There are several possible reasons, which usually mix. The most common are:
Independent log levels. It may be that the general log is INFO
, but for some classes or applications is different. Check log settings in Tomcat and also in the applications that are running.
Writing to more than one place. Applications may be redirecting logs to the stdout
instead of individual files, or who knows even for both places.
Applications writing directly to stdout
. Poorly made systems or with inattentive programmers may have in the code some System.out.println
and e.printStackTrace
which was left there for debugging during development, but which now has no way of being shut down. To make matters worse, they sometimes put it into bonds.
Many applications running on the same server. The more systems, the more logs. However, they should write to different files.
Many accesses to the server. The more accesses, the more logs. Check if there was no access spike or if the number of users is not above server capacity.
Considerations
By file size, I’d say there are some classes logging in with DEBUG
or TRACE
or that all queries to the database are written.
Inevitably you will need to look at the logs to understand what is occurring. Of course it will not be possible to use a traditional text editor, so use another tool to partially load the file or to extract part of the file to another one. If you use Linux or Mac will be easy, if it is with Windows will suffer a little, but it is possible.
Finally, configure rotary log specifying a maximum size for the file. Thus you avoid a lot of headache and can still archive the logs routinely. Just be careful when discarding old logs too early, you may need them for auditing, detecting fraud or investigating obscure bugs.
What level is set for logs in conf/logging.properties ?
– dougg0k
The level for some properties is
INFO
– DiegoAugusto