1

At my work someone once setup Tomcat to log to syslog. The problem is that these messages also get sent to the console.

The system is RHEL6, these are the involved RPM's

rsyslog-5.8.10-10.el6_6.x86_64
tomcat-7.0.64-1.x86_64

I tried to silence messages to the console using these two commands:

dmesg -n 1
sysctl -w kernel.printk="1 4 1 3"

These made no difference, these messages still keep coming. Log4j does not seem to be used on this system. In server.xml from Tomcat this section is for logging:

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
       prefix="localhost_access_log." suffix=".txt" rotatable="false"
       pattern="%h %l %u %t &quot;%r&quot; %s %b" />

If I stop rsyslog it will stop these messages. I don’t know what was done to setup logging to rsyslog from Tomcat, I am no Tomcat expert. Tomcat is the only application sending message to console. Other stuff gets sent to rsyslog but nothing gets logged to console other than Tomcat stuff.

Since I tried command dmesg -n 1 I suspect Tomcat is sending messages on highest level, but I cannot find any code that could be responsible for that.

Example of a message on the console (note that it says tomcat-instance06, its a self-made RPM to allow for multiple Tomcat instances). I just noticed it always shows a [FATAL] message on the console, and then a second message about the same:

Message from syslogd@localhost at Jun 22 16:52:12 ...
 [FATAL] some.portal-app: [model.website.PageService] RequestID already used - ...#012Detail: #012detail#012Tag context: #012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 486#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 484#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, l...

Message from syslogd@...ine at Jun 22 16:52:12 ...
 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 482#012/opt/tomcat-instance06/webapps/ROOT/model/WebserviceRequest.cfc, line 268#012/opt/tomcat-instance06/webapps/ROOT/model/website/PageService.cfc, line 194#012/opt/tomcat-instance06/webapps/ROOT/model/website/PageService.cfc, line 86#012/opt/tomcat-instance06/webapps/ROOT/model/RequestContextDecorator.cfc, line 16#012/opt/tomcat-instance06/webapps/ROOT/model/RequestContextDecorator.cfc, line 232#012/opt/tomcat-instance06/webapps/ROOT/handlers/General.cfc, line 596#012/opt/tomcat-instance06/webapps/ROOT/coldbox/system/web/Controller.cfc, line 764#012/opt/tomcat-instance06/webapps/ROOT/coldbox/system/web/Controller.cfc, line 648#012/opt/tomcat-instance06/webapps/ROOT/coldbox/system/web/services/ExceptionService.cfc, line 51#012/opt/tomcat-instance06/webapps/ROOT/coldbox/system/Coldbox.cfc, line 350#012/opt/tomcat-instance06/webapps/ROOT/coldbox/system/Coldbox.cfc, line 382#012/opt/tomcat-instance06/webapps/ROOT/Application.cfc, line 60

This is the contents of /etc/rsyslog.conf:

#
# Use traditional timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog

# Provides --MARK-- message capability
$ModLoad immark

# Provides support for local system logging (e.g. via logger command)
$ModLoad  imuxsock

# set ratelimit interval
$SystemLogRateLimitInterval 2
$SystemLogRateLimitBurst 150

# Provides UDP syslog reception
$ModLoad  imudp

# Syslog server listen address
$UDPServerAddress 127.0.0.1

# Syslog server listen UDP port
$UDPServerRun 514

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.*                                                  /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none;local0.none;local6.none  /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                                        /var/log/secure
# Log all the mail messages in one place.
mail.*                                                           -/var/log/mail.log

# Log cron stuff
cron.*                                                            /var/log/cron

# Everybody gets emergency messages
*.emerg                                                           *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                                    /var/log/spooler

# Save boot messages also to boot.log
local6.warning                                                    /var/log/audit_orcl.log
LOCAL6.WARNING                                                    /var/log/audit_orcl.log

# Save boot messages also to boot.log
local7.*                                                          /var/log/boot.log

# Log all messages to the following syslog servers
<I have removed this section containing ip's of syslogservers>

In /etc/rsyslog.conf have tried to comment out kern.*

#kern.*                                                  /dev/console

But after restarting rsyslog it still logs these tomcat messages to console :(

Any idea’s where to look to disable these messages?

  • First, happy you were able to solve your issue. But please do not edit your question—or the question title—to add “(SOLVED)” to it. Your question is good and your answer solves it and is good as well. So that’s all good. When you can—in a day or so—please be sure to check off your answer as the solution. That is the way to indicate a problem has been solved. – JakeGould Jun 22 '16 at 15:30
2

Found it (duh).

Commenting out this in /etc/rsyslog.conf stopped the messages:

# Everybody gets emergency messages
*.emerg                        *

And also found out the the fact that tomcat is the only application logging to this continuously is due to a badly programmed application logging each message as fatal, causing it to go to the console.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.