具有日志轮换功能的JBoss访问日志 [英] JBoss access logs with log rotation
问题描述
我试图告诉我的jboss编写包含我需要的所有信息的访问日志，并每天进行日志轮换.到目前为止，这不是问题.最终目标是使用logstash转发器将所有访问日志条目发送到麋鹿堆栈.也没什么大不了的.我现在遇到的问题是定义访问日志名称.
I'm trying to tell my jboss to write an access log with all information I need and use a daily log rotation. So far this is not an issue. The ultimate goal is to send all access log entries to an elk stack using logstash forwarder. Also not that big a deal. The problem I'm having now is to define the access logs names.
JBoss提供了开箱即用的日志轮换功能，但为每个日志文件添加了时间戳，因此今天的文件也具有时间戳后缀.
JBoss offers log rotation out of the box but adds a timestamp to each logfile so todays file also has a timestamp suffix.
我要实现的行为与tomcat或jbosses server.log相同.这意味着今天的文件应仅命名为access.log，并且仅在今天的文件成为昨天的文件并因此转为无效状态时才附加后缀.
What I want to achive is the same behavior as tomcat or as jbosses server.log. Meaning todays file should just be named access.log and only have a suffix appended when todays file becomes yesterdays file and hence is rotated into inactve state.
我的jboss配置如下:
my jboss config looks like this:
<subsystem xmlns="urn:jboss:domain:logging:1.3">
<periodic-rotating-file-handler name="FILE" autoflush="true">
<formatter>
<pattern-formatter pattern="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n"/>
</formatter>
<file relative-to="jboss.server.log.dir" path="server.log"/>
<suffix value=".yyyy-MM-dd"/>
<append value="true"/>
</periodic-rotating-file-handler>
<periodic-rotating-file-handler name="ACCESS" autoflush="true">
<formatter>
<pattern-formatter pattern="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n"/>
</formatter>
<file relative-to="jboss.server.log.dir" path="access.log"/>
<suffix value=".yyyy-MM-dd"/>
<append value="true"/>
</periodic-rotating-file-handler>
<logger category="com.arjuna">
<level name="WARN"/>
</logger>
<logger category="org.apache.tomcat.util.modeler">
<level name="WARN"/>
</logger>
<logger category="org.jboss.as.config">
<level name="DEBUG"/>
</logger>
<logger category="sun.rmi">
<level name="WARN"/>
</logger>
<logger category="jacorb">
<level name="WARN"/>
</logger>
<logger category="jacorb.config">
<level name="ERROR"/>
</logger>
<root-logger>
<level name="INFO"/>
<handlers>
<handler name="FILE"/>
<handler name="ACCESS"/>
</handlers>
</root-logger>
</subsystem>
这是我的启用了日志轮转的access-log配置(上面已提到了时间戳行为).当我设置rotate ="false"时，我会得到一个access.log，它没有被批准.
And here is my access-log config with log rotation enabled (has above mentioned timestamp behavior). When I set rotate="false" I get an access.log which it's not ratated.
<subsystem xmlns="urn:jboss:domain:web:1.5" default-virtual-server="default-host" native="false">
<connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
<virtual-server name="default-host" enable-welcome-root="true">
<alias name="localhost"/>
<alias name="example.com"/>
<access-log pattern=""%{HOST}i" - %h %t "%m" "%U" - "%q" - "%H" - %s %B "%{User-Agent}i" %T %D "%p"" prefix="access.log" rotate="true">
<directory path="."/>
</access-log>
</virtual-server>
</subsystem>
现在，我看到了两种将日志文件发送到我的麋鹿堆栈的方法.首先是在没有时间戳的情况下写入access.log并在旋转时添加时间戳，以便logstash转发器始终可以读取access.log.其次是设置转发器配置，以始终检查最新的access.log文件.这样，带有时间戳的文件名就不会成为问题.但是我不知道那是否可能.
Right now I see two ways to send the logfiles to my elk stack. First is writing into an access.log with no timestamp and add timestamp on rotation so the logstash forwarder can always read access.log. Second is set up the forwarders config to always check the newest access.log file. This way the timestamped filename wouldn't be an issue. But I don't know if thats possible.
