Eat BEA WebLogic® server logs

Eat BEA WebLogic® server logs

Part of what we'd like to provide over time is information about logging for common components of distributed applications.

The WebLogic logging infrastructure supports a logger on each server which collects the log events generated by your own applications and subsystems. By default, WebLogic logging services use an implementation based on the Java Logging APIs. You can implement logging in a variety of other ways, either via internal WebLogic tools, or using Log4J or the Commons API. For information on configuring WebLogic logging services, see the following documentation on the Oracle website:

• Configuring Log Files and Filtering Log Messages
• Using WebLogic Logging Services for Application Logging

This topic lists the locations of the main types of logs produced by a WebLogic implementation.

WebLogic server logs

Splunk recognizes the WebLogic server log format as one of Splunk's pretrained sourcetypes. To eat these logs, monitor these files and assign them the Splunk sourcetype weblogic_stdout. The server files can be monitored in one of two locations:

• You can monitor the individual server log file on each WebLogic server instance using Splunk forwarders and send the logs to a central Splunk server. The default location for the WebLogic server log file is DOMAIN_NAME\servers\SERVER_NAME\logs\SERVER_NAME.log, where DOMAIN_NAME is the name of the directory in which you located the domain and SERVER_NAME is the name of the server.

• You can monitor the domain log file. Each server instance forwards a subset of its messages to a domain-wide log file. (By default, servers forward only messages of severity level NOTICE or higher.) The domain log resides in DOMAIN_NAME\servers\ADMIN_SERVER_NAME\logs\DOMAIN_NAME.log, where DOMAIN_NAME is the name of the directory in which you located the domain and ADMIN_SERVER_NAME is the name of the Administration Server.

Here is an example of a message in the server log file.

####<Sept 22, 2004 10:46:51 AM EST> <Notice> <WebLogicServer> <MyComputer> <examplesServer> <main> <<WLS Kernel>> <> <null> <1080575211904> <BEA-000360> <Server started in RUNNING mode>

Additional logs

• The HTTP subsystem keeps a log of all HTTP transactions in a text file located in the same directory as the server log.
• If you use the Node Manager to start a Managed Server, messages are written to a single log file for that server instance, located at DOMAIN_NAME\servers\SERVER_NAME\logs\SERVER_NAME.out.
• The Node Manager writes its startup and status messages to a single log file, NM_HOME/nodemanager.log, where NM_HOME designates the Node Manager installation directory, by default, WL_HOME/common/nodemanager.
• The WebLogic Auditing provider saves all its auditing information in WL_HOME\DOMAIN_NAME\servers\SERVER_NAME\logs\DefaultAuditRecorder.log. This is done per server, not per security realm. Configuring an Auditing provider is optional; it is not configured by default.
• The JDBC subsystem writes events related to JDBC to the server log.
• The JMS message log is located in DOMAIN_NAME\servers\SERVER_NAME\logs\jmsServers\SERVER_NAMEJMSServer\jms.messages.log. JMS logging is enabled by default when you create a JMS server, however, you must specifically enable it on message destinations in the JMS modules targeted to this JMS server.
• The JVM, in which a WebLogic Server instance runs, sends messages to standard error and standard out. Through a configuration option, you can redirect the JVM output to all the registered log destinations, like the server terminal console and log file. When enabled, a log entry appears as a message of NOTICE severity. Redirecting the JVM output does not capture output from native code, for example thread dumps from the JVM.

WebLogic configuration file

The config.xml file, located in the domain directory, is a persistent store for the managed objects that WebLogic Server creates and modifies during execution. The purpose of config.xml is to store changes to managed objects so that they are available when WebLogic Server is restarted. You normally use the Administration Console to configure WebLogic Server's manageable objects and services and allow WebLogic Server to maintain the config.xml file. See WebLogic Server Configuration Reference on the Oracle website for information on config.xml.

You can use Splunk's fschange functionality to monitor config.xml and write an event to Splunk whenever the file changes. See Configuration monitoring in this manual for an example of how to set up fschange.

Note: BEA WebLogic and BEA WebLogic Server are trademarks or registered trademarks of BEA Systems, Inc.

• Was this topic useful?
• Post a comment