Apache Tomcat

Apache Tomcat is an open-source web server and servlet container. Tomcat implements several Java EE specifications including Java Servlet, JavaServer Pages (JSP), Java EL, and WebSocket, and provides a “pure Java” HTTP web server environment for Java code to run in.

All information about the activity of the Tomcat server can be logged using the Syslog-NG server, which can be configured to send all of the data to the Logmanager server.

1. Edit the Tomcat server configuration file /etc/tomcat7/server.xml.

2. See the section <Host name=“localhost”… and update the following parameters:

   <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
       prefix="localhost_access" suffix=".log"
       rotatable="false"
       pattern='" "%{User-agent}i";"%{yyyy-mm-dd HH:mm:ss.SSSZZZ}t";"%v";"%p";"%h";"%l";"%u";"%a";"%D";"%s";"%U";"%q";"%B";"%m";"%{Referer}i";' />
   

3. Restart the Tomcat server with the command:
   /etc/init.d/tomcat7 restart

Repeat this procedure for all domains.

This completes the configuration of the Tomcat server. Now continue with configuring Syslog-NG.

Syslog writes events generated by Linux. These messages are stored locally in individual files. Messages can be set to automatically forward to the Logmanager.

Please do the following steps:

1. According to the chapter Linux Syslog-NG, check the settings of the parameters: source and @include.

2. Create a file /etc/syslog-ng/conf.d/tomcat-forward-toLM.conf.

3. Paste the following code into it:

    # configuring source
    source tomcat_access {
        file("/var/log/tomcat7/localhost_access.log" program_override("tomcat"));
    };
   
    # logging destination on the Logmanager server
    destination d_logmanager { tcp("<Logmanager_IP_address>" port(514)); };
   
    # action, i.e. sending the Tomcat message to the Logmanager server
    log { source(tomcat_access); destination(d_logmanager); };
   

   Logmanager_IP_address is the IP address of your Logmanager server.

4. Restart the Syslog-NG server with the command:
   /etc/init.d/syslog-ng restart

Now your Apache Tomcat server will be sending logs to Logmanager.