Logback Classic offers the existing SocketAppender and SSLSocketAppender which are designed to send logging events to a remote logging server where those events can then be logged according to local policy. This model works well enough for logging from an application server to a logging server, but it is a bit more inconvenient for the development of tools such as Logback Beagle, because it requires such tools to open a passive listening socket on the developer's workstation. It may be difficult (and in some cases infeasible) for an application server to open a connection to a developer's workstation, even within the bounds of a private enterprise network.

This feature request will allow Logback Classic to offer a model in which the socket roles of sender and receiver are reversed. The new ServerSocketAppender (and SSLServerSocketAppender) will create a passive listening socket and await client connections, asynchronously. Logging events that are delivered to the appender will be sent to each of the connected clients as serialized ILoggingEvent objects. When no clients are connected, messages delivered to the appender will be summarily discarded. Using such an appender, a developer tool could open a connection to a running application's appender to receive logging events and log according to local policy. Moreover, using the recently added SocketServer (or SSLSocketServer), a logging server application could be configured with a server component that would receive logging events from remote appender clients and deliver them to interested receivers by delivering them to an appender of type ServerSocketAppender or SSLServerSocketAppender.

Much of the supporting infrastructure for SSL and the new SocketServer/SSLSocketServer might be leveraged advantageously for this feature.

I will add subtasks needed in order to complete the feature, and will submit pull requests for the implementation.