Tomcat Enterprise Log Rotation & Rsyslog

1. Linux logrotate Policy (/etc/logrotate.d/tomcat)

Standard Tomcat directs standard output and standard error unbuffered to catalina.out. The copytruncate directive is mandatory to prevent JVM file handle locking:

/opt/tomcat/logs/catalina.out {
    copytruncate
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 0640 tomcat tomcat
    dateext
    dateformat -%Y%m%d
    size 100M
}

copytruncate: Truncates the original file in place without renaming it, preventing Tomcat crash from lost file handles.
delaycompress: Postpones compression to the next rotation cycle so active log tailing is uninterrupted.

2. rsyslog Centralized Forwarding (/etc/rsyslog.d/30-tomcat.conf)

Forward Tomcat application and access logs directly to centralized logging clusters (Graylog, Splunk, Datadog, Elasticsearch) with reliable disk-assisted memory queues:

# Module loading for file tailing
module(load="imfile" PollingInterval="2")

# Input definition for Tomcat Access Logs
input(type="imfile"
      File="/opt/tomcat/logs/localhost_access_log.*.txt"
      Tag="tomcat-access:"
      Severity="info"
      Facility="local0")

# Input definition for Catalina Output
input(type="imfile"
      File="/opt/tomcat/logs/catalina.out"
      Tag="tomcat-catalina:"
      Severity="notice"
      Facility="local0")

# Disk-Assisted High Availability Forwarding Queue
local0.* action(type="omfwd"
        target="siem.internal.corp"
        port="514"
        protocol="tcp"
        action.resumeRetryCount="-1"
        queue.type="LinkedList"
        queue.filename="q_tomcat_fwd"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on")

3. High-Precision AccessLogValve with Latency Telemetry (%D)

Configure buffered access logging in conf/server.xml to log request duration in milliseconds (%D):

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
       prefix="localhost_access_log" suffix=".txt"
       pattern="%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-Agent}i" %D"
       buffered="true"
       rotatable="true" />