web.jboss

[ 1 Introduction ] [ 2 Valid tags and data tables ] [ 3 Table structure ] [ 4 How is the data sent to Devo? ]

Introduction

The tags beginning with web.jboss identify events generated by the WildFly Web Server (formerly JBoss web application server) belonging to Red Hat.

Valid tags and data tables

The full tag must have 3 levels. The first two are fixed as web.jboss and the third identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service	Tags	Data tables

Product / Service	Tags	Data tables
WildFly Web Server (formerly JBoss web application server)	`web.jboss.accessClf`	`web.jboss.accessClf`
	`web.jboss.accessCombined`	`web.jboss.accessCombined`
	`web.jboss.accessLt`	`web.jboss.accessLt`
	`web.jboss.boot`	`web.jboss.boot`
	`web.jboss.server`	`web.jboss.server`

For more information, read more about Devo tags.

Access logs (access_log.yyyy-MM-dd)

JBoss v7 access log files are identical to those of the Apache Tomcat application server but you can control the actual event content in terms of format and fields included.

The access log is not enabled by default so you need to edit the urn:jboss:domain:web:1.1 subsystem in the standalone/configuration/standalone.xml file to add the access-log definition as in this example:

JBoss 7.x access-log configuration:

<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
    <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
    <virtual-server name="default-host" enable-welcome-root="true">
        <alias name="localhost"/>
            <access-log rotate="false" prefix="access_log.txt" pattern="combined" >
                <directory path="." relative-to="jboss.server.log.dir" />
            </access-log>
    </virtual-server>
</subsystem>

Devo supports three formats for access logs; two of them are based upon standard formats and the other is defined by Devo to offer a format that contains more details. Each of these formats corresponds with the third level of an access log tag.

The log format that corresponds to the web.jboss.accessClf tag is based on the Common Log Format (CLF). The specification of this format is:
pattern="%h %l %u %t "%r" %s %b" pattern="common"
The log format that corresponds to the web.jboss.accessCombined tag is based on the NCSA Combined log format. The specification of this format is:
pattern="%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-Agent}i"" pattern="combined"
The log format that corresponds to the web.jboss.accessLt tag is a custom format defined by Devo to offer more detailed logging. The specification of this format that includes cookie names is:
However, if you prefer not to include cookie names in your events, use this specification instead.

Server.log and boot.log

For general information about these log files and their default directories, see the WildFly Documentation.

You should review the configuration for the generation of boot.log and modify it as needed. You want to ensure it is generated using the default PATTERN formatter and that it is written in append mode. The configuration file is usually found in standalone/configuration/logging.properties or domain/configuration/logging.properties depending on if the server is started in managed domain or standalone server mode. These lines below are those you should review and edit as needed.

boot.log JBoss 7.x configuration:

Table structure

These are the fields displayed in these tables:

web.jboss.accessClf

Field	Type	Source field name	Extra fields

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
environment	`str`	venv
application	`str`	vapp
clon	`str`	vclon
serverdate	`timestamp`
srcIp	`ip4`
user	`str`
method	`str`
url	`str`
protocol	`str`
statusCode	`int4`
responseLength	`int4`
srcIdentd	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

web.jboss.accessCombined

Field	Type	Source field name	Extra fields

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
environment	`str`	venv
application	`str`	vapp
clon	`str`	vclon
serverdate	`timestamp`
srcIp	`ip4`
user	`str`
method	`str`
url	`str`
protocol	`str`
statusCode	`int4`
responseLength	`int4`
referer	`str`
userAgent	`str`
srcIdentd	`str`
hostchain	`str`		✓
tag	`str`		✓

web.jboss.accessLt

Field	Type	Source field name	Extra Label

Field	Type	Source field name	Extra Label
eventdate	`timestamp`
environment	`str`	venv
application	`str`	vapp
clon	`str`	vclon
serverdate	`timestamp`
srcIp	`ip4`
serverName	`str`
serverPort	`int4`
user	`str`
sessionId	`str`
method	`str`
url	`str`
protocol	`str`
statusCode	`int4`
referer	`str`
userAgent	`str`
cookies	`str`
responseTime	`int4`
requestLength	`int4`
threadName	`str`
srcIdentd	`str`
hostchain	`str`		✓
tag	`str`		✓

web.jboss.boot

Field	Type	Source field name	Extra fields

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
environment	`str`	venv
application	`str`	vapp
clon	`str`	vclon
message	`str`
hostchain	`str`		✓
tag	`str`		✓

web.jboss.server

Field	Type	Source field name	Extra fields

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
environment	`str`	venv
application	`str`	vapp
clon	`str`	vclon
message	`str`
hostchain	`str`		✓
tag	`str`		✓

How is the data sent to Devo?

To send data to Devo, you con use file monitor as shown below.

File monitor using rsyslog in Unix-like environments

You can read more about using rsyslog to monitor and send files to a Devo endpoint here. These are the different aspects to consider: