web.jboss

The tags beginning with web.jboss identify log events generated by the JBoss web application server and the access logs of the applications the server hosts.  The JBoss v7 server generates a boot and server log. You can configure access logs for each of the applications that runs on the JBoss server.

This article describes the tag naming structure, a little about logging in JBoss v7, and how to send log events from the JBoss server to Devo using rsyslog.

Tag structure

The full tag must have at least six levels. The first two are fixed as web.jboss. The third level identifies the log type/format and currently must be one of boot, access-clf, access-combined, access-lt, or server.

The fourth, fifth and sixth levels are required and should identify the environment type, web application, and instance respectively. 

• environment - Describes the environment in when the event occurred. For example, development, testing, or production.
• web application - The name of the web application.
• clon - This is the instance that generated the event. Depending on your network, this can be a machine name, or the virtual name of a JBoss process.

The values of these levels should be guided by the structure we propose because they will be saved in the events when saved in Devo. When you open the resulting data table, these will appear in the environment, site and clon columns.

Therefore, the valid tags include:

• web.jboss.boot.env.app.clon
• web.jboss.access-clf.env.app.clon
• web.jboss.access-combined.env.app.clon
• web.jboss.access-lt.env.app.clon
• web.jboss.server.env.app.clon
  

For more information, read more about Devo tags.

JBoss logs

Server.log and boot.log

For general information about these log files and their default directories, see the JBoss Documentation.

You should review the configuration for the generation of boot.log and modify it as needed. You want to ensure it is generated using the default PATTERN formatter and that it is written in append mode. The configuration file is usually found in standalone/configuration/logging.properties or domain/configuration/logging.properties depending on if the server is started in managed domain or standalone server mode.

These are the lines you should review and edit as needed:

# File handler configuration
handler.FILE=org.jboss.logmanager.handlers.FileHandler
handler.FILE.level=DEBUG
handler.FILE.properties=autoFlush,append,fileName
handler.FILE.autoFlush=true
handler.FILE.append=true
handler.FILE.fileName=${org.jboss.boot.log.file:boot.log}
handler.FILE.formatter=PATTERN

Access logs (access_log.yyyy-MM-dd)

JBoss v7 access log files are identical to those of the Apache Tomcat application server but you can control the actual event content in terms of format and fields included. 

The access log is not enabled by default so you need to edit the urn:jboss:domain:web:1.1 subsystem in the standalone/configuration/standalone.xml file to add the access-log definition as in this example:

<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
    <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
    <virtual-server name="default-host" enable-welcome-root="true">
        <alias name="localhost"/>
            <access-log rotate="false" prefix="access_log.txt" pattern="combined" >
                <directory path="." relative-to="jboss.server.log.dir" />
            </access-log>
    </virtual-server>
</subsystem>

Devo supports three formats for access logs; two of them are based upon standard formats and the other is defined by Devo to offer a format that contains more details. Each of these formats corresponds with the third level of an access log tag.

The log format that corresponds to the web.jboss.access-clf tag is based on the Common Log Format (CLF). The specification of this format is:

pattern="%h %l %u %t "%r" %s %b" pattern="common"

The log format that corresponds to the web.jboss.access-combined tag is based on the NCSA Combined log format. The specification of this format is:

pattern="%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-Agent}i"" pattern="combined"

The log format that corresponds to the web.jboss.access-lt tag is a custom format defined by Devo to offer more detailed logging. The specification of this format that includes cookie names is:

pattern="%t %a %l %u %S %v:%p %m "%U%q" %H "%{Referer}i" "%{User-Agent}i" "%{cookieName1}c:%{cookieName2}c" %s %D %B %I"

 However, if you prefer not to include cookie names in your events, use this specification instead. 

pattern="%t %a %l %u %S %v:%p %m "%U%q" %H "%{Referer}i" "%{User-Agent}i" "" %s %D %B %I"

Sending to Devo using file monitoring 

Using rsyslog in Unix-like environments

You can read more about using rsyslog to monitor and send files to a Devo endpoint in the Sending data to Devo section of our documentation. Here we offer a sample rsyslog configuration file that is set up to monitor the server and boot logs and one access log, and forward them to a Devo Relay.

$template jboss,"<%PRI%>%timegenerated% %HOSTNAME% %syslogtag% %msg%"
 
# File server.log
$InputFileName JBOSS_PATH/standalone/log/server.log
$InputFileTag web.jboss.server.ENV.APP.CLON:
$InputFileStateFile stat-jboss-server1
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# File boot.log
$InputFileName JBOSS_PATH/standalone/log/boot.log
$InputFileTag web.jboss.boot.ENV.APP.CLON:
$InputFileStateFile stat-jboss-boot1
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# File access log
$InputFileName JBOSS_PATH/standalone/log/access_log.txt
$InputFileTag web.jboss.access-combined.ENV.APP.CLON:
$InputFileStateFile stat-jboss-accessCombined1
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# SSL config for DEVO cloud
#$DefaultNetstreamDriver gtls # use gtls netstream driver
#$DefaultNetstreamDriverCAFile /etc/rsyslog.d/ca.crt
#$DefaultNetstreamDriverCertFile /etc/rsyslog.d/user.crt
#$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/user.key
#$ActionSendStreamDriverMode 1 # require TLS for the connection
#$ActionSendStreamDriverAuthMode x509/name
#$ActionSendStreamDriverPermittedPeer collector
 
if $syslogtag contains 'web.jboss.' and $syslogfacility-text == 'local7' then @@DEVO-RELAY:PORT;jboss
:syslogtag, contains, "web.jboss." ~

Note the following placeholder values in the sample file above:

• JBOSS_PATH should be the absolute path where your JBoss log files reside. 
• Replace ENV.APP.CLON with the values that represent the source environment, application, and instance.
• In this example, the access log uses the accessCombined tag. You should specify the tag that corresponds to the format you have elected to use.
• Replace DEVO-RELAY and PORT with the IP address and port of your Devo Relay. 

You can uncomment the SSL section of the file to send the events directly to the Devo Cloud. In this case, you should replace DEVO-RELAY and PORT with the hostname of your Devo domain and port 443. 

Make sure that the file you are sending and the directory where resides can be read by the user running rsyslog. If not, you can assign the necessary permissions by changing the file group to syslog:

chown :syslog /opt/jboss/standalone/log /opt/jboss/standalone/log/*
chmod 750 /opt/jboss/standalone/log
chmod 640 /opt/jboss/standalone/log/*

To configure file rotation, you can use the logrotate utility. The following in an example of a jboss.conf might be set up.

/opt/jboss/standalone/log/server.log /opt/jboss/standalone/log/boot.log /opt/jboss/standalone/log/access_log.txt
{
    rotate 14
    daily
    copytruncate
    missingok
    notifempty
    delaycompress
    compress
    sharedscripts
    lastaction
        service rsyslog stop
        rm -f /var/spool/rsyslog/stat-jboss-*
        service rsyslog start
    endscript
}

When you have made all the configuration changes necessary, don't forget to restart the rsyslog process:

/etc/init.d/rsyslog restart

Windows environments

When running JBoss on Windows, Devo recommends using the MagicLog component of the Devo Agent for Windows to forward the log events to Devo. You can also use the third-party tool, Snare Epilog. 

In both cases:

• Make sure the logs are written in text files.
• Have the complete paths to the log files on hand when setting up the sending.

Related articles

• Secure sending using rsyslog
• Monitoring files using rsyslog
• Devo Agent for Windows
• List of Devo parsers