Log4Net LevelEvaluator Ignored when bufferSize greater than 1 for SmtpAppender

Question

I have configured log4net with a RollingLogFileAppender and a SmtpAppender, with the intention of logging the DEBUG level to the RollingLogFileAppender and FATAL only to the SmtpAppender:

<appender name="SmtpAppender" type="log4net.Appender.SmtpAppender">
  <to value="[email protected]" />
  <from value="[email protected]" />
  <subject value="Fatal Error" />
  <smtpHost value="smtp.test.com" />
  <SMTPPort value="366"/>
  <Username value="[email protected]"/>
  <Password value="password"/>      
  <bufferSize value="1" />
  <lossy value="true" />
  <evaluator type="log4net.Core.LevelEvaluator">
    <threshold value="FATAL"/>
  </evaluator>      
  <layout type="log4net.Layout.PatternLayout">
  <conversionPattern value="%date [%thread] %-5level %logger [%ndc] - %message%newline"                             />
  </layout>
</appender>

<root>
  <level value="DEBUG" />
  <appender-ref ref="RollingLogFileAppender" />
  <appender-ref ref="SmtpAppender" />
</root>

This works perfectly until I increase the bufferSize. When I do this, all levels are sent via email and the log4net.Core.LevelEvaluator seems to be ignored. I have also tried using LevelRangeFilter and LevelMatchFilter but with these configured I seem to get no emails at all.

Answer 1

The evaluator is not ignored, but it does not do what you expect: Your settings instruct the appender to put all log messages on a buffer and send an email only when a message with level FATAL is logged. If the buffer is full then the oldest messages are discarded (that is the lossy setting; without it you would also get an email as soon as the buffer is full).

If you want to filter the messages then you need to use a filter. For instance like this:

<filter type="log4net.Filter.LevelMatchFilter">
   <acceptOnMatch value="true" />
   <levelToMatch  value="FATAL" />
</filter>
<filter type="log4net.Filter.DenyAllFilter" />

I am not sure though if I would consider my mail appender like this since I would want to get notified immediately if my application has a problem that it needs to log it with level FATAL.