Mandar Shinde

Tomcat Access Logging Configuration

  1. Home
  2. Blog
  3. Tomcat Access Logging Configuration

Tomcat Access Logging Configuration

Mandar Shinde

November 08 2012

Oracle Endeca Enterprise Search

Monitoring who is using your server or if we want to record site activity, (hits, page views, errors).  
Setting up Logging
To setup access logging, edit the Tomcat server configuration file, ${tomcat_home}/conf/server.xml and uncomment the AccessLogValve:
     
   <Valve className=”org.apache.catalina.valves.AccessLogValve” directory=”logs”  prefix=”localhost_access_log.” suffix=”.txt” pattern=”common” resolveHosts=”false”/>
 
By default the log files are created in the ${tomcat_home}/logs directory and roll over to a new file at midnight.
The log messages can be written in either of two standard web access log formats by setting the pattern attribute to common or combined. These appear to be the ones used by web log analysers. Other log formats can be specified with the pattern attribute.
More information on the AccessLogValve and the pattern attribute can be found on the Tomcat Valve Configuration Reference.
Modifying the Log Format
We can extend the “common” and “combined” patterns by appending the response time for each request. To use this, set the
  • common: pattern=”common”
  • common plus response time: pattern=”%h %l %u %t &quot;%r&quot; %s %b %D”
  • combined: pattern=”combined”
  • combined plus response time: pattern=”%h %l %u %t &quot;%r&quot; %s %b &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot; %D”
 Using FastCommonAccessLogValve
The FastCommonAccessLogValve has better performance than the AccessLogValve. If you are running a production system, you might consider switching to the FastCommonAccessLogValve. The main restriction is that only the “common” and “combined” log formats can be used.
        
<Valve className=”org.apache.catalina.valves.FastCommonAccessLogValve” directory=”logs”  prefix=”localhost_access_log.” suffix=”.txt”
pattern=”common” resolveHosts=”false”/>
 
The Logging Output
Here is a sample entry from the sample logs, using the combined plus response time pattern.

Example log entry: –
69.69.69.61 – test [07/Nov/2012:00:00:00 -0500] “GET /test/demo/Global/offset/ HTTP/1.1” 200 564874 4987
Example Value
Meaning
69.69.69.61
client IP address
–
not used
test
authenticated username
[07/Nov/2012:00:00:00 -0500]
request time
“GET …”
HTTP request verb and path
200
HTTP response code
564874
bytes transferred
4987
response time in msecs
Let's Share
Show Buttons
Hide Buttons