I think the general outline to this would be (but I haven't done this, and I stand to be corrected).

1. Write a custom LOG4j Appender  :

Write custom appenders for log4j | JavaWorld

java - How to create a own Appender in log4j? - Stack Overflowhttp://www.javaworld.com/article/2073104/learn-java/write-custom-appenders-for-log4j.html

This is probably where you are going to put the logic to examine the special string within the Logging Event - and decide whether to Log it, or throw it away.

You can filter 'higher-up' in log4j - but only ( I believe ) based on CATEGORY / LEVEL (like info,debug) - I don't believe (I could be wrong*) you can filter on any arbitary field within the Logging Event....

If you are logging to a file - you might be able to extend an existing File Appender - rather than having to re-implement the whole thing from scratch.

2. Package the compiled Appender into a JAR file.

3. Upload JAR to PRPC.

4. Edit your PRCONFIG.XML to configure your appender.

AES uses a similar approach here - so you can use the following as a guide here - you would replace the classnames for your custom appender:

<appender name="ALERT-AES-SOAP" class="com.pega.pegarules.priv.util.SOAPAppenderPega">
        <param name="EndPointURL" value="http://localhost:8888/prweb/PRSOAPServlet" />
        <param name="Mode" value="ALERT" />
        <layout class="com.pega.apache.log4j.PatternLayout">
            <param name="ConversionPattern" value="%m%n" />
        </layout>
    </appender>

So my areas of uncertainty (my "known unknowns" :-| ) are:

1.  Since PRPC uses a extended / repackaged version of LOG4J - would a standard log4j APPENDER work OOTB ? Or do you have to extend the PRPC version of the Appender ?

EDIT: I had a sneaky look at the source code of the SOAPAppenderPega; it does this:

//
package com.pega.pegarules.priv.util;
import com.pega.apache.log4j.AppenderSkeleton;
[...]
public class SOAPAppenderPega extends AppenderSkeleton {
[...]
//

So probably you *could* extend the same PRPC class...whether this is the right thing to do is another question.... :-)

2. I assume it would be the right thing to upload the Appender Code to the DB...maybe you could (and maybe should?) package this as external JAR ?

* Possibly LOG4j 'Filters' could provide you a mechanism here....I have never used them - but maybe they could be used instead of you implemented the logic yourself ? dunno  : https://logging.apache.org/log4j/2.0/manual/filters.html

EDIT2: Looks like you might be able to get away with not even having to implement an Appender to this - you might be able to configure an 'ExpressionFilter' right in your prlogging.xml....

See this link : http://blog.trifork.com/2011/08/23/filtering-specific-exceptions-when-using-log4j/

and this one : http://logging.apache.org/log4j/companions/apidocs/org/apache/log4j/filter/ExpressionFilter.html

I haven't tried this yet myself.....

Here what we have done for this.

we have edited prlogging.xml and created custom appender

<appender-ref ref="CONSOLE"/>  pega default

  <appender-ref ref="PEGA"/>      pega default

  <appender-ref ref="Test-Log"/>  custom

Then we log in the file using string match

<appender name="Test-Log" class="com.pega.pegarules.priv.util.DailySizeRollingFileAppenderPega">

  <param name="FileNamePattern" value="'${test.location}/Testlog-${logging.clusterId}-'"/>

            <param name="MaxFileSize" value="512000KB"/>

<layout class="com.pega.apache.log4j.PatternLayout">

<param name="ConversionPattern" value="%d [%20.20t] [%10.10X{pegathread}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n"/>

</layout>

<filter class="com.pega.apache.log4j.varia.StringMatchFilter">

<param name="StringToMatch" value="Entering activity"/>

<param name="AcceptOnMatch" value="true"/>

</filter>

<filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

<param name="LevelToMatch" value="FATAL"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

<filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

<param name="LevelToMatch" value="ALERT"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

<filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

<param name="LevelToMatch" value="INFO"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

<filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

<param name="LevelToMatch" value="ERROR"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

</appender>

make sure you disable StringMatch in other appenders if you dont want to log in those files

<filter class="com.pega.apache.log4j.varia.StringMatchFilter">

<param name="StringToMatch" value="Entering activity"/>

<param name="AcceptOnMatch" value="false"/>

${logging.clusterId}  and ${test.location} are websphere variables for location and to write seperate log file for each node

So when you log you have to add the string Entering activity in log message , the it will be logged in this file.

