Why did Tomcat get so bad at logging logs?
The tomcat firewall, as it is known, allows access to a number of applications on the network.
The logs contain the names of the applications, the IP addresses of the machines, and the timestamp of when each access was made.
Tomcat’s logs are a handy way to track what applications were running at any given time.
In this article, we’ll dive deeper into the history of tomcat logs to see why it’s so hard to find them.
A security flaw with tomcat 1.6.2, which Tomcat patched in 2013, made it impossible to trace any access logs.
To find the logs, we had to first find the application that was being accessed.
For Tomcat, this meant going to the Applications tab in the Tomcat interface.
If we clicked on the application we were interested in, we’d be taken to the Application Logs section of the Application Manager interface.
The Application Log section was hidden by default, but you could click the Advanced button to see the details of the application’s logs.
The application we wanted to find was the web browser tab, and we could now find the log in the logs tab.
Tomcats logs were available for a period of five years from 2012 until 2017.
After that, the logs went away entirely.
That’s because Tomcat didn’t want to track all the applications it was running on the web.
This was a security flaw that Tomcat fixed in 2013.
TomCat’s logs were also difficult to trace, since they were stored in a database, and there was no way to see who accessed what at a given time in the database.
So we had an easier time tracking applications that we wanted.
In the coming weeks, we will continue to dig into the Tomcats logging to see how it was handled.
We hope to have a better understanding of what Tomcat is logging, and to learn about other security flaws that were introduced in later versions of Tomcat.
The tomcats source code is available on Github.