Changed logback.xml from WARN to INFO. I can now see web session logins and
logouts and server logins / logouts.
Logback.xml:
<configuration>
<!-- Default appender -->
<appender name="GUAC-DEFAULT" class="ch.qos.logback.core.FileAppender">
<file>/var/log/guacamole/guacamole.log</file>
<encoder>
<pattern>%date{"yyyy-MM-dd'T'HH:mm:ss,SSSXXX", UTC} [%thread]
%-5level %logger{36} - %msg%n</pattern>
</encoder>
</appender>
<!-- Log at INFO level -->
<root level="INFO">
<appender-ref ref="GUAC-DEFAULT" />
</root>
</configuration>
I hope this conversation is useful to someone else who may be having similar
issues.
Thanks,
Brad
From: Brad Turnbough <[email protected]>
Sent: Tuesday, April 14, 2026 8:31 AM
To: [email protected]
Subject: RE: Audit Logging Help --- Guac 1.5.5 on Ubuntu 24.04
Getting a bit further now…..
Looks like systemd has some strange app-armor like mechanism……You have to allow
the service to write to certain paths. (thanks gemini)
Sudo systemctl edit tomcat9.service
added this:
[Service]
ReadWritePaths=/var/log/guacamole/
to the TOP of the service file.
Reload services…
sudo systemctl daemon-reload
sudo systemctl restart tomcat9
The file is logging now, somewhat… but I’m not sure it’s logging what I think
it should be logging.
root@host:/var/log# cat /var/log/guacamole/guacamole.log
2026-04-14T13:22:32,932Z [main] WARN o.g.jersey.server.wadl.WadlFeature -
JAXBContext implementation could not be found. WADL feature is disabled.
2026-04-14T13:22:35,866Z [main] WARN o.g.jersey.server.wadl.WadlFeature -
JAXBContext implementation could not be found. WADL feature is disabled.
2026-04-14T13:22:38,991Z [main] WARN o.g.jersey.server.wadl.WadlFeature -
JAXBContext implementation could not be found. WADL feature is disabled.
Thanks,
Brad
From: Brad Turnbough
<[email protected]<mailto:[email protected]>>
Sent: Tuesday, April 14, 2026 8:07 AM
To: [email protected]<mailto:[email protected]>
Subject: RE: Audit Logging Help --- Guac 1.5.5 on Ubuntu 24.04
I’m unfortunately not seeing anything in the logs.
root@host:/var/log# ls -lah /var/log/guacamole/
total 8.0K
drwxrwxrwx 2 tomcat adm 4.0K Apr 13 16:57 .
drwxrwxr-x 17 root syslog 4.0K Apr 14 00:00 ..
-rwxrwxrwx 1 tomcat adm 0 Apr 13 16:57 guacamole.log
OS is Ubuntu 24.04.
Catalina.out is saying this:
[2026-04-14 08:00:00] [info] #011at java.io.FileNotFoundException:
/var/log/guacamole/guacamole.log (Read-only file system)
[2026-04-14 08:00:03] [info] 08:00:03,769 |-ERROR in
ch.qos.logback.core.FileAppender[GUAC-DEFAULT] -
openFile(/var/log/guacamole/guacamole.log,true) call failed.
java.io.FileNotFoundException: /var/log/guacamole/guacamole.log (Read-only file
system)
However, the filesystem is not mounted RO, and the file is there (as shown
above)
root@knx-guacamole-01:/var/log# mount | grep ' /var/log\ '
/dev/mapper/vg0-lv--4 on /var/log type ext4 (rw,relatime)
Thanks for your help thus far, Nick!
Thanks,
Brad
From: Nick Couchman <[email protected]<mailto:[email protected]>>
Sent: Monday, April 13, 2026 6:37 PM
To: [email protected]<mailto:[email protected]>
Subject: Re: Audit Logging Help --- Guac 1.5.5 on Ubuntu 24.04
On Mon, Apr 13, 2026 at 6:08 PM Brad Turnbough
<[email protected]<mailto:[email protected]>>
wrote:
I’m having a hard time implementing the audit logging in guac.
/etc/guacamole/logback.xml is as follows:
<configuration>
<!-- Default appender -->
<appender name="GUAC-DEFAULT" class="ch.qos.logback.core.FileAppender">
<file>/var/log/guacamole/guacamole.log</file>
<encoder>
<pattern>%date{"yyyy-MM-dd'T'HH:mm:ss,SSSXXX", UTC} [%thread]
%-5level %logger{36} - %msg%n</pattern>
</encoder>
</appender>
<!-- Log at INFO level -->
<root level="WARN">
<appender-ref ref="GUAC-DEFAULT" />
</root>
</configuration>
For the extent of this test. /var/log/guacamole is chmod 777 and the file
exists and is also chmod 777.
Once everything was in place, I restarted tomcat….. systemctl restart tomcat9
Am I missing something else?
What behavior are you seeing? Nothing at all in the logs? Or not what you
expect?
What Linux distribution and version are you running - in particular, does it
use SELinux, and is the file labeled properly?
Is there anything in the main Tomcat log file (catalina.out, etc.) that
indicates a reason why it cannot write to that file?
-Nick
NOTICE: This electronic mail message and any attachments transmitted with it
are intended exclusively for the individual or entity to which it is addressed.
The message may contain confidential and/or privileged information. Any
unauthorized review, use, printing, saving, copying, disclosure or distribution
is strictly prohibited. If you have received this message in error, please
immediately advise the sender by reply email and delete all copies.
