优化 Python SysLogHandler：实现日志发送超时控制

import logging
import logging.handlers
import socket
import sys
import time

# 假设 SyslogServer 和 SyslogPort 是全局变量或配置项
SyslogServer = '127.0.0.1' # 替换为你的Syslog服务器地址
SyslogPort = 514           # 替换为你的Syslog服务器端口

# 定义一个字典来存储logger实例，避免重复创建
loggers = {}

class SysLogHandlerWithTimeout(logging.handlers.SysLogHandler):
    """
    自定义SysLogHandler，用于在socket连接上设置超时。
    """
    def __init__(self, address, socktype=socket.SOCK_DGRAM, timeout=10):
        super(SysLogHandlerWithTimeout, self).__init__(address, socktype)
        self.timeout = timeout

    def createSocket(self):
        """
        重写createSocket方法，在创建socket后设置超时。
        """
        # 调用父类的createSocket方法，创建socket
        super(SysLogHandlerWithTimeout, self).createSocket()
        # 设置socket的超时时间
        if self.socket:
            self.socket.settimeout(self.timeout)
            # print("Socket timeout set to: %s seconds" % self.timeout) # 调试信息

def writeSyslog (mtype, msg):
    """
    发送消息/日志到Syslog服务器
    """
    try:
        global loggers
        logger_name = 'SplunkLogger' # 统一使用一个logger名称

        if logger_name in loggers:
            splunk_logger = loggers.get(logger_name)
        else:
            # 使用我们自定义的带有超时功能的SysLogHandler
            # 注意：这里socktype=socket.SOCK_STREAM是为了TCP连接，与原问题一致
            handler = SysLogHandlerWithTimeout(
                address=(SyslogServer, SyslogPort),
                socktype=socket.SOCK_STREAM,
                timeout=5 # 设置5秒的超时时间
            )
            formatter = logging.Formatter('%(asctime)s %(levelname)s %(message)s')
            handler.setFormatter(formatter)

            splunk_logger = logging.getLogger(logger_name)
            # 确保logger只添加一次handler，避免重复日志
            if not splunk_logger.handlers:
                splunk_logger.addHandler(handler)
            splunk_logger.setLevel(logging.DEBUG) # 设置日志级别
            loggers[logger_name] = splunk_logger

        # 根据mtype发送不同级别的日志
        if "emerg" in mtype:
            splunk_logger.emergency(msg)
        elif "alert" in mtype:
            splunk_logger.alert(msg)
        elif "crit" in mtype:
            splunk_logger.critical(msg)
        elif "err" in mtype:
            splunk_logger.error(msg)
        elif "warn" in mtype:
            splunk_logger.warning(msg)
        elif "notice" in mtype:
            splunk_logger.notice(msg)
        elif "info" in mtype:
            splunk_logger.info(msg)
        else:
            splunk_logger.debug(msg)

    except socket.timeout:
        sys.stdout.write("\t\tSyslog failed due to timeout when sending to %s:%d\n" % (SyslogServer, SyslogPort))
    except socket.error as e:
        sys.stdout.write("\t\tSyslog failed sending to %s:%d - Socket Error: %s\n" % (SyslogServer, SyslogPort, e))
    except Exception as e:
        sys.stdout.write("\t\tSyslog failed sending to %s:%d - General Error: %s\n" % (SyslogServer, SyslogPort, e))

# 示例调用
if __name__ == "__main__":
    print("尝试发送日志到Syslog服务器...")
    # 模拟Syslog服务器不可用（例如，不启动一个服务器监听该端口）
    # 或者启动一个简单的服务器来观察正常情况

    # 正常发送日志
    writeSyslog("info", "这是一条信息日志。")
    time.sleep(1)
    writeSyslog("warn", "这是一条警告日志。")
    time.sleep(1)

    # 模拟服务器无响应（如果服务器不存在或关闭，则会触发超时）
    # 请确保 SyslogServer 和 SyslogPort 指向一个不会响应的地址或端口来测试超时
    print("\n模拟服务器无响应，等待超时...")
    SyslogServer = '127.0.0.1' # 假设这个地址没有Syslog服务器监听
    SyslogPort = 5145 # 假设这个端口没有Syslog服务器监听
    # 需要清除旧的logger handler，以便重新创建带有新地址的handler
    if 'SplunkLogger' in loggers:
        for handler in loggers['SplunkLogger'].handlers[:]:
            loggers['SplunkLogger'].removeHandler(handler)
        del loggers['SplunkLogger']

    start_time = time.time()
    writeSyslog("err", "这是一条错误日志，预期会超时。")
    end_time = time.time()
    print("日志发送尝试结束，耗时：%.2f 秒" % (end_time - start_time))

    # 恢复到可能的正常地址（如果需要）
    SyslogServer = '127.0.0.1'
    SyslogPort = 514
    if 'SplunkLogger' in loggers:
        for handler in loggers['SplunkLogger'].handlers[:]:
            loggers['SplunkLogger'].removeHandler(handler)
        del loggers['SplunkLogger']
    writeSyslog("info", "这是超时后的又一条信息日志。")