Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have Tomcat running on Ubuntu server. It runs a web service, open to the internet.

Sometimes it has a sudden spike of traffic and goes down. There is nothing unusual in Tomcat access logs. I guess it is because some of the requests are so 'heavy' that they never finish and hence are not recorded to Tomcat access logs.

Is there a way to configure Ubuntu or a 3rd party tool to log incoming requests in the following format (below)?

Date, Time, URL (with query string params), IP address (of client)

There should be one line per request. Each request should be logged before it is executed. Only incoming requests to ports 80 and 443 should be logged.

share|improve this question
    
Are you talking about http requests? The os knows nothing of anything above tcp, that's all on the server daemon. –  Robbie Mckennie Jul 2 '13 at 10:43
    
Ok, a third party tool would do as well. I am concerned about using Tomcat logging since it hangs and may not be able to log the details. –  Maxim Eliseev Jul 2 '13 at 11:36
    
Why is the downvote? –  Maxim Eliseev Jul 2 '13 at 11:36
    
You didn't answer my question, what exactly are you trying to log? –  Robbie Mckennie Jul 4 '13 at 1:57
    
I am trying to log the URLS and IP addresses of HTTP requests coming from the internet to our web service. Example: –  Maxim Eliseev Jul 4 '13 at 8:36

2 Answers 2

up vote 1 down vote accepted

2 possible solutions for you.

  1. Configure squid or similar to act as a reverse proxy, look up 'squid reverse proxy'. caveat: You may find you have compatibility issues, but i'm no expert.
  2. It is possible to use iptables to log traffic coming into your server. See the LOG target in the iptables man-page. caveat: iptables will NOT be http aware. You will get all the information you want except the requested url.
share|improve this answer
    
Accepted for both reverse proxy and IP tables ideas. –  Maxim Eliseev Jul 5 '13 at 13:18

Install nginx (or Apache) and configure it as a simple reverse proxy in front of Tomcat. Below is a sample configuration you can use in a virtual host in nginx. The default access log format should give you the information you need.

server {
  listen 80;
  server_name www.example.org example.org;

  location /context/ {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://tomcat-server:8080/context/;
  }

  access_log /var/log/nginx/www.example.org-access.log;
  error_log /var/log/nginx/www.example.org-error.log;
}

Edit: Even if Tomcat was unable to serve the request, it should be logged in nginx (and also in Tomcat).

share|improve this answer
1  
Thank you! I am going to upvote you when I have 15 reputation. –  Maxim Eliseev Jul 5 '13 at 13:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.