0

We have Tomcat running on Ubuntu server. It runs a web service, open to the internet.

Sometimes it has sudden spike of traffic and goes down. There is nothing unusual in Tomcat access logs. I guess because some of the requests are so 'heavy' that they never finish and hence are not recorded to Tomcat access logs.

Is there a way to configure Ubuntu to log incoming requests in the following format (below)?

Date, Time, URL (with query string params), IP address (of client)

There should be one line per request. Each request should be logged before it is executed. Only incoming requests to ports 80 and 443 should be logged.

  • I would recommend asking this question on stackoverflow.com – January Jul 2 '13 at 10:46
  • If there is nothing in the access logs, how do you know there is a spike in traffic? – David Edwards Jul 2 '13 at 13:25
  • The server is hosted on Amazon. I see the "Network in" spike in CloudWatch metrics for that instance (virtual server). – Maxim Eliseev Jul 2 '13 at 14:20
  • So it might not be requests to Tomcat causing the spikes. Tomcat will eventually log to its access logs, even if the request takes a long time. If you have requests that never end, you'll see them in a thread dump of Tomcat. You can use tcpdump during a spike to see what the network traffic is. You might get more help asking on the AWS forums or serverfault.com. – David Edwards Jul 2 '13 at 15:19
0

Tomcat will eventually log all requests to its access logs, even if the request takes a long time to complete. If you have requests that never end, you'll see them in a thread dump of Tomcat. You can do a thread dump by running kill -3 PID where PID is the process id of the Tomcat JVM. You can run ps aux | grep java to find the process id; it's the number in the 2nd column.

However, if you're not seeing anything obvious in the Tomcat access logs already, then the network traffic might not be going to Tomcat.

You could try using tcpdump to monitor what network traffic you are getting whilst the spike is occurring. See the man page for more information.

Depending on the cause of the spike, you might want to try asking on the AWS Developer Forums or on Server Fault where there is a larger population of system administrators.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.