There are several possible reasons, which usually blend. The most common are:
-
Independent log levels. It may be that the general log is INFO
, but for some classes or applications it is different. Check logging settings in tomcat and also in the applications that are running.
-
Writing to more than one place. Applications may be redirecting logs to stdout
instead of individual files, or maybe even to the two places.
-
Applications writing directly to stdout
. Poorly done or inattentive programmers may have some code System.out.println
and e.printStackTrace
in the code that was left there for debugging during development, but now can not be turned off. To make things worse, they sometimes put it in the loop.
-
Many applications running on the same server. The more systems, the more logs. However, they should write to different files.
-
Many access to the server. The more hits, the more logs. Make sure there is no peak access or if the number of users is not above the server capacity.
Considerations
By the size of the file, I would say that there are some classes logging with DEBUG
or TRACE
or that all queries to the database are written.
Inevitably you will need to look at the logs to understand what is occurring. Of course it will not be possible to use a traditional text editor, so use another tool to load the file partially or to extract part of the file to another. If you use Linux or Mac it will be easy, if it is with Windows it will be a bit painful, but it is possible.
Finally, configure rotating log specifying a maximum size for the file. This avoids a lot of headaches and can still archive the logs routinely. Just be careful when discarding old logs too early, you may need them to audit, detect scams, or investigate obscure bugs.