Current view: XpoLog V7 (Latest). Available: XpoLog V6 and XpoLog V5

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 8 Next »

Tomcat server can be configured to use different type of logging systems, the server has default logging configuration and can be configured to use log4j. Tomcat can also create access logs based on the Access Log Valve.

Tagging

All Tomcat/Catalina logs are tagged by logtype - tomcat

In addition there are the following log types that must be assigned for the Tomcat App to be deployed on:

  • Catalina out log or Console out log will be tagged by logtype - out
  • Catalina Servlet or webapp log will be tagged by logtype - servlet
  • Access logs will be tagged by logtype - access

Defualt logging configuration can be found under the conf direcotry (tomcat/conf) or *nix /etc/tomcat../conf/ logging.properties file. Usually the access log will be defined in server.xml file under the conf directory.

Default Log structure and configuration

For log type out and servlet, those logs can be name by default catalina.out,  and will be located under the logs directory. Use the following XpoLog pattern for those logs

{date:Date,dd-MMM-yyyy HH:mm:ss.SSS} {priority:Prioriryt,ftype=severity,ALL;FINEST;FINER;FINE;INFO;CONFIG;WARNING;SEVERE} [{text:thread,ftype=thread}] {text:Source,ftype=source} {string:Message,ftype=message}

Custom Logging

If the Tomcat server is configured to use external logging with log4j or other java.util framework than use XpoLog pattern wizard and defenition to configure the log pattern correctly for the app to work.

Make sure that if you are using log4j wizard you will need to setup the log sources and manually apply the Tomcat/Catalina tags on them for the App to work correctly. 

References

Tomcat 7

https://tomcat.apache.org/tomcat-7.0-doc/logging.html

Access Logs: https://tomcat.apache.org/tomcat-7.0-doc/config/valve.html#Access_Logging

Tomcat 8

Logging: https://tomcat.apache.org/tomcat-8.0-doc/logging.html

Access Logs: https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Access_Logging

Tomcat 9

https://tomcat.apache.org/tomcat-9.0-doc/logging.html

Access Logs: https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#Access_Logging

Log4J

If the Server is using the log4j library for logging please follow the steps documented in adding logs from log4j 1.2 or log4j 2.* 

 

Tomcat Access Logs Configuration

  1. Add Log Data In XpoLog, When adding a log to XpoLog you can now select the Log Type (logtype) for Apache Tomcat Access with the following logtypes:
    1. tomcat
      1. in addition select the log type - access

Example

In the Apache Tomcat configuration file, usually server.xml or by default, located under the conf/ directory (Linux "/etc/tomcat/conf") search for the Access Log Valve element in the XML:

"%a %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" combined

The following sequence is the log structure definition for the Httpd server %a %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"

In XpoLog such pattern will be translated into:

{geoip:Client IP,ftype=remoteip;type=;,} {string:Remote Log Name,ftype=remotelog;,} {string:Remote User,ftype=remoteuser;,} [{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}] "{choice:Method,ftype=reqmethod;,GET;POST} {string:URL,ftype=requrl;,}{block,start,emptiness=true}?{string:Query,ftype=querystring;,}{block,end,emptiness=true} {string:reqprotocol,ftype=reqprotocol;,}" {number:Status,ftype=respstatus;,} {number:Bytes Sent,ftype=bytesent;,}{block,start,emptiness=true} {number:TimeToPrcessRequest,ftype=processrequestmilli;,}{block,end,emptiness=true} "{string:Referer,ftype=referer;,}" "{string:User Agent,ftype=useragent;,}"{eoe}


 

Apache Tomcat Access Log Format Conversion Table

logtyep should be set to: tomcat, access

Format StringDescriptionXpoLog PatternXpoLog ftype

%a

Remote IP-address

{ip:RemoteIP,ftype=remoteip}

remoteip

%A

Local IP-address

{ip:LocalIP,ftype=localip}

localip

%B

Size of response in bytes, excluding HTTP headers.

{number:BytesSent,ftype=bytesent}

bytesent

%b

Bytes sent, excluding HTTP headers, or '-' if zero

{text:BytesSent,ftype=bytesent}

bytesent

%{Foobar}C

The contents of cookie Foobar in the request sent to the server. Only version 0 cookies are fully supported.