The Class you are using is the problem. here is the working logging.xml which we are using.

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">

<log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/" debug="false">

  <appender name="ASYNC" class="com.pega.apache.log4j.AsyncAppender">

  <param name="BufferSize" value="1024"/>

  <param name="Blocking" value="false"/>

  <filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

  <param name="LevelToMatch" value="ALERT"/>

  <param name="AcceptOnMatch" value="false"/>

  </filter>

  <appender-ref ref="CONSOLE"/>

  <appender-ref ref="PEGA"/>

  <appender-ref ref="Test"/>

  </appender>

  <appender name="ALERT-ASYNC" class="com.pega.apache.log4j.AsyncAppender">

  <param name="BufferSize" value="512"/>

  <param name="Blocking" value="false"/>

  <filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

  <param name="LevelToMatch" value="ALERT"/>

  <param name="AcceptOnMatch" value="true"/>

  </filter>

  <filter class="com.pega.apache.log4j.varia.DenyAllFilter"/>

  <appender-ref ref="ALERT-PERFORMANCE"/>

  <appender-ref ref="ALERT-SECURITY"/>

  </appender>

  <appender name="ALERT-PERFORMANCE" class="com.pega.apache.log4j.AsyncAppender">

  <param name="BufferSize" value="512"/>

  <param name="Blocking" value="false"/>

  <filter class="com.pega.pegarules.priv.MDCMatchFilter">

  <param name="TagToMatch" value="alertType" />

  <param name="StringToMatch" value="security" />

  <param name="AcceptOnMatch" value="false"/>

  </filter>

  <appender-ref ref="ALERT"/>

  </appender>

  <appender name="ALERT-SECURITY" class="com.pega.apache.log4j.AsyncAppender">

  <param name="BufferSize" value="512"/>

  <param name="Blocking" value="false"/>

  <filter class="com.pega.pegarules.priv.MDCMatchFilter">

  <param name="TagToMatch" value="alertType" />

  <param name="StringToMatch" value="security" />

  <param name="AcceptOnMatch" value="true"/>

  </filter>

  <filter class="com.pega.apache.log4j.varia.DenyAllFilter"/>

  <appender-ref ref="ALERTSECURITY"/>

  </appender>

  <appender name="Test" class="com.pega.pegarules.priv.util.DailySizeRollingFileAppenderPega">

  <param name="FileNamePattern" value="'${log.location}/Test-${logging.clusterId}-'"/>

            <param name="MaxFileSize" value="512000KB"/>

  <param name="MaxBackupIndex" value="8"/>

<layout class="com.pega.apache.log4j.PatternLayout">

<param name="ConversionPattern" value="%d [%20.20t] [%10.10X{pegathread}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n"/>

</layout>

<filter class="com.pega.apache.log4j.varia.StringMatchFilter">

<param name="StringToMatch" value="Entering activity"/>

<param name="AcceptOnMatch" value="true"/>

</filter>

<filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

<param name="LevelToMatch" value="FATAL"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

<filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

<param name="LevelToMatch" value="ALERT"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

<filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

<param name="LevelToMatch" value="INFO"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

<filter class="com.pega.apache.log4j.varia.LevelMatchFilter">

<param name="LevelToMatch" value="ERROR"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

</appender>

  <appender name="CONSOLE" class="com.pega.apache.log4j.ConsoleAppender">

  <layout class="com.pega.apache.log4j.PatternLayout">

  <param name="ConversionPattern" value="%d [%20.20t] [%10.10X{pegathread}] [%20.20X{tenantid}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n"/>

