I'm trying to monitor Tomcat log files from a security perspective.
My questions are related to two main areas:
1) User Management
- 1.a) Does the Tomcat GUI provide any option to create and delete users, or does this have to be done directly via the tomcat-users.xml file?
- 1.b) Does Tomcat create any log entry when users are being created / deleted?
2) How are log files being handled?
- 2.a) Is there any option provided by the GUI to modify / delete Tomcat log files?
- 2.b) Are modifications in log files being logged in some log file only accessible by root?
The reason I'm asking is that I would like to look for relevant security events in Tomcat logs to establish some kind of monitoring on this. However, the only thing I could find was "Access Logging" for Tomcat, which unfortunately does not answer my questions.