Apache Tomcat Access Log to Syslogd

OK, I searched the WWW far and wide, but I could not really find a good solution how to send the access log from Apache Tomcat to a syslogd:-( So I checked the source;-) and there were at least more than the default AccessLogValve.java implementation. There was even one for logging to a DB. But not for syslogd:-(

I don’t normally do much in Java any more, but I still understand it;-) So I started to look into what it would take to create a new Valve to do what I wanted. It did turn out to be not that hard, especially with the help of the Apache log4j SyslogAppender.java and friends;-)

This little jar contains my shiny new SyslogAccessLogValve as source & class. It was compiled against Apache Tomcat 6.0.35, but I don’t think it would be a big problem to port it to version 7. The new class lives in the same package as all the others valves. But keep in mind that it’s NOT an official apache.org source!!

Drop the jar into CATALINA_BASE/lib and configure the new valve as any other AccessLogValve:

    <Valve className="org.apache.catalina.valves.SyslogAccessLogValve"
        hostname="localhost"
        facility="local6"
        pattern="common"
        resolveHosts="false"/>

This will try to send the messages to the syslogd running on localhost and use the LOCAL6 facility. Since this class is a subclass of the orginal AccessLogValve, the pattern can contain the same elements as it’s superclass. I just used “common” for my tests so far, but the formatting is dome by the superclass;-)

And now the final output from syslogd, actually rsyslogd on my Linux system;-)

Jun 12 20:32:16 feather4 http-8080-1[10763] 0:0:0:0:0:0:0:1 - - [12/Jun/2012:20:32:16 -0700] "GET / HTTP/1.1" 200 7777
Jun 12 20:32:16 feather4 http-8080-1[10763] 0:0:0:0:0:0:0:1 - - [12/Jun/2012:20:32:16 -0700] "GET /tomcat.gif HTTP/1.1" 200 1934
Jun 12 20:32:16 feather4 http-8080-2[10763] 0:0:0:0:0:0:0:1 - - [12/Jun/2012:20:32:16 -0700] "GET /asf-logo-wide.gif HTTP/1.1" 200 5866
Jun 12 20:32:16 feather4 http-8080-2[10763] 0:0:0:0:0:0:0:1 - - [12/Jun/2012:20:32:16 -0700] "GET /tomcat-power.gif HTTP/1.1" 200 2324

Those are the four accesses when a browser hits the Apache Tomcat default home page.

I don’t know if that’s helpful for others, but since I saw a couple of places where the same question came up, it might be. In that case, have fun with it;-)

Update: Since this still seems to be found quite often, there is an update for this post in the next entry!

12 thoughts on “Apache Tomcat Access Log to Syslogd”

Phil August 5, 2012

Nice work, was looking around and not finding much just as you mention. Now the Apache Tomcat project just needs to consume this for everyone to conveniently enjoy.

admin Post authorAugust 5, 2012

Did you see the updated post above?

coffeeortech August 14, 2012

Awesome! thanks a bunch, worked on my solaris tomcat instance.
Saw one minor change to make in the documentation in the java file — “level” is listed twice when the second one should be “header”. I needed to set that to false for my custom pattern to avoid date field showing up again.
Going to try this on a Windows tomcat server too.

admin Post authorAugust 14, 2012

Yes, I found that the Solaris syslogd can not handle the header too:-( I updated my jar a little bit, see the second post https://marcoscorner.walther-family.org/2012/06/apache-tomcat-and-logging-the-2nd/

Jerry Boonstra November 8, 2012

I’m interested in sending this data through unix domain sockets instead of localhost UDP. Any guidance on how to make that addition?

admin Post authorNovember 8, 2012

Unfortunately, that’s a log4j problem:-( I found a bug @ Apache which seems to be there for quite some time:-( So I don’t know what to tell you:-(

https://issues.apache.org/bugzilla/show_bug.cgi?id=44839

Glassfish v2 had a JNI library to do just that. But that will always be system specific. So if you’re really interested in that, you might want to find that source. Here is my little adventure in the GF syslog setup:

https://marcoscorner.walther-family.org/2008/10/glassfish-v2-and-syslogd-an-adventure/

Jerry Boonstra November 9, 2012

Interesting. I’m first going to try Syslog4j and JNA to see if i can rig it. Claims to support it.

rayman March 27, 2013

does it work on tomcat7?
i get java.lang.NoClassDefFoundError: org/apache/catalina/util/StringManager

admin Post authorApril 2, 2013

I did not try to build it for Tomcat7 yet. But it should be relatively easy to adapt.

Pingback: Apache Tomcat and Logging – The 2nd - Marco's Corner

Arun August 1, 2014

Please replace the package name for StringManager to org.apache.naming to work on Tomcat 7 version

import org.apache.naming.StringManager

admin Post authorAugust 1, 2014

There is an updated jar in https://marcoscorner.walther-family.org/2012/06/apache-tomcat-and-logging-the-2nd/ , that should work for Tomcat7.

Phil August 5, 2012

Nice work, was looking around and not finding much just as you mention. Now the Apache Tomcat project just needs to consume this for everyone to conveniently enjoy.
admin Post authorAugust 5, 2012

Did you see the updated post above?
coffeeortech August 14, 2012

Awesome! thanks a bunch, worked on my solaris tomcat instance.
Saw one minor change to make in the documentation in the java file — “level” is listed twice when the second one should be “header”. I needed to set that to false for my custom pattern to avoid date field showing up again.
Going to try this on a Windows tomcat server too.
admin Post authorAugust 14, 2012

Yes, I found that the Solaris syslogd can not handle the header too:-( I updated my jar a little bit, see the second post https://marcoscorner.walther-family.org/2012/06/apache-tomcat-and-logging-the-2nd/
Jerry Boonstra November 8, 2012

I’m interested in sending this data through unix domain sockets instead of localhost UDP. Any guidance on how to make that addition?
admin Post authorNovember 8, 2012

Unfortunately, that’s a log4j problem:-( I found a bug @ Apache which seems to be there for quite some time:-( So I don’t know what to tell you:-(

https://issues.apache.org/bugzilla/show_bug.cgi?id=44839

Glassfish v2 had a JNI library to do just that. But that will always be system specific. So if you’re really interested in that, you might want to find that source. Here is my little adventure in the GF syslog setup:

https://marcoscorner.walther-family.org/2008/10/glassfish-v2-and-syslogd-an-adventure/
Jerry Boonstra November 9, 2012

Interesting. I’m first going to try Syslog4j and JNA to see if i can rig it. Claims to support it.
rayman March 27, 2013

does it work on tomcat7?
i get java.lang.NoClassDefFoundError: org/apache/catalina/util/StringManager
admin Post authorApril 2, 2013

I did not try to build it for Tomcat7 yet. But it should be relatively easy to adapt.
Pingback: Apache Tomcat and Logging – The 2nd - Marco's Corner
Arun August 1, 2014

Please replace the package name for StringManager to org.apache.naming to work on Tomcat 7 version

import org.apache.naming.StringManager
admin Post authorAugust 1, 2014

There is an updated jar in https://marcoscorner.walther-family.org/2012/06/apache-tomcat-and-logging-the-2nd/ , that should work for Tomcat7.

12 thoughts on “Apache Tomcat Access Log to Syslogd”

Leave a Reply Cancel reply