Tomcat Access Logging

Setting up Logging

To setup access logging, edit the Tomcat server configuration file, ${tomcat_home}/conf/server.xml and uncomment the AccessLogValve:

        <Valve className="org.apache.catalina.valves.AccessLogValve"
                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
                 pattern="common" resolveHosts="false"/>

By default the log files are created in the ${tomcat_home}/logs directory and roll over to a new file at midnight.
The log messages can be written in either of two standard web access log formats by setting the pattern attribute to common or combined. These appear to be the ones used by web log analysers. Other log formats can be specified with the pattern attribute.

Modifying the Log Format

We can extend the "common" and "combined" patterns by appending the response time for each request. To use this, set the

• common: pattern="common"
• common plus response time: pattern="%h %l %u %t "%r" %s %b %D"
• combined: pattern="combined"
• combined plus response time: pattern="%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-Agent}i" %D"

Using FastCommonAccessLogValve

The FastCommonAccessLogValve has better performance than the AccessLogValve. If you are running a production system, you might consider switching to the FastCommonAccessLogValve. The main restriction is that only the "common" and "combined" log formats can be used.

        <Valve className="org.apache.catalina.valves.FastCommonAccessLogValve"
                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
                 pattern="common" resolveHosts="false"/>

The Logging Output

Here is a sample entry from the motherlode logs, using the combined plus response time pattern.
Example log entry:

82.93.133.81 - joe [01/Jul/2007:08:44:38 -0600] "GET /thredds/dodsC/fmrc/NCEP/GFS/Global_0p5deg/offset/NCEP-GFS-Global_0p5deg_Offset_0.0
hr.dds HTTP/1.1" 200 32707 "null" "IDV/NetcdfJava/HttpClient" 2999

Example Value	Meaning
82.93.133.81	client IP address
-	not used
joe	authenticated username
[01/Jul/2007:08:44:38 -0600]	request time
"GET ..."	HTTP request verb and path
200	HTTP response code
32707	bytes transferred
"null"	Referer
"IDV/NetcdfJava/HttpClient"	client name
2999	response time in msecs

Values for the pattern attribute are made up of literal text strings, combined with pattern identifiers prefixed by the "%" character to cause replacement by the corresponding variable value from the current request and response. The following pattern codes are supported:

• %a - Remote IP address
• %A - Local IP address
• %b - Bytes sent, excluding HTTP headers, or '-' if zero
• %B - Bytes sent, excluding HTTP headers
• %h - Remote host name (or IP address if resolveHosts is false)
• %H - Request protocol
• %l - Remote logical username from identd (always returns '-')
• %m - Request method (GET, POST, etc.)
• %p - Local port on which this request was received
• %q - Query string (prepended with a '?' if it exists)
• %r - First line of the request (method and request URI)
• %s - HTTP status code of the response
• %S - User session ID
• %t - Date and time, in Common Log Format
• %u - Remote user that was authenticated (if any), else '-'
• %U - Requested URL path
• %v - Local server name
• %D - Time taken to process the request, in millis
• %T - Time taken to process the request, in seconds
• %I - current request thread name (can compare later with stacktraces)

There is also support to write information from the cookie, incoming header, outgoing response headers, the Session or something else in the ServletRequest. It is modeled after the apache syntax:

• %{xxx}i for incoming request headers
• %{xxx}o for outgoing response headers
• %{xxx}c for a specific request cookie
• %{xxx}r xxx is an attribute in the ServletRequest
• %{xxx}s xxx is an attribute in the HttpSession

The shorthand pattern name common (which is also the default) corresponds to '%h %l %u %t "%r" %s %b'.

The shorthand pattern name combined appends the values of the Referer and User-Agent headers, each in double quotes, to the common pattern described in the previous paragraph.

More information on the AccessLogValve and the pattern attribute can be found on the Tomcat Valve Configuration Reference.