AccessLog implementation via logging subsystem?

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

AccessLog implementation via logging subsystem?

Thomas Meyer
Hi,

as far as I can see there seems to be no AccessLog interface implementation that is using the standard tomcat logging subsystem.
Is there a reason for this?
I have a use case were I want to forward access log to splunk via http event collector endpoint.
The idea is to log access log via tomcat logging and configure tomcat logging to use HttpEventCollectorLog4jAppender to forward all access logs to splunk.

mfg
thomas

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: AccessLog implementation via logging subsystem?

Mark Eggers
Thomas,

On 1/20/2021 2:59 AM, Thomas Meyer wrote:
> Hi,
>
> as far as I can see there seems to be no AccessLog interface implementation that is using the standard tomcat logging subsystem.
> Is there a reason for this?
> I have a use case were I want to forward access log to splunk via http event collector endpoint.
> The idea is to log access log via tomcat logging and configure tomcat logging to use HttpEventCollectorLog4jAppender to forward all access logs to splunk.
>
> mfg
> thomas

You could probably configure Tomcat to use log4j2 and its
SocketAppender to do this. Then it becomes a configuration exercise.

I think there were some notes on how to do the former on the mailing
list. It's been a couple of years since I've set up Tomcat with log4j2,
otherwise I'd write up detailed instructions.

I hope that gets you started down a reasonable path.

. . . just my two cents.
/mde/


OpenPGP_signature (505 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: AccessLog implementation via logging subsystem?

markt
In reply to this post by Thomas Meyer
On 20/01/2021 10:59, Thomas Meyer wrote:
> Hi,
>
> as far as I can see there seems to be no AccessLog interface implementation that is using the standard tomcat logging subsystem.
> Is there a reason for this?
> I have a use case were I want to forward access log to splunk via http event collector endpoint.
> The idea is to log access log via tomcat logging and configure tomcat logging to use HttpEventCollectorLog4jAppender to forward all access logs to splunk.

https://tomcat.markmail.org/thread/aawkctjwltiqkmby

Mark


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: AccessLog implementation via logging subsystem?

Felix Schumacher

Am 20.01.21 um 18:44 schrieb Mark Thomas:
> On 20/01/2021 10:59, Thomas Meyer wrote:
>> Hi,
>>
>> as far as I can see there seems to be no AccessLog interface implementation that is using the standard tomcat logging subsystem.
>> Is there a reason for this?
>> I have a use case were I want to forward access log to splunk via http event collector endpoint.
>> The idea is to log access log via tomcat logging and configure tomcat logging to use HttpEventCollectorLog4jAppender to forward all access logs to splunk.
> https://tomcat.markmail.org/thread/aawkctjwltiqkmby

At work we use something like the attached version of an subclassed
AbstractAccessLogValve to send our access log to log4j2. That way we can
format the access log as json and print it out on STDOUT. Might not be
the most performant way to log those accesses, but it is a convenient
way to run in a kubernetes environment, where JSON formatted events are
automatically parsed.

This implementation (well the log4j part really) has some other downsides.

You have to enable log4j2 globally in tomcat, which is not that well
documented. Enabling it globally can be an annoyance, when webapps
include their own copy of log4j.

Felix

>
> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Log4jAccessLogValve.java (3K) Download Attachment