web.tomcat

Introduction

The tags beginning with web.tomcat identify events generated by the Apache Tomcat web application server belonging to The Apache Software Foundation.

Valid tags and data tables

The full tag must have at least 3 levels. The first two are fixed as web.nginx. The third level identifies the type of events sent and the rest of them indicate the event subtypes.

Product/Service	Tag	Data table
Apache Tomcat web application server	`web.tomcat.accessClf`	`web.tomcat.accessClf`
	`web.tomcat.accessCombined`	`web.tomcat.accessCombined`
	`web.tomcat.access-lt.des.lucca.zkoxgiaud155m0j`	`web.tomcat.accessLt`
	`web.tomcat.app`	`web.tomcat.app`
	`web.tomcat.app-lt.des.lucca.zkoxgiaud155m0j`	`web.tomcat.appLt`
	`web.tomcat.catalina`	`web.tomcat.catalina`
	`web.tomcat.catalina-lt.des.lucca.zkoxgiaud155m0j`	`web.tomcat.catalinaLt`
	`web.tomcat.tomcat_gc`	`web.tomcat.tomcat_gc`
	`web.tomcat.out.pro.app-logtrust.aws1`	`web.tomcat.out`

For more information, read more about Devo tags.

Event formats

Tomcat uses Apache Common Logging to generate the log events. The log messages that arrive through ServletContex log methods are also routed to this log library and associated to the following category:

org.apache.catalina.core.ContainerBase.[engine].[host].[context]

Usually, the engine is Catalina and the host is localhost.

The context name it is used as [context], but there are some exceptions. For example, an application whose context path is /cava would have the following category associated org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/cava].

In Tomcat default distribution, Apache Common Logging is associated to the JUL framework (java.util.logging). Hence, all events, including the ones generated by ServletContext are managed by JUL.

Tomcat configures JUL with the file specified in the LOGGING_CONFIG environment variable. In case it is missing, the installation file CATALINA_BASE/conf/logging.properties is used.

Access log (localhost_access_log.yyyy-MM-dd.log):
This file contains an access log similar to web server logs. In the log, there is an event for each petition processed by the server. You can control the event content (format and fields) in detail.
The access log is configured as a Tomcat Valve. The definition is found in CATALINA_BASE/conf/server.xml.
```
<Valve className="org.apache.catalina.valves.AccessLogValve"
    directory="logs"
    prefix="localhost_access_log." suffix=".txt"
    pattern="%h %l %u %t &quot;%r&quot; %s %b" />
```
Devo supports three formats for access logs; two of them are based upon standard formats and the other is defined by Devo to offer a format that contains more details. Each of these formats corresponds with the third level of an access log tag.
- The log format that corresponds to the web.tomcat.access-clf tag is based on the Common Log Format (CLF). The specification of this format is:
```
pattern="%h %l %u %t &quot;%r&quot; %s %b"
pattern="common"
```
- The log format that corresponds to the web.tomcat.access-combined tag is based on the NCSA Combined log format. The specification of this format is:
```
pattern="%h %l %u %t &quot;%r&quot; %s %b &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot;"
pattern="combined"
```
- The log format that corresponds to the web.tomcat.access-lt tag is a custom format defined by Devo to offer more detailed logging. The specification of this format that includes cookie names is:
```
pattern="%t %a %l %u %S %v:%p %m &quot;%U%q&quot; %H &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot; &quot;%{cookieName1}c:%{cookieName2}c&quot; %s %D %B %I"
```
  However, if you prefer not to include cookie names in your events, use this specification instead.
```
pattern="%t %a %l %u %S %v:%p %m &quot;%U%q&quot; %H &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot; &quot;&quot; %s %D %B %I"
```
localhost.yyyy-MM-dd.log:
This log contains the messages written by the applications with JUL (java.util.logging). Tags starting with web.tomcat.app should be associated with events from this log file.
The definition is found in CATALINA_BASE/ conf/logging.properties . The logs coming from the applications are configured to be stored in this file. This is done with the help of a handler built to write in localhost.yyy-MM-dd.log and associated with ServletContext log.
```
2localhost.org.apache.juli.FileHandler.level = FINE
2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
2localhost.org.apache.juli.FileHandler.prefix = localhost.
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler
```
catalina.yyyy-MM-dd.log:
This log contains the messages generated by Tomcat, usually associated with the server and applications life cycle. Tags starting with web.tomcat.catalina should be associated with events from this log file.
The definition is found in CATALINA_BASE/ conf/logging.properties. The logs coming from the container are configured to be stored in this file. This is done with the help of a handler built to write in catalina.yyy-MM-dd.log and associated with the root logger.
```
1catalina.org.apache.juli.FileHandler.level = FINE
1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
1catalina.org.apache.juli.FileHandler.prefix = catalina.  
.handlers = 1catalina.org.apache.juli.FileHandler
```
catalina.out:
This log contains the information sent by the applications to stdout and stderr. It is generated by redirecting to this files standard and error output at operating system level. Since Tomcat is not directly responsible of its creation, it doesn't rotate. Tags starting with web.tomcat.out should be associated with events from this log file.

Table structure

These are the fields displayed in these tables:

How is the data sent to Devo?

To send data to Devo, you con use file monitor as shown below.

File monitor in UNIX environments

The standard method is to configure Tomcat to write the logs to file and rely on another tool (like rsyslog or syslog-ng) to send the events. To know more about this topic, visit Monitoring files using rsyslog and Monitoring files using rsyslog.