Debugging & Logging - Log Files

Overview

The Log Files page in the ColdFusion Administrator provides access to all ColdFusion log files for viewing, searching, downloading, and archiving. Log files are essential for troubleshooting application issues, monitoring server health, and identifying security incidents. Understanding what each log file contains and how to effectively search and analyze them is critical for maintaining production ColdFusion applications.

This guide covers all major ColdFusion log files, common error patterns to watch for, log searching techniques, and integration with centralized logging solutions. Proper log management enables faster incident response and better application observability.

Core ColdFusion Log Files

Database and Performance Logs

Scheduled Tasks and Mail Logs

Additional Log Files

Viewing and Searching Logs

Administrator Log Viewer

• Features:
• View logs directly in browser
• Search for specific text or patterns
• Filter by date/time range
• View most recent entries
• Refresh to see new entries
• Limitations:
• Can be slow for very large logs
• Limited to viewing one log at a time
• No advanced filtering or correlation

Searching Logs in Administrator

• Search Field: Enter text to find in log entries
• Case Sensitive: Option to match case exactly
• Line Limit: Number of recent lines to search
• Search Tips:
• Search for error messages or exception types
• Use partial file paths to find template issues
• Search for specific dates/times
• Look for specific datasource or function names

Downloading Logs

• Download Button: Download entire log file
• Format: Plain text file
• Use Cases:
• Offline analysis with text editors
• Sharing with support or developers
• Long-term archival
• Import into log analysis tools
• Best Practice: Download before deleting or archiving

Archiving and Deleting Logs

• Archive: Move current log to timestamped archive file
• Delete: Permanently remove log file
• Caution: Deletion is permanent, archive first
• When to Archive:
• Before major deployments or changes
• When logs become too large to view easily
• After resolving major incidents (preserve evidence)
• When to Delete:
• After external archival is confirmed
• When disk space is critical
• For very old logs past retention period

Common Error Patterns to Watch For

Memory Errors

• Pattern: java.lang.OutOfMemoryError
• Variants:
• Java heap space - Heap exhausted
• Metaspace - Class metadata exhausted
• GC overhead limit exceeded - Too much GC time
• Immediate Action: Restart server if unresponsive
• Root Cause Analysis: Analyze heap dump, check memory leaks
• Prevention: Increase heap size, fix memory leaks

Database Connection Errors

• Patterns:
• Unable to get connection
• Connection timeout
• Communications link failure
• No suitable driver
• Common Causes:
• Database server down or unreachable
• Connection pool exhausted
• Network issues
• Invalid credentials
• Solutions:
• Verify database is running
• Check connection pool settings
• Test network connectivity
• Verify datasource configuration

Template Not Found Errors

• Pattern: File not found / Template not found
• Causes:
• Incorrect file path
• Mapping not configured
• Case sensitivity on Linux/Unix
• File permissions
• Debugging: Check exact path in error, verify file exists

Method/Variable Not Found

• Patterns:
• Variable [name] is undefined
• Method [name] not found
• The [component] method was not found
• Causes:
• Variable not initialized or out of scope
• Typo in variable or function name
• Wrong component path
• Best Practice: Use var scoping and cfparam

Lock Timeout Errors

• Pattern: A timeout occurred while attempting to lock
• Causes: Contention for shared resource locks
• Solutions: Review locking strategy, reduce lock scope

Request Timeout Errors

• Pattern: The request has exceeded the allowable time limit
• Causes: Long-running queries or processes
• Solutions: Optimize code, increase timeout, use asynchronous processing

Log Analysis Tools and Techniques

Command-Line Log Analysis

• Linux/Mac (grep):
• grep "ERROR" exception.log (find errors)
• grep -i "outofmemory" *.log (case-insensitive search all logs)
• grep -A 10 "NullPointerException" exception.log (show 10 lines after match)
• tail -f application.log (follow log in real-time)
• Windows (findstr):
• findstr /i "error" exception.log (case-insensitive search)
• findstr /c:"Database connection" *.log (search phrase in all logs)
• PowerShell:
• Get-Content exception.log -Tail 50 (last 50 lines)
• Select-String "ERROR" *.log (search all logs)

Text Editor Analysis

• Tools: Notepad++, Sublime Text, VS Code, vim
• Features to Use:
• Find/Replace with regex support
• Multi-file search
• Syntax highlighting for log formats
• Bookmarking error lines
• Filtering/folding to hide noise

Log Analysis Tools

• BareTail: Real-time log viewing (Windows)
• Logstash: Parse and transform logs
• GoAccess: Real-time web log analyzer
• Loggly: Cloud-based log management
• FusionReactor: ColdFusion-specific monitoring with log integration

Centralized Logging Solutions

Why Centralized Logging?

