Apache Tomcat Access Log to Syslogd

By | June 12, 2012

OK, I searched the WWW far and wide, but I could not really find a good solution how to send the access log from Apache Tomcat to a syslogd:-( So I checked the source;-) and there were at least more than the default AccessLogValve.java implementation. There was even one for logging to a DB. But not for syslogd:-(

I don’t normally do much in Java any more, but I still understand it;-) So I started to look into what it would take to create a new Valve to do what I wanted. It did turn out to be not that hard, especially with the help of the Apache log4j SyslogAppender.java and friends;-)

This little jar contains my shiny new SyslogAccessLogValve as source & class. It was compiled against Apache Tomcat 6.0.35, but I don’t think it would be a big problem to port it to version 7. The new class lives in the same package as all the others valves. But keep in mind that it’s NOT an official apache.org source!!

Drop the jar into CATALINA_BASE/lib and configure the new valve as any other AccessLogValve:

    <Valve className="org.apache.catalina.valves.SyslogAccessLogValve"

This will try to send the messages to the syslogd running on localhost and use the LOCAL6 facility. Since this class is a subclass of the orginal AccessLogValve, the pattern can contain the same elements as it’s superclass. I just used “common” for my tests so far, but the formatting is dome by the superclass;-)

And now the final output from syslogd, actually rsyslogd on my Linux system;-)

Jun 12 20:32:16 feather4 http-8080-1[10763] 0:0:0:0:0:0:0:1 - - [12/Jun/2012:20:32:16 -0700] "GET / HTTP/1.1" 200 7777
Jun 12 20:32:16 feather4 http-8080-1[10763] 0:0:0:0:0:0:0:1 - - [12/Jun/2012:20:32:16 -0700] "GET /tomcat.gif HTTP/1.1" 200 1934
Jun 12 20:32:16 feather4 http-8080-2[10763] 0:0:0:0:0:0:0:1 - - [12/Jun/2012:20:32:16 -0700] "GET /asf-logo-wide.gif HTTP/1.1" 200 5866
Jun 12 20:32:16 feather4 http-8080-2[10763] 0:0:0:0:0:0:0:1 - - [12/Jun/2012:20:32:16 -0700] "GET /tomcat-power.gif HTTP/1.1" 200 2324

Those are the four accesses when a browser hits the Apache Tomcat default home page.

I don’t know if that’s helpful for others, but since I saw a couple of places where the same question came up, it might be. In that case, have fun with it;-)

Update: Since this still seems to be found quite often, there is an update for this post in the next entry!

12 thoughts on “Apache Tomcat Access Log to Syslogd

  1. Phil

    Nice work, was looking around and not finding much just as you mention. Now the Apache Tomcat project just needs to consume this for everyone to conveniently enjoy.

  2. coffeeortech

    Awesome! thanks a bunch, worked on my solaris tomcat instance.
    Saw one minor change to make in the documentation in the java file — “level” is listed twice when the second one should be “header”. I needed to set that to false for my custom pattern to avoid date field showing up again.
    Going to try this on a Windows tomcat server too.

  3. Jerry Boonstra

    I’m interested in sending this data through unix domain sockets instead of localhost UDP. Any guidance on how to make that addition?

  4. admin Post author

    Unfortunately, that’s a log4j problem:-( I found a bug @ Apache which seems to be there for quite some time:-( So I don’t know what to tell you:-(


    Glassfish v2 had a JNI library to do just that. But that will always be system specific. So if you’re really interested in that, you might want to find that source. Here is my little adventure in the GF syslog setup:


  5. rayman

    does it work on tomcat7?
    i get java.lang.NoClassDefFoundError: org/apache/catalina/util/StringManager

  6. admin Post author

    I did not try to build it for Tomcat7 yet. But it should be relatively easy to adapt.

  7. Pingback: Apache Tomcat and Logging – The 2nd - Marco's Corner

  8. Arun

    Please replace the package name for StringManager to org.apache.naming to work on Tomcat 7 version

    import org.apache.naming.StringManager

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.