  </layout>

  <filter class="com.pega.apache.log4j.varia.StringMatchFilter">

  <param name="StringToMatch" value="Entering activity"/>

  <param name="AcceptOnMatch" value="false"/>

  </filter>

  </appender>

  <appender name="PEGA" class="com.pega.pegarules.priv.util.DailySizeRollingFileAppenderPega">

   <param name="FileNamePattern" value="'${log.location}/PegaRULES-${logging.clusterId}-'"/>

   <param name="MaxFileSize" value="50MB" />

   <layout class="com.pega.apache.log4j.PatternLayout">

    <param name="ConversionPattern" value="%d [%20.20t] [%10.10X{pegathread}] [%20.20X{tenantid}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n"/>

   </layout>

   <filter class="com.pega.apache.log4j.varia.StringMatchFilter">

<param name="StringToMatch" value="Entering activity"/>

<param name="AcceptOnMatch" value="false"/>

</filter>

  </appender>

  <appender name="ALERT" class="com.pega.pegarules.priv.util.DailySizeRollingFileAppenderPega">

   <param name="FileNamePattern" value="'${log.location}/PegaRULES-ALERT-${logging.clusterId}-'"/>

   <param name="MaxFileSize" value="50MB" />

   <layout class="com.pega.apache.log4j.PatternLayout">

  <param name="ConversionPattern" value="%m%n" />

   </layout>

  </appender>

  <appender name="ALERTSECURITY" class="com.pega.pegarules.priv.util.DailySizeRollingFileAppenderPega">

   <param name="FileNamePattern" value="'${log.location}/PegaRULES-ALERTSECURITY-${logging.clusterId}-'"/>

   <param name="MaxFileSize" value="50MB" />

   <layout class="com.pega.apache.log4j.PatternLayout">

  <param name="ConversionPattern" value="%m%n" />

   </layout>

  </appender>

  <appender name="BIX" class="com.pega.pegarules.priv.util.DailySizeRollingFileAppenderPega">

   <param name="FileNamePattern" value="'${log.location}/PegaBIX-${logging.clusterId}-'"/>

   <param name="MaxFileSize" value="50MB" />

   <layout class="com.pega.apache.log4j.PatternLayout">

    <param name="ConversionPattern" value="%d [%20.20t] [%20.20X{tenantid}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n"/>

   </layout>

  </appender>

  <category name="com.pega.pegarules.data.internal.access.ExtractImpl" additivity="false">

  <priority value="info"/>

  <appender-ref ref="BIX"/>

  </category>

  <category name="com.pega.pegarules.data.internal.access.ExtractParameters" additivity="false">

  <priority value="info"/>

  <appender-ref ref="BIX"/>

  </category>

  <category name="com.pega.pegarules.data.internal.access.DatabaseUtilsCommonImpl" additivity="false">

  <priority value="info"/>

  <appender-ref ref="BIX"/>

  </category>

<!--  Provided as an example for how to enable messaging for PRPC or java class.

  <category name="Rule_Obj_Activity">

  <priority value="info"/>

  </category>

  <category name="com.pega.pegarules.engine.context.InitialConfiguration">

  <priority value="info"/>

  </category>

-->

<!-- Provided as an example for how to enable logging for LookupLists in a separate file

  <appender name="LOOKUPLIST-STAT" class="com.pega.pegarules.priv.util.FileAppenderPega">

  <param name="FileNamePattern" value="'PegaRULES-LLCSTAT-'yyyy-MMM-dd'.csv'" />

  <layout class="com.pega.apache.log4j.PatternLayout">

  <param name="ConversionPattern" value="%m%n" />

  </layout>

  </appender>

  <category

  name="com.pega.pegarules.session.internal.stats.lookuplist.LookupListStats">

  <priority value="info" />

  <appender-ref ref="LOOKUPLIST-STAT" />

  </category>

-->

  <root>

  <priority value="alert"/>

  <appender-ref ref="ASYNC"/>

  <appender-ref ref="ALERT-ASYNC"/>

  </root>

</log4j:configuration>