• Multiple Servers: View logs from all servers in one place
• Correlation: Connect related events across systems
• Search: Fast full-text search across all logs
• Retention: Long-term storage with compression
• Alerting: Real-time alerts on critical events
• Visualization: Dashboards showing trends and patterns
• Scalability: Handle massive log volumes efficiently

ELK Stack (Elasticsearch, Logstash, Kibana)

• Overview: Open-source log aggregation platform
• Elasticsearch: Search and storage engine
• Logstash: Log parsing and transformation
• Kibana: Visualization and dashboard interface
• Filebeat: Lightweight log shipper
• Strengths:
• Free and open source
• Powerful search capabilities
• Flexible dashboarding
• Large community and plugins
• Setup:
• Install Filebeat on CF server
• Configure to ship CF log files
• Parse logs with Logstash patterns
• Visualize in Kibana dashboards

Splunk

• Overview: Commercial enterprise log management
• Strengths:
• Easy to use and configure
• Excellent search and reporting
• Machine learning capabilities
• Enterprise support
• Pricing: Based on daily data volume
• Integration: Universal Forwarder ships CF logs to Splunk

Graylog

• Overview: Open-source alternative to Splunk
• Strengths:
• Free core version
• Built on Elasticsearch
• Good balance of features and simplicity
• Stream-based log processing
• Integration: Syslog or GELF protocol from CF

Cloud Solutions

• AWS CloudWatch Logs:
• Native AWS log aggregation
• Integrates with EC2, Lambda, etc.
• CloudWatch Agent ships logs
• Azure Monitor Logs:
• Azure-native log analytics
• Kusto Query Language (KQL)
• Google Cloud Logging:
• GCP log aggregation
• Integration with Cloud Console
• Datadog:
• Full-stack observability platform
• Logs, metrics, and traces
• New Relic:
• Application performance monitoring
• Log management included
• Sumo Logic:
• Cloud-native log analytics
• Machine learning insights

Setting Up Log Shipping

• File-Based Shipping (Recommended):
• Install Filebeat, Fluentd, or similar agent
• Configure to watch CF log directory
• Parse log format (regex or grok patterns)
• Ship to centralized logging platform
• Syslog Integration:
• Use cflog with application="syslog"
• Configure syslog daemon on server
• Forward to remote syslog server
• API-Based Shipping:
• Write custom logging to HTTP endpoints
• Use structured JSON format
• Batch for efficiency

Log Management Best Practices

Regular Review Schedule

• Daily: Check exception.log for new errors
• Weekly: Review slowquery.log for performance issues
• Weekly: Check scheduler.log for failed tasks
• Monthly: Analyze trends in error rates and types
• After Deployments: Monitor all logs for 24-48 hours
• During Incidents: Real-time monitoring of relevant logs

Alerting Strategy

• Critical Alerts (Immediate):
• OutOfMemoryErrors
• Server startup failures
• Datasource connection failures
• Security violations
• Warning Alerts (Review Within Hours):
• High error rates (threshold exceeded)
• Repeated exceptions of same type
• Scheduled task failures
• Info Alerts (Daily Summary):
• Daily exception count
• Slow query summary
• Disk space for log directory

Retention Policies

• Local Retention: 7-30 days based on disk space
• Archive Retention: 90 days to 1 year
• Compliance Retention: Based on regulatory requirements
• Centralized Logs: 30-90 days hot, longer in cold storage
• Backup Strategy: Include archived logs in backup rotation

Log Security

• Restrict file system access to log directory (administrators only)
• Avoid logging sensitive data (passwords, credit cards, PII)
• Encrypt logs if containing sensitive information
• Implement log integrity monitoring (detect tampering)
• Comply with data protection regulations (GDPR, HIPAA)
• Secure centralized logging endpoints (encryption in transit)

Performance Considerations

• Use appropriate log levels (Error/Warning in production)
• Implement log rotation to prevent huge files
• Use fast storage (SSD) for log directories
• Consider asynchronous logging for high-volume sites
• Monitor disk space and I/O performance
• Compress old logs to save space

Troubleshooting Workflows

Application Error Investigation

• 1. Check exception.log for recent errors
• 2. Note timestamp, template path, and error message
• 3. Review stack trace to identify root cause
• 4. Check application.log around same time for context
• 5. If database-related, check datasource.log
• 6. Reproduce error in development if possible
• 7. Fix code and deploy, monitor for recurrence

Performance Degradation

• 1. Check slowquery.log for slow database queries
• 2. Review coldfusion-out.log for GC activity
• 3. Check server.log for resource warnings
• 4. Analyze request patterns in httpd.log if available
• 5. Use FusionReactor or similar for detailed profiling
• 6. Correlate slow periods with log timestamps

Intermittent Failures

• 1. Search exception.log for error pattern
• 2. Note frequency and timing of errors
• 3. Check if errors correlate with scheduled tasks
• 4. Look for resource exhaustion patterns (memory, connections)
• 5. Check for external dependencies (database, APIs)
• 6. Set up real-time monitoring to catch next occurrence

Email Delivery Issues

• 1. Check mail.log for send attempts and errors
• 2. Verify SMTP server connectivity from logs
• 3. Check mailsent.log to confirm successful sends
• 4. Review mail spool directory for stuck messages
• 5. Test SMTP configuration with diagnostic tools

Related Resources