Major Description
There is a race condition in the AbstractOutputStreamAppender that allows two log events to be sent in the same UDP package during concurrent log writes, thereby combining them into a single log event of output. This is an issue at least for the SyslogAppender, as only the first of the two lines will be parsed and templated correctly by services like rsyslog.
Currently, the AbstractOutputStreamAppender uses a read lock in its append method to lock around writes and flushes to the log manager. However, two threads may acquire the read lock, write simultaneously to the log manager and then trigger a manager flush. Since the DatagramOutputStream only sends packets upon receiving the flush method this will cause two log events to go into a single UDP package, which violates RFC 5426 spec.
One option to fix the bug is to change the read lock used in the append method to be a write lock. This seems to match the intention of the code, and I'm curious as to why a read lock was used originally.