Moving tomcat logs to syslog servers

Hi All,
I am new here in this platform, let everyone have a healthy life.
I work in a middleware technology and I have created account to join this community and I am glad to be on this to engage myself with techie people around :slight_smile:
question : - I have a tomcat running on production environment, my client needs the logs to be moved automatically to the syslog servers. please help me on this issue.

Regards
Fazil

hi Fazil, welcome.

take a look at the logrotate utility this should be capable of doing what you need.

man logrotate or info logrotate on your local system

there are many online examples - search 'logrotate examples' ... using your favourite engine (google/bing/ddg/...)

if you have specific issues wrt potential solution(s) , post them - with accompanying code and problems, the team can then provide guidance/assistance.

Thank you for your response :slight_smile:
seems like the client has syslog servers, the OS team has done their setup and their logs are moving to syslog (kind of pushing logs automatically using syslog servers).
same thing - they need on the tomcat to get it done. how this can be achieved!

@fazil, How are Tomcat log files currently rotated in your set up ? (server.xml , catalina .properties files .... )

if the OS team have already set up (configured?) syslog (which syslog as there are a number of tools providing this) for 'their logs' then reach out to them on what they have done and see if/how that can be customised for your specific use. Its likely syslog integration/use most likely be an additional step to the existing Tomcat configuration.

  • can you also provide OS name and version, Tomcat version and any other relevant details (configuration files).

hi,
seems the OS team has done the changes according to the blog given in this link -

  1. Configuring the tomcat.conf file

    I want to send the tomcat catalina.log to syslog server using the local1 facility. Go to the /etc/rsyslog.d/ and create a file called tomcat.conf and add the following content to the file.

File 1

input(type="imfile"
File="/var/log/tomcat/catalina.log"
Tag="catalina"
StateFile="/var/spool/catalina"
Severity="info"
Facility="local1")

local1.* @:514

Replace syslogServer with your actual syslog name or ip address server.

In the above configuration

File is the tomcat log file absolue path. In my case tomcat log file path is /var/log/tomcat/catalina.log.

Tag is the identification for the tomcat log file into the syslog server. In my case catalina is the tag to filter the content from the syslog server.

type is the module is being used to parse the log files. This module needs to be configured in the /etc/rsyslog.conf file. Please look section 2.2 for configuration.

StateFile is the tomcat log file parse status.

Severity is the logging severity into the syslog server

Faciltiy is the logging under facilitiy. In my case facility is local1 and this faility is being used to
filter the log file content and send to the different location.
2. Configuring the rsyslog.conf
2.1 Load the imfile module
The imfile module is required to parse the catalina.log file and send to the syslog server.
Edit the rsyslog.conf file and add the following content under MODULE section.

  module(load="imfile" PollingInterval="10")

2.2 Configure the messages
This confuguration is required for not logging the calatling.log messages into the /var/log/messages.

Edit the /etc/rsyslog.conf file and append the local1.none content before /var/log/messages.

*.info;mail.none;authpriv.none;cron.none;local1.none                /var/log/messages 

2.3 Restart the rsyslog daemon.
systemctl restart rsyslog

these steps has been followed, but it wasn't tested because we need a downtime for production servers.
we have - tomcat version -7 , Redhat linux 2.6.32...

is there a way, we could connect in any platform to make a chat session. just asking! :slight_smile:

1 Like

/usr1/app/tomcat/bin ~$ ./version.sh

Using CATALINA_BASE: /usr1/app/tomcat
Using CATALINA_HOME: /usr1/app/tomcat
Using CATALINA_TMPDIR: /usr1/app/tomcat/temp
Using JRE_HOME: /usr/lib/jvm/java-1.8.0-openjdk.x86_64/jre
Using CLASSPATH: /usr1/app/tomcat/bin/bootstrap.jar:/usr1/app/tomcat/bin/tomcat-juli.jar
Server version: Apache Tomcat/7.0.69
Server built: Apr 11 2016 07:57:09 UTC
Server number: 7.0.69.0
OS Name: Linux
OS Version: 2.6.32-754.36.1.el6.x86_64
Architecture: amd64
JVM Version: 1.8.0_275-b01
JVM Vendor: Red Hat, Inc.

/usr1/app/tomcat/conf

vi logging.properties

1catalina.org.apache.juli.FileHandler.level = WARNING
1catalina.org.apache.juli.FileHandler.directory = /usr1/logs/tomcat
1catalina.org.apache.juli.FileHandler.prefix = catalina.

2localhost.org.apache.juli.FileHandler.level = WARNING
2localhost.org.apache.juli.FileHandler.directory = /usr1/logs/tomcat
2localhost.org.apache.juli.FileHandler.prefix = localhost.

3manager.org.apache.juli.FileHandler.level = WARNING
3manager.org.apache.juli.FileHandler.directory = /usr1/logs/tomcat
3manager.org.apache.juli.FileHandler.prefix = manager.

4host-manager.org.apache.juli.FileHandler.level = WARNING
4host-manager.org.apache.juli.FileHandler.directory = /usr1/logs/tomcat
4host-manager.org.apache.juli.FileHandler.prefix = host-manager.

java.util.logging.ConsoleHandler.level = WARNING
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter

/usr1/logs/tomcat
has below logs files seen under the folder , while hitting the URL priority_live.log getting updated*

host-manager.2022-09-26.log
staging.log
a...,_assets.log
priority_live.log

/usr1/app/tomcat/conf
Entries seen in server.xml file*
vi server.xml

STAGING: staging sites share content, all staging domains are alias
GENERAL_LIVE: All non priority live sites, does not include custom setups
PRIORITY_LIVE: PearsonSchool, pearson private schools, specific high load sites, does not include custom setups
CUSTOM: Other sites where root CFM code cannot be easily combined into shared CFML folder '

                    &a..,n_assets;
                    &staging;
                    &general_live;
                    &priority_live;

I am waiting to hear from you..