Page Comparison

Introduction

The tags beginning with web.

...

jboss identify

...

events generated by the WildFly Web Server (formerly JBoss web application server

...

This article describes the tag naming structure, a little about logging in JBoss v7, and how to send log events from the JBoss server to Devo using rsyslog.

...

) belonging to Red Hat.

Valid tags and data tables

The full tag must have at least six 3 levels. The first two are fixed as asweb.jboss. The and the third level identifies the log type /format and currently must be one of boot, access-clf, access-combined, access-lt, or server.

The fourth, fifth and sixth levels are required and should identify the environment type, web application, and instance respectively. 

• environment - Describes the environment in when the event occurred. For example, development, testing, or production.
• web application - The name of the web application.
• clon - This is the instance that generated the event. Depending on your network, this can be a machine name, or the virtual name of a JBoss process.

The values of these levels should be guided by the structure we propose because they will be saved in the events when saved in Devo. When you open the resulting data table, these will appear in the environment, site and clon columns.

...

Technology

...

Brand

...

Log type/format

...

Environment

...

Web application

...

Clon

...

• boot

• access-clf

• access-combined

• access-lt

• server

free but required

...

Therefore, the valid tags include:

...

of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

For more information, read more about Devo tags.

JBoss logs

Server.log and boot.log

For general information about these log files and their default directories, see the JBoss Documentation.

You should review the configuration for the generation of boot.log and modify it as needed. You want to ensure it is generated using the default PATTERN formatter and that it is written in append mode. The configuration file is usually found in standalone/configuration/logging.properties or domain/configuration/logging.properties depending on if the server is started in managed domain or standalone server mode.

These are the lines you should review and edit as needed:

# File handler configuration
handler.FILE=org.jboss.logmanager.handlers.FileHandler
handler.FILE.level=DEBUG
handler.FILE.properties=autoFlush,append,fileName
handler.FILE.autoFlush=true
handler.FILE.append=true
handler.FILE.fileName=${org.jboss.boot.log.file:boot.log}
handler.FILE.formatter=PATTERN

...

<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
    <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
    <virtual-server name="default-host" enable-welcome-root="true">
        <alias name="localhost"/>
            <access-log rotate="false" prefix="access_log.txt" pattern="combined" >
                <directory path="." relative-to="jboss.server.log.dir" />
            </access-log>
    </virtual-server>
</subsystem>

...

...

...

...

# File handler configuration
handler.FILE=org.jboss.logmanager.handlers.FileHandler

Sending to Devo using file monitoring 

...

handler.FILE.level=DEBUG
handler.FILE.properties=autoFlush,append,fileName
handler.FILE.autoFlush=true
handler.FILE.append=true
handler.FILE.fileName=${org.jboss.boot.log.file:boot.log}
handler.FILE.formatter=PATTERN

Table structure

These are the fields displayed in these tables:

• web.jboss.accessClf

• web.jboss.accessCombined

• web.jboss.accessLt

• web.jboss.boot

• web.jboss.server

web.jboss.accessClf

web.jboss.accessCombined

web.jboss.accessLt

web.jboss.boot

web.jboss.server

How is the data sent to Devo?

To send data to Devo, you con use file monitor as shown below.

File monitor using rsyslog in Unix-like environments

You can read more about using rsyslog to monitor and send files to a Devo endpoint in the Sending data to Devo section of our documentation. here. These are the different aspects to consider:

$template jboss,"<%PRI%>%timegenerated% %HOSTNAME% %syslogtag% %msg%"
 
# File server.log
$InputFileName JBOSS_PATH/standalone/log/server.log
$InputFileTag web.jboss.server.ENV.APP.CLON:
$InputFileStateFile stat-jboss-server1
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# File boot.log
$InputFileName JBOSS_PATH/standalone/log/boot.log
$InputFileTag web.jboss.boot.ENV.APP.CLON:
$InputFileStateFile stat-jboss-boot1
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# File access log
$InputFileName JBOSS_PATH/standalone/log/access_log.txt
$InputFileTag web.jboss.access-combined.ENV.APP.CLON:
$InputFileStateFile stat-jboss-accessCombined1
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# SSL config for DEVO cloud
#$DefaultNetstreamDriver gtls # use gtls netstream driver
#$DefaultNetstreamDriverCAFile /etc/rsyslog.d/ca.crt
#$DefaultNetstreamDriverCertFile /etc/rsyslog.d/user.crt
#$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/user.key
#$ActionSendStreamDriverMode 1 # require TLS for the connection
#$ActionSendStreamDriverAuthMode x509/name
#$ActionSendStreamDriverPermittedPeer collector
 
if $syslogtag contains 'web.jboss.' and $syslogfacility-text == 'local7' then @@DEVO-RELAY:PORT;jboss
:syslogtag, contains, "web.jboss." ~

...

/opt/jboss/standalone/log/server.log /opt/jboss/standalone/log/boot.log /opt/jboss/standalone/log/access_log.txt
{
    rotate 14
    daily
    copytruncate
    missingok
    notifempty
    delaycompress
    compress
    sharedscripts
    lastaction
        service rsyslog stop
        rm -f /var/spool/rsyslog/stat-jboss-*
        service rsyslog start
    endscript
}

/etc/init.d/rsyslog restart

Related articles

...