\begin{table}[h]
    \caption{CxLogOutput Attributes}        
    \begin{tabularx}{\textwidth}{cccl}
        \toprule
        \textbf{Attribute} & \textbf{Default} & \textbf{Required} & \textbf{Description}\\
        \midrule
        \texttt{DataRetentionDays} & N/A & Yes & \makecell[l]{The maximum number of days a file can be\\
        untouched before purge.}\\
        \midrule
        \texttt{OutputRoot} & N/A & Yes & \makecell[l]{The root folder where logs are written.}\\
        \bottomrule
    \end{tabularx}
\end{table}

\noindent\\The \texttt{PurgeSpecs} element contains one or more \texttt{spec} child elements.  The attribute \texttt{MatchSpec} in each \texttt{spec} element
defines a file mask used for selecting files to purge.  The search for files matching one or more of the specifications are performed recursively
from the root.  Any files found matching one or more of the specifications are purged if the last modified date is older than the value configured
in the \texttt{DataRetentionDays} element.