AccessLog implementation via logging subsystem?

[Thomas Meyer]

Hi,

as far as I can see there seems to be no AccessLog interface implementation that is using the standard tomcat logging subsystem.
Is there a reason for this?
I have a use case were I want to forward access log to splunk via http event collector endpoint.
The idea is to log access log via tomcat logging and configure tomcat logging to use HttpEventCollectorLog4jAppender to forward all access logs to splunk.

mfg
thomas

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

[Mark Eggers]

Thomas,

On 1/20/2021 2:59 AM, Thomas Meyer wrote:
> Hi,
>
> as far as I can see there seems to be no AccessLog interface implementation that is using the standard tomcat logging subsystem.
> Is there a reason for this?
> I have a use case were I want to forward access log to splunk via http event collector endpoint.
> The idea is to log access log via tomcat logging and configure tomcat logging to use HttpEventCollectorLog4jAppender to forward all access logs to splunk.
>
> mfg
> thomas

You could probably configure Tomcat to use log4j2 and its
SocketAppender to do this. Then it becomes a configuration exercise.

I think there were some notes on how to do the former on the mailing
list. It's been a couple of years since I've set up Tomcat with log4j2,
otherwise I'd write up detailed instructions.

I hope that gets you started down a reasonable path.

. . . just my two cents.
/mde/

[markt]

On 20/01/2021 10:59, Thomas Meyer wrote:
> Hi,
>
> as far as I can see there seems to be no AccessLog interface implementation that is using the standard tomcat logging subsystem.
> Is there a reason for this?
> I have a use case were I want to forward access log to splunk via http event collector endpoint.
> The idea is to log access log via tomcat logging and configure tomcat logging to use HttpEventCollectorLog4jAppender to forward all access logs to splunk.

https://tomcat.markmail.org/thread/aawkctjwltiqkmby

Mark


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

[Felix Schumacher]

Am 20.01.21 um 18:44 schrieb Mark Thomas:
> On 20/01/2021 10:59, Thomas Meyer wrote:
>> Hi,
>>
>> as far as I can see there seems to be no AccessLog interface implementation that is using the standard tomcat logging subsystem.
>> Is there a reason for this?
>> I have a use case were I want to forward access log to splunk via http event collector endpoint.
>> The idea is to log access log via tomcat logging and configure tomcat logging to use HttpEventCollectorLog4jAppender to forward all access logs to splunk.
> https://tomcat.markmail.org/thread/aawkctjwltiqkmby

At work we use something like the attached version of an subclassed
AbstractAccessLogValve to send our access log to log4j2. That way we can
format the access log as json and print it out on STDOUT. Might not be
the most performant way to log those accesses, but it is a convenient
way to run in a kubernetes environment, where JSON formatted events are
automatically parsed.

This implementation (well the log4j part really) has some other downsides.

You have to enable log4j2 globally in tomcat, which is not that well
documented. Enabling it globally can be an annoyance, when webapps
include their own copy of log4j.

Felix

>
> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]