如果有任何建议，我将不胜感激.谢谢并恭祝安康.塞巴斯蒂安
I'd be grateful for any advice. Thanks and regards. Sebastian
推荐答案
注意
- 以下解决方案已在 EAP 7.0/Wildfly 10 上进行了测试.
- 下面显示的所有配置均在
standalone.xml中完成
- The solution below is tested on EAP 7.0/Wildfly 10.
- All configuration shown below is done in
standalone.xml
JBoss EAP/Wildfly的访问日志直接附带的日志轮换是非常基本的，并且有一些限制.在上面的问题中，日志旋转如下激活
The log rotation that comes directly with the access-log of JBoss EAP / Wildfly is very basic and has some limitations. In the question above the log rotation is activated as follows
<access-log .... rotate="true" />
在我们的案例中，我们通过不使用日志并将访问日志发送到一般服务器日志(请注意use-server-log="true")来解决日志循环不佳的问题.
In our case we solved the poor log rotation by not using it and sending the access log to general server log (note use-server-log="true").
<subsystem xmlns="urn:jboss:domain:undertow:4.0">
...
<server name="default-server">
<http-listener name="default" socket-binding="http" record-request-start-time="true" redirect-socket="https" />
<https-listener name="https" socket-binding="https" record-request-start-time="true" security-realm="ApplicationRealm" />
<host name="default-host" alias="localhost">
<!-- how to access log see https://access.redhat.com/solutions/2423311 -->
<!-- access log pattern see http://undertow.io/javadoc/1.3.x/io/undertow/server/handlers/accesslog/AccessLogHandler.html -->
<!-- Hint: access log is sent to server log (use-server-log="true") in order to add proper log file rolling/purging and set a readable timestamp -->
<access-log pattern="%h %l %u "%r" %s %b "%{i,Referer}" "%{i,User-Agent}" "%{i,COOKIE}" "%{o,SET-COOKIE}" %S "%I" %T" use-server-log="true"/>
...
</host>
</server>
重要的是不要忘记http-listener上的record-request-start-time="true"，否则您将不会获得任何计时日志.
Important do not forget the record-request-start-time="true" on the http-listener otherwise you will not get any timing logs.
在<subsystem xmlns="urn:jboss:domain:logging部分，我们将访问日志记录配置如下:
In the <subsystem xmlns="urn:jboss:domain:logging section we configured access logging as follows:
<profile>
<subsystem xmlns="urn:jboss:domain:logging:3.0">
...
<!-- log rotate access.log by size to avoid disk-full -->
<size-rotating-file-handler name="ACCESS" autoflush="true">
<formatter>
<pattern-formatter pattern="[%d] - %s%n"/>
</formatter>
<file relative-to="jboss.server.log.dir" path="access.log"/>
<rotate-size value="10485760"/>
<max-backup-index value="5"/>
<append value="true"/>
</size-rotating-file-handler>
...
<logger category="io.undertow.accesslog" use-parent-handlers="false">
<handlers>
<handler name="ACCESS"/>
</handlers>
</logger>
<root-logger>
<level name="INFO"/>
<handlers>
<handler name="CONSOLE"/>
<handler name="FILE"/>
</handlers>
</root-logger>
...
</subsystem>
这将最多创建5个访问日志文件，每个10MB.还有其他可用的日志处理程序，例如每天滚动.
This will create at maximum 5 access log files with each 10MB. There are also other log handlers that are available e.g. daily rolling.
有关如何配置JBoss Logging/LogHandlers的信息:
Information about how to configure JBoss Logging / LogHandlers:
- https://access.redhat.com /documentation/zh-CN/red_hat_jboss_enterprise_application_platform/7.0/html/configuration_guide/logging_with_jboss_eap
- https://access.redhathat .com/documentation/zh-CN/red_hat_jboss_enterprise_application_platform/7.0/html/configuration_guide/logging_with_jboss_eap#configuring_log_handlers
- https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.0/html/configuration_guide/logging_with_jboss_eap
- https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.0/html/configuration_guide/logging_with_jboss_eap#configuring_log_handlers
此处为拥有RedHat帐户的用户提供更多信息:
Further information here for those having a RedHat Account:
- https://access.redhat.com/solutions/2423311
- https://access.redhat.com/solutions/2773641
这篇关于具有日志轮换功能的JBoss访问日志的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
