weblogic10.3.6自定义access.log日志
Weblogic在运行的过程中会产生access.log，access.log可以帮助我们了解应用的一些访问信息，比如：可以了解某个时间段的访问数量；可以了解访问应用的IP分布；还可以做一些安全的审计（防范攻击）。
默认的access.log的日志格式如下：
192.168.174.132 - - [08/Mar/2017:16:00:51 -0800] "GET /Test HTTP/1.1" 302 259
192.168.174.132 - - [08/Mar/2017:16:00:51 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:14 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:17 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:17 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:18 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:18 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:18 -0800] "GET /Test/ HTTP/1.1" 200 625
192.168.174.132 - - [08/Mar/2017:16:30:18 -0800] "GET /Test/ HTTP/1.1" 200 625
这里面包含了IP、时间、请求的URL和HTTP协议，HTTP请求状态，发送给客户端文件内容大小等信息。我们还可以对默认的日志格式进行扩展。首先进入下列界面（主页>服务器概要>server1）
将公用改为扩展，并将日志记录格式字段设置成：c-ip cs-username date time cs-uri sc-status bytes cs(Referer) cs(User-Agent)，修改完成后，重启server1，得到的日志格式就会变成如下:
#Version: 1.0
#Fields: c-ip cs-username date time cs-uri sc-status bytes cs(Referer) cs(User-Agent)
#Software: WebLogic
#Start-Date: 2017-03-16 16:12:40
192.168.174.1 - 2017-03-16 16:14:26 /Test 302 269 "http://192.168.174.132:7001/console/console.portal?_nfpb=true&_pageLabel=WebAppApplicationTestingPage&handle=com.bea.console.handles.AppDeploymentHandle%28%22com.bea%3AName%3DTest%2CType%3DAppDeployment%22%29" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
192.168.174.1 - 2017-03-16 16:14:27 /Test/ 200 627 "http://192.168.174.132:7001/console/console.portal?_nfpb=true&_pageLabel=WebAppApplicationTestingPage&handle=com.bea.console.handles.AppDeploymentHandle%28%22com.bea%3AName%3DTest%2CType%3DAppDeployment%22%29" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
192.168.174.1 - 2017-03-16 16:14:27 /favicon.ico 404 1164 - "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
192.168.174.1 - 2017-03-16 16:14:30 /Test/index.jsp 200 627 "http://192.168.174.132:7001/console/console.portal?_nfpb=true&_pageLabel=WebAppApplicationTestingPage&handle=com.bea.console.handles.AppDeploymentHandle%28%22com.bea%3AName%3DTest%2CType%3DAppDeployment%22%29" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
192.168.174.1 - 2017-03-16 16:14:34 /Test/index.jsp 200 627 "http://192.168.174.132:7001/console/console.portal?_nfpb=true&_pageLabel=WebAppApplicationTestingPage&handle=com.bea.console.handles.AppDeploymentHandle%28%22com.bea%3AName%3DTest%2CType%3DAppDeployment%22%29" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
可以看到日志的格式发生了变化，多了url跳转来源，用户终端浏览器等信息。具体设置可以参考下列表格：
| Field | Description | Example value from above |
|---|---|---|
| x-GWXFF | actual client IP using custom jar file | 11.22.33.44 |
| c-ip | IP of client, in this case, IP of the load balancer | 22.33.44.55 |
| s-ip | IP or hostname of managed server:port |
managed-serve-rhost:port |
| cs-username | Username passed during http authorization | “-” implies it was not passed |
| date | date of request in YYYY-MM-DD format | 2013-11-20 |
| time | time of request in HH:MM:SS format | 16:10:19 |
| cs-method | Method for this request, can be GET, POST, etc | POST |
| cs-uri | URI called | /HelloWorld/index.jsp |
| sc-status | HTTP status code, e.g. 200, 301, 403, 500, etc | 200 |
| bytes | bytes sent | 5245 |
| cs(Referer) | Referer URL | “-” implies direct visit |
| cs(User-Agent) | User-Agent of the client’s browser making the request | Axis/1.3 |
