7.1 Application specific logging

Information

By default, java.util.logging does not provide the capabilities to configure per-web application settings, only per VM. In order to overcome this limitation Tomcat implements JULI as a wrapper for java.util.logging. JULI provides additional configuration functionality so you can set each web application to have unique logging specifications.

Rationale:

Establishing per application logging profiles will help ensure that each application's logging verbosity is set to an appropriate level in order to provide appropriate information when needed for security review.

Solution

Create a logging.properties file and place that into your application WEB-INF/classes directory.

Note: By default, installing Tomcat places a logging.properties file in $CATALINA_HOME/conf. This file can be used as base for an application specific logging properties file.

Default Value:

By default, per application logging is not configured.

See Also

https://workbench.cisecurity.org/files/2506

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12, CSCv6|3.1, CSCv7|6.3

Plugin: Unix

Control ID: 4b076140d2e1e2aa6c66aaaea7048cf9aae50d463e6dacc63b8fc8b55ea10cbe