2

Our project consists of 3 webapplcations that communicate with each other via web services. All 3 web apps are running on 3 different web servers that run as a cluster with load balancer. (spring , tomcat, mysql)

Our CTO mentioned that in production, it can be very helpfull to invistigate errors on log on a single unified log file that is consist of all the webapplication log files combined together.

this way it is very easy to see in the log the whole flow across the webapps and not skipping from one log file to another (for each webapp log)

after a quick research we found that combining all the logs into a single file may cause corrupt file error of the log file itself. (we are using slf4j with log4j configuration)

So basically we have 3 questions:

1) Is it a good practice to combine all of the web apps log into one?

2) Whats the best way to achieve that (non corrupted log file will be nice)

3) Is it possible \ relevant to do the same concept of log unification in regard to tomcat logs? (unify all unified logs of all tomcats in the same cluster)

Urbanleg
  • 6,252
  • 16
  • 76
  • 139
  • Instead of trying to come up with your own sollution, you could also try some specialized products like [Logentries](https://logentries.com/) or any other monitoring tool that supports log analysis. – JanM May 21 '15 at 15:32

2 Answers2

1

Logging to the same file from multiple servers can get very messy. You inevitably end up with multiple servers attempting to update files simultaneously, which has a habit of causing problems such as weirdly intermingled output and locking.

Given that you're using Log4J, then you should check out JMS queue appenders:

http://logging.apache.org/log4j/2.x/manual/appenders.html#JMSQueueAppender

Using this, every server logs to a JMS queue, and you can set up a listener which logs to file on a separate server.

A reasonable alternative would be to do a little bit of Perl scripting to grab the files and merge them periodically, or on demand.

You will probably find messages which are out of step with each other. That's because each server will be buffering up log output to avoid blocking your application processes.

Steve
  • 9,270
  • 5
  • 47
  • 61
1

Logging just the errors to a common place is useful. You can continue to log to each application's log, but you can add remote logging for selected entries (e.g. anything with Level=ERROR).

The easiest way to set this up is to run a SocketServer on one of your machines.

Here's an example that shows how to configure it.

Community
  • 1
  • 1
Darius X.
  • 2,886
  • 4
  • 24
  • 51