WebLogic Log Management

Server Logs
Each WebLogic server instance writes all messages from subsystems and applications to a server log file located on the local host. By default, the server log files are located in the logs directory at the root of the server instance;

for example D:\Oracle\Middleware\user_projects\domains\ Snails_domain\servers\adminserver\logs\adminserver.log, of which snails_domain is the name of the directory in which the domain is located, and \adminserver is the name of the server.

Each log message has an associated severity level. The level of the log message roughly describes its critical level or emergency level. WebLogic Server has a predefined severity from TRACE to EMERGENCY, which translates the corresponding severity to the log level when the log request is dispatched to the logger. The log level has the following values

to set the log severity level on loggers and handlers. When set on the logger, no handlers receive events that the logger has rejected. For example, if the log level is set to NOTICE on the logger, no handlers receive an INFO-level event. When you set the log level on a handler, only restrictions are applied to the handler, not to other programs. For example, turning off debug for a file handler means that no debug messages will be written to the log file, but the debug message will be written to standard output.

domain log  
Each server instance forwards a portion of its message to the domain-wide log file, in addition to writing the message to the server log file. By default, the server forwards only messages with a severity level of NOTICE or higher. Although you can modify which messages are forwarded, the server never forwards messages with a severity level of DEBUG. The
Domain log file provides a central location for viewing the overall state of the domain. The domain log resides in the logs directory of the Management Server. The default name and location of the domain log file is Domain_name\servers\admin_server_name\logs\domain_name.log, where domain_name is the name of the directory in which the domain is located, and Admin_ server_name is the name of the Management server. The timestamp that is logged in the
domain log is the timestamp of the server that issued the message. Log records in the domain log are not written in their timestamp order, and are written to the message as soon as it arrives. It is possible that a managed server could not contact the Management Server for a period of time. In this case, the message is buffered locally and sent to the Management Server after reconnecting the server.

http access log  
in WebLogic can record the files on the server accessed with the HTTP,HTTPS protocol, the log file is named Access.log by default, and the file is recorded at a certain time, A client of an IP address accesses that file on the server.  
127.0.0.1--[25/feb/2002:11:35:58 +0800] "Get/weather HTTP /1.1 "302 0
127.0.0.1--[25/feb/2002:11:35:58 +0800]" Get/weather/index. Html http/1.1 "176 
The properties of the HTTP access log can be set in the HTTP property page.

The HTTP subsystem keeps a log of all HTTP transactions in a text file. The default location and scrolling policy for HTTP access logs are the same as for server logs. You can set the attributes that define the HTTP access log behavior for each server or for each virtual host that you define.

how the server instance forwards messages to the domain log
To forward messages to the domain log, each server instance broadcasts its log messages. The server broadcasts all messages and message text except for the severity level of debug messages.
The Management server listens to a subset of the messages in the above message and writes them to the domain log file. To listen for these messages, the Management Server registers the listener on each managed server. By default, the listener contains a filter that only allows messages that are severity level NOTICE and higher to be forwarded to the Management Server. Specific mechanisms See

For any given WebLogic Server instance, you can overwrite the default filter and create a log filter to write a different set of message sets to the domain log file. If the Management Server is unavailable, the managed server continues to write the message to its local server log file. However, by default, when you reconnect to the server, all messages written during disconnection are not forwarded to the domain log file. The managed server retains a specified number of messages in the buffer so that they can be forwarded to the Management Server when reconnecting to the server. The number of messages kept in the buffer is configured by the Domainlogbroadcasterbuffersize attribute on Logmbean. The default value is 1. If configured to use a default value, only the last logged message is forwarded to the server after reconnecting the Management server. For example, if the Management server recovers after two hours of availability, the domain log does not contain any messages generated within this two-hour period. If a value greater than 1 is configured, the corresponding number of messages will be forwarded to the domain log after the managed server is reconnected to the Management server.
Note: This causes messages that have an earlier timestamp to be listed in the domain log file after the message has a later timestamp. After messages are flushed to the Management server in the buffer of previously disconnected managed servers, they are appended directly to the domain log even if they were generated before a message in the domain log.
Log Message Format
When a WebLogic server instance writes a message to the server log file, the first line of each message begins with # # #, followed by the attributes of the message. Each attribute is enclosed in angle brackets.
The following is an example of a message in the server log file:
####<sept, 2004 10:46:51 AM est> <Notice> <WebLogicServer> <MyComputer> <examplesserver > <main> <<wls kernel>> <> <null> <1080575211904> <BEA-000360>
<server started in RUNNING mode>
In this example, the attributes of the message are: Timestamp by locale, severity, subsystem, computer name, server name, thread ID, user ID, transaction ID, diagnostic context ID, original time value, message ID, and message text. (The individual attributes are described in the following message Attributes section.) ）
If a message is not recorded in the transaction context, the angle brackets for the transaction ID are included, even if the transaction ID is not included.
If the message contains a stack trace, the stack trace is included in the message text. WebLogic Server uses the default character encoding of the host for the messages it writes.
format of output in standard output and standard error
When a WebLogic server instance writes a message to standard output, the output does not contain a # # # prefix, and does not include the server name, computer name, thread ID, user ID, transaction ID, diagnostic context ID, and original time Value field.
The following example shows how to output the messages in the previous section to standard output:
<sept, 2004 10:51:10 AM est> <Notice> <WebLogicServer> <BEA-000360> <server started in Runni NG mode>
In this example, the message attributes are: Timestamp, severity, subsystem, message ID, and message text formatted by locale.
Graphical interface Operation
Login WebLogic background for related operations
1. Log Related parameter settings
Left menu: Environment –> Server
menu on the right: server –> log records
Just find AdminServer.log, access.log, and do some things.
Such as: Set the rollback of log files, set the log file name, etc.
2. Log View
Left menu: Environment –> Server
menu on the right: click server name
Left menu: Diagnosing –> log files
menu on the right: Select the relevant log click to view

WebLogic Log Management