Ubuntu Tomcat日志自动化分析方案
一 架构与流程
二 方案一 集中式平台 ELK 或 Grafana Loki
input {
file {
path => "/var/log/tomcat*/catalina.out"
start_position => "beginning"
sincedb_path => "/var/lib/logstash/sincedb_tomcat"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} "
negate => true
what => "previous"
}
}
}
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} \[%{DATA:thread}\] %{JAVACLASS:class} - %{GREEDYDATA:msg}" }
match => { "message" => "%{COMMONAPACHELOG}" } # 可选:解析访问日志
}
date { match => [ "timestamp", "ISO8601" ] target => "@timestamp" }
mutate { remove_field => ["timestamp"] }
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "tomcat-logs-%{+YYYY.MM.dd}"
}
}
三 方案二 轻量自动化脚本与系统工具
tail -f /opt/tomcat/logs/catalina.out
grep -i "ERROR\|Exception" /opt/tomcat/logs/catalina.out | tail -50
awk '/ERROR/ {count++} END {print "ERROR count:", count}' /opt/tomcat/logs/catalina.out
/opt/tomcat/logs/*.out {
size 50M
rotate 7
compress
missingok
copytruncate
}
import re, smtplib, time
from email.mime.text import MIMEText
LOG = "/opt/tomcat/logs/catalina.out"
SEEN = set()
def alert(subj, body):
msg = MIMEText(body)
msg["Subject"], msg["From"], msg["To"] = subj, "from@example.com", "to@example.com"
with smtplib.SMTP("smtp.example.com", 587) as s:
s.starttls(); s.login("user", "pass"); s.sendmail("from@example.com", ["to@example.com"], msg.as_string())
def tail_error():
with open(LOG) as f:
f.seek(0, 2)
while True:
line = f.readline()
if not line: time.sleep(1); continue
if "ERROR" in line and line not in SEEN:
SEEN.add(line); alert("Tomcat ERROR", line.strip())
if __name__ == "__main__": tail_error()
四 关键配置与落地要点