On 2/21/20, 11:36 AM, "Christopher Schultz" <[email protected]>
wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Darryl,
On 2/21/20 12:15, Darryl Philip Baker wrote:
> I have taken over the administration of several Tomcat instances.
> A number of these are load balanced using an F5 appliance. The
> org.apache.catalina.values.AccessLogValve log file is filled with
> the F5 polls to see if the application is alive. Under almost all
> circumstances these are useless, I would like to stop logging just
> these requests.
Dumb question: why bother removing them?
Not so dumb a question, I have 2 reasons. First when looking at the raw file on
the server these poles from the load balancers make it hard to find the useful
entries. The second reason is we use Splunk as a log aggregator. In Splunk it
is easy to filter these out when looking at the log but having all these almost
useless messages significantly adds to the activity of the Splunk forwarder on
these systems.
Darryl Baker, GSEC (he/him/his)
Sr. System Administrator
Distributed Application Platform Services
Northwestern University
1800 Sherman Ave.
Suite 6-600 – Box #39
Evanston, IL 60201-3715
[email protected]
(847) 467-6674
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
