Logging

Primetime Origin Server includes a log formatter that formats access logs in a manner that enables Splunk to easily index the logs. The formatter class is com.adobe.fms.http.KeyValueAccessFromatter.

To use this formatter for access logs, change the formatter property of com.adobe.fms.http.AccessFileHandler in logging.properties to com.adobe.fms.http.KeyValueAccessFromatter. As per Splunk logging best practices, this formatter logs all fields in key-value pairs with values enclosed in quote marks and different key-value pairs separated by commas.

The following are sample entries of the access log by this formatter:

date="2013-Oct-21 13:38:38.287 +0530", 
resTime="11", 
reqLen="0", 
status="200", 
resLen="191", 
method="GET", 
uri="/crossdomain.xml",
ip="10.40.62.12:33645"

date="2013-Oct-21 13:38:44.275 +0530", 
resTime="103", 
reqLen="0", status="200", 
resLen="1691", method="GET", 
uri="/_default_/_default_/livestream.f4m",
ip="10.40.63.232:55560"

date="2013-Oct-21 13:38:44.486 +0530", 
resTime="155", 
reqLen="0", 
status="200", 
resLen="15151", 
method="GET", 
uri="/_default_/_default_/livestream.drmmeta",
ip="10.40.63.232:55560"

date="2013-Oct-21 13:38:48.289 +0530", 
resTime="2", 
reqLen="0", 
status="200", 
resLen="191", 
method="GET", 
uri="/crossdomain.xml", 
ip="10.40.62.12:33647"

The formatter uses the following key names:

Key Name	Description
Date	Log timestamp
resTime	Request processing time taken by Origin in milliseconds
reqLen	Request Length in bytes
status	HTTP response status code for the request
resLen	Response Length in bytes
method	HTTP Request Method
X-Forwarded-For	Client IP address extracted from the X-Forwarded-For header
uri	Requested URI
ip	Remote IP Address

The following are sample contents of the default logging.properties file provided with Adobe Primetime:

# Specify the handlers to create in the root logger (all loggers are children of the root logger)
# The following creates two handlershandlers = java.util.logging.FileHandler, java.util.logging.ConsoleHandler
# Set the default logging level for the root logger.level = INFO				

#Uncomment this to enable FINE level logs for only com.adobe.fms and children loggers
#com.adobe.fms.level = FINE
#Settings for displaying log messages to 
 Consolejava.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
 java.util.logging.ConsoleHandler.level = INFO
#Settings for writing log messages to origin.log
 java.util.logging.FileHandler.pattern = ./logs/origin.%g.log
 java.util.logging.FileHandler.level =  FINEST
 java.util.logging.FileHandler.formatter = com.adobe.fms.util.PTSimpleFormatter
 java.util.logging.FileHandler.append = true
# limit each file to 512MB before rolling over.
 java.util.logging.FileHandler.limit = 524288000
 java.util.logging.FileHandler.count = 4
#Settings for writing log messages to access.log
 com.adobe.fms.http.handlers = com.adobe.fms.http.AccessFileHandler
 com.adobe.fms.http.level = FINE
 com.adobe.fms.http.AccessFileHandler.pattern = ./logs/http/access.%g.log
 com.adobe.fms.http.AccessFileHandler.level = FINE
#use this KeyValueAccessFromatter to generate splunk-friendly access logs
#com.adobe.fms.http.AccessFileHandler.formatter = com.adobe.fms.http.KeyValueAccessFromatter
 com.adobe.fms.http.AccessFileHandler.formatter = com.adobe.fms.http.AccessFormatter
 com.adobe.fms.http.AccessFileHandler.append = true
 com.adobe.fms.http.AccessFileHandler.limit = 524288000
 com.adobe.fms.http.AccessFileHandler.count = 4
#############################################################################################
## An example to debug log messages for the StreamContainer "foo"
## Setup a unique file handler
#com.adobe.fms.module.FileHandler1.pattern = ./logs/debugContainer.%g.log
#com.adobe.fms.module.FileHandler1.level = FINEST
#com.adobe.fms.module.FileHandler1.formatter = java.util.logging.SimpleFormatter
#com.adobe.fms.module.FileHandler1.append = true
#com.adobe.fms.module.FileHandler1.limit = 524288000
#com.adobe.fms.module.FileHandler1.count = 4
##com.adobe.fms.StreamContainer.foo.handlers = com.adobe.fms.module.FileHandler1
#com.adobe.fms.StreamContainer.foo.level = FINEST
##############################################################################################
## An example to debug log messages for the Stream "stream1" in the 
## StreamContainer "foo" while using com.adobe.fms.module.FileHandler2
### Setup a unique file handler
#com.adobe.fms.module.FileHandler2.pattern = ./logs/debugStream.%g.log
#com.adobe.fms.module.FileHandler2.level = FINEST
#com.adobe.fms.module.FileHandler2.formatter = java.util.logging.SimpleFormatter
#com.adobe.fms.module.FileHandler2.append = true
#com.adobe.fms.module.FileHandler2.limit = 524288000
#com.adobe.fms.module.FileHandler2.count = 4
#com.adobe.fms.StreamContainer.foo.Stream.stream1.handlers = com.adobe.fms.module.FileHandler2
#com.adobe.fms.StreamContainer.foo.Stream.stream1.level = INFO
#

To use the Splunk formatter, uncomment the following line in the default logging.properties file:

#com.adobe.fms.http.AccessFileHandler.formatter = com.adobe.fms.http.KeyValueAccessFromatter

In addition, comment the following line in the same file:

com.adobe.fms.http.AccessFileHandler.formatter = com.adobe.fms.http.AccessFormatter