A Guide to Apache Tomcat Access and Error Logs

Apache Tomcat is a popular open-source web server and servlet container that runs Java applications. It is widely used in production environments to deploy Java-based web applications. Understanding how to manage Tomcat’s logging system is crucial for monitoring application performance, diagnosing errors, and ensuring the security of your deployments.

Tomcat primarily maintains two types of logs:

1. Access Logs – Record details of incoming HTTP requests.
2. Error Logs – Capture server-side errors, application issues, and performance warnings.

This guide will walk you through how to configure, analyze, and use both types of logs in Tomcat.

---

Log & Configuration File Locations

Before getting into the specifics, it’s essential to know where Tomcat stores its logs and configuration files.

Description	Location
Access Logs	/var/log/tomcat9/localhost_access_log.*.txt
Error Logs	/var/log/tomcat9/catalina.out
Configuration Files	/etc/tomcat9/server.xml, /etc/tomcat9/logging.properties

---

Understanding Tomcat Access Logs

What Are Access Logs?

Access logs capture details of all incoming HTTP requests handled by Tomcat. These logs are useful for:

• Analyzing traffic patterns and client behavior
• Tracking resource usage and popular endpoints
• Identifying potential security threats, such as suspicious IP addresses

Configuring Access Logs

Tomcat uses the AccessLogValve element in the server.xml file to log incoming requests.

Example Configuration: Open /etc/tomcat9/server.xml and add or modify the following section:

<Valve className="org.apache.catalina.valves.AccessLogValve"
       directory="logs"
       prefix="localhost_access_log"
       suffix=".txt"
       pattern="%h %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-Agent}i\""
       fileDateFormat=".yyyy-MM-dd" />

Access Log Format

The pattern attribute specifies the format of the access logs. Here’s what the default pattern includes:

%h %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-Agent}i\"

Sample Access Log Entry:

192.168.1.10 - - [14/Nov/2024:10:15:23 +0000] "GET /index.jsp HTTP/1.1" 200 4523 "https://example.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Field	Description
%h	Client IP address
%l	Remote logname (usually ‘-‘)
%u	Authenticated user (if any)
%t	Timestamp of the request
"%r"	HTTP method, URI, and protocol
%s	HTTP status code
%b	Response size in bytes
"%{Referer}i"	Referrer URL
"%{User-Agent}i"	Client’s browser information

---

Understanding Tomcat Error Logs

What Are Error Logs?

Error logs capture issues related to Tomcat’s operation, such as misconfigurations, application errors, or JVM issues. These logs are essential for troubleshooting and maintaining server stability.

Configuring Error Logs

By default, Tomcat logs errors to catalina.out. You can control the logging behavior using the logging.properties file, located in /etc/tomcat9/.

To adjust logging levels:

1. Open /etc/tomcat9/logging.properties.
2. Modify the logging level for different components:

org.apache.catalina.level = INFO
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = SEVERE

Error Log Levels

Tomcat supports several logging levels:

Level	Description
SEVERE	Critical errors that require immediate attention
WARNING	Potential issues that may need investigation
INFO	General informational messages
CONFIG	Configuration-related messages
FINE	Debugging information
FINER	Detailed debugging information
FINEST	Highly detailed debugging information

Sample Error Log Entry

An example of an entry in catalina.out:

14-Nov-2024 10:16:45.123 SEVERE [http-nio-8080-exec-10] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [jsp] in context [/example] threw exception
 java.lang.NullPointerException
    at com.example.MyServlet.doGet(MyServlet.java:42)

Explanation:

• The log entry indicates a NullPointerException in the MyServlet class at line 42.

Common Error Types

Here are some typical Tomcat error log messages:

Error Message	Description
Servlet.service() threw exception	An unhandled exception occurred in a servlet
OutOfMemoryError: Java heap space	The server has run out of memory
404 Not Found	The requested resource could not be found
Connection reset	The client closed the connection prematurely

---

Configuring Logs for Virtual Hosts

Tomcat allows you to configure separate logs for different virtual hosts. This can be useful if you are running multiple applications on the same server:

1. Open the server.xml file.
2. Add the AccessLogValve within the <Host> section for each virtual host:

<Host name="example.com" appBase="webapps/example">
    <Valve className="org.apache.catalina.valves.AccessLogValve"
           directory="logs/example"
           prefix="access_log"
           suffix=".txt"
           pattern="%h %l %u %t \"%r\" %s %b" />
</Host>

This configuration will log access requests for example.com in a separate log file.

---

Mastering Tomcat logs is crucial for maintaining the performance, security, and stability of your Java applications. By effectively configuring and analyzing access and error logs, you can gain insights into your server’s operations, diagnose issues quickly, and optimize application performance.

Use this guide to optimize your Tomcat logging setup and enhance your server management capabilities.