Connection Access Logs and Events.

[Normann P. Nielsen - TDC/Netic]

Working on some access/event loggging for both Confluence and JIRA:

http://www.mos-eisley.dk/display/ATLASSIAN/Access+Logging+in+Confluence

http://www.mos-eisley.dk/display/ATLASSIAN/Logging+PageEvents+to+Splunk

(Work in progress - comments welcome)

I would like to corrolate access logs and/or catalina.out from Tomcat with Confluence Events. In catalina.out, there is a "token", can this token be found in a Event? A Catalina out:

2017-10-27 08:18:31,054 http-nio-6060-exec-18 INFO person@@domain.com 498x3216418x1 9egm1s 77.2412.33 /rest/jddap/1.0/attachment [ExampleListener.class] Script=Listener.groovy IssueKey=PROJECT-723 ScriptRunIdent=32533 Action=EndScript

Can the "9egm1s" part be grabbed in the script or event?

[Gonchik Tsymzhitov]

Hi!

I have excluded this paramater in my parser, 

because I have not seen any reason in my experience. 

Better for your situation you need parse  pattern from Valve config (server.xml) and log4j.properties 

https://confluence.atlassian.com/confkb/audit-confluence-using-the-tomcat-valve-component-223216846.html

https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html

https://confluence.atlassian.com/doc/working-with-confluence-logs-108364721.html

I hope it will help you.

I will be happy if you click vote and answer accepted:)

Cheers, 

Gonchik Tsymzhitov

[Normann P. Nielsen - TDC/Netic]

Hi,

Interesting links, but I dont think my core question was answered, as in can I corrolate logs and events. 

Preferrably by a unique ident that is present in both logs and events.

BR,

Normann