{string:Cookie_< FOOBAR >}

Replace < FOOBAR > with cookie name

 

%D

The time taken to serve the request, in microseconds.

{number:ResponseTimeMicroSecs,ftype=responsetimemicro}

responsetimemicro

%F

Time taken to commit the response, in millis

{number:ResponseTimeMilliSecs,ftype=responsetimemilli}

responsetimemilli

%h

Remote host name (or IP address if enableLookups for the connector is false)

{text:Remotehost,ftype=remotehost}

 

remotehost

%H

The request protocol

{ text:RequestProtocol,ftype=reqprotocol}

 

reqprotocol

%{Foobar}i

The contents of Foobar: header line(s) in the request sent to the server. Changes made by other modules (e.g. mod_headers)

affect this. If you're interested in what the request header was prior to when most modules would have modified it, use mod_setenvif to copy the header into an

internal environment variable and log that value with the %{VARNAME}e described above.

{text:<FOOBAR>}

https://en.wikipedia.org/wiki/List_of_HTTP_header_fields and so on it goes for the different headers.

 

 

%{Referer}i

Referer

{ text:Referer,ftype=referer}

 

referer

%{User-agent}i

User-agent

{ text:User-agent,ftype=useragent}

 

useragent
%{X-Forwarded-For}iX-Forwarded-For

{text: X-Forwarded-For,ftype=forwardforip} OR

{ip: X-Forwarded-For,ftype=forwardforip}

 

forwardforip

%I

Current request thread name (can compare later with stacktraces)

{text:RequestThread,ftype=thread}

thread

%l

Remote logical username from identd (always returns '-')

{text:logicalname}

 

%m

The request method

{text:RequestMethod,ftype=reqmethod}

reqmethod

%{Foobar}o

write value of outgoing header with name xxx

{string:<FOOBAR>}

 

 

%p

The canonical local port of the server serving the request

{number:ServerPort,ftype=serverport}

serverport

%{format}p

The canonical local port of the server serving the request or the server's actual port or the client's actual port. Valid formats are canonicallocal, or remote.

%{canonical}p

%{local}p

%{remote}p

{number:ServerPort,ftype=serverport}

{number:LocalServerPort,ftype=localserverport}

{number:RemotePort,ftype=remoteport}

serverport

localserverportt

remoteport

%q

The query string (prepended with a ? if a query string exists, otherwise an empty string)

{text:QueryString,ftype=querystring}

OR

Suggest a regexp that will build a list of parameters as cloumns.

The query string (prepended with a ? if a query string exists, otherwise an empty string)

querystring

%r

First line of the request (method and request URI)

{text:FirstLine,ftype=reqfirstline}

TBD - might be parsed to multiple value and types}

 

reqfirstline

%s

Status. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

{number:ResponseStatus,ftype=respstatus}

. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

respstatus
%SUser session ID{text:UserSessionId,ftype=sessionid}sessionid

%t

Time the request was received (standard english format)

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

 

 
%{format}t

The time, in the form given by format, which should be in an extended strftime(3) format (potentially localized). If the format starts with begin: (default)

the time is taken at the beginning of the request processing. If it starts with end: it is the time when the log entry gets written, close to the end of the request

processing. In addition to the formats supported by strftime(3), the following format tokens are supported:

sec

number of seconds since the Epoch

msec

number of milliseconds since the Epoch

usec

number of microseconds since the Epoch

msec_frac

millisecond fraction

usec_frac

microsecond fraction

These tokens can not be combined with each other or strftime(3) formatting in the same format string. You can use multiple %{format}t tokens instead.

The extended strftime(3) tokens are available in 2.2.30 and later.

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

sec number of seconds since the Epoch
msec number of milliseconds since the Epoch
usec number of microseconds since the Epoch
msec_frac millisecond fraction
usec_frac microsecond fraction

 

%T

The time taken to serve the request, in seconds.

{number:ResponseTimeSecs,,ftype=processrequestsec}

 

processrequestseci

%u

Remote user that was authenticated (if any), else '-'

{text:User,ftype=remoteuser}

Remote user (from auth; may be bogus if return status (%s) is 401)

remoteuser

%U

The URL path requested, not including any query string.

{text:RequestURL,ftype=requrl}

The URL path requested, not including any query string.

requrl

%v

 Local server name

{text:ServerName,ftype=servername}

servername
  

 

 

 

 

  • No labels