weblogic10.3.6自定义access.log日志

Weblogic在运行的过程中会产生access.log，access.log可以帮助我们了解应用的一些访问信息，比如：可以了解某个时间段的访问数量；可以了解访问应用的IP分布；还可以做一些安全的审计（防范攻击）。

默认的access.log的日志格式如下：

192.168.174.132 - - [08/Mar/2017:16:00:51 -0800] "GET /Test HTTP/1.1" 302 259
192.168.174.132 - - [08/Mar/2017:16:00:51 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:14 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:17 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:17 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:18 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:18 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:18 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:18 -0800] "GET /Test/ HTTP/1.1" 200 625

这里面包含了IP、时间、请求的URL和HTTP协议，HTTP请求状态，发送给客户端文件内容大小等信息。我们还可以对默认的日志格式进行扩展。首先进入下列界面（主页>服务器概要>server1）

将公用改为扩展，并将日志记录格式字段设置成：c-ip cs-username date time cs-uri sc-status bytes cs(Referer) cs(User-Agent)，修改完成后，重启server1，得到的日志格式就会变成如下:

#Version: 1.0
#Fields: c-ip cs-username date time cs-uri sc-status bytes cs(Referer) cs(User-Agent)
#Software: WebLogic
#Start-Date: 2017-03-16 16:12:40
192.168.174.1 - 2017-03-16 16:14:26 /Test 302 269 "http://192.168.174.132:7001/console/console.portal?_nfpb=true&_pageLabel=WebAppApplicationTestingPage&handle=com.bea.console.handles.AppDeploymentHandle%28%22com.bea%3AName%3DTest%2CType%3DAppDeployment%22%29" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
192.168.174.1 - 2017-03-16 16:14:27 /Test/ 200 627 "http://192.168.174.132:7001/console/console.portal?_nfpb=true&_pageLabel=WebAppApplicationTestingPage&handle=com.bea.console.handles.AppDeploymentHandle%28%22com.bea%3AName%3DTest%2CType%3DAppDeployment%22%29" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
192.168.174.1 - 2017-03-16 16:14:27 /favicon.ico 404 1164 - "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
192.168.174.1 - 2017-03-16 16:14:30 /Test/index.jsp 200 627 "http://192.168.174.132:7001/console/console.portal?_nfpb=true&_pageLabel=WebAppApplicationTestingPage&handle=com.bea.console.handles.AppDeploymentHandle%28%22com.bea%3AName%3DTest%2CType%3DAppDeployment%22%29" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
192.168.174.1 - 2017-03-16 16:14:34 /Test/index.jsp 200 627 "http://192.168.174.132:7001/console/console.portal?_nfpb=true&_pageLabel=WebAppApplicationTestingPage&handle=com.bea.console.handles.AppDeploymentHandle%28%22com.bea%3AName%3DTest%2CType%3DAppDeployment%22%29" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"

可以看到日志的格式发生了变化，多了url跳转来源，用户终端浏览器等信息。具体设置可以参考下列表格：

 

Field	Description	Example value from above
x-GWXFF	actual client IP using custom jar file	11.22.33.44
c-ip	IP of client, in this case, IP of the load balancer	22.33.44.55
s-ip	IP or hostname of managed  server:port	managed-serve-rhost:port
cs-username	Username passed during http authorization	“-” implies it was not passed
date	date of request in YYYY-MM-DD format	2013-11-20
time	time of request in HH:MM:SS format	16:10:19
cs-method	Method for this request, can be GET, POST, etc	POST
cs-uri	URI called	/HelloWorld/index.jsp
sc-status	HTTP status code, e.g. 200, 301, 403, 500, etc	200
bytes	bytes sent	5245
cs(Referer)	Referer URL	“-” implies direct visit
cs(User-Agent)	User-Agent of the client’s browser making the request	Axis/1.3

转载于:https://www.cnblogs.com/talonxu/p/6559678.html