# Cis Tomcat101 7.2

> Specify file handler in logging.properties files (Automated)

- Skill: `cyberstrikeus/cis-tomcat101-7-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-tomcat101-7-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-tomcat101-7-2/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-tomcat101-7-2

---


# 7.2 Specify file handler in logging.properties files (Automated)

## Description

Handlers specify where log messages are sent. Console handlers send log messages to the Java console and File handlers specify logging to a file.

## Rationale

Utilizing file handlers will ensure that security event information is persisted to disk.

## Impact

Configuring logging to debug logging, i.e. FINEST or ALL, can generate large amounts of information which may impact server performance.

## Audit Procedure

Review each application's `logging.properties` file located in the applications `$CATALINA_BASE/webapps/<app_name>/WEB-INF/classes` directory and determine if the file handler properties are set.

```
$ grep handlers \
$ CATALINA_BASE/webapps/<app_name>/WEB-INF/classes/logging.properties
```

In the instance where an application specific logging has not been created, the `logging.properties` file will be located in `$CATALINA_BASE/conf`

```
$ grep handlers $CATALINA_BASE/conf/logging.properties
```

## Remediation

Add the following entries, replacing `<file_handler>` with either `FileHandler` or `AsyncFileHandler`, to your `logging.properties` file if they do not exist.

```
handlers=1catalina.org.apache.juli.<file_handler>,
2localhost.org.apache.juli.<file_handler>,
3manager.org.apache.juli.<file_handler>, 4host-
manager.org.apache.juli.<file_handler>, java.util.logging.ConsoleHandler
```

Ensure logging is not off and set the `<logging_level>` to the desired level (SEVERE, WARNING, INFO, CONFIG, FINE, FINER, FINEST or ALL), for example:

```
org.apache.juli.FileHandler.level=<logging_level>
```

## Default Value

No value for new applications by default.

## References

1. https://tomcat.apache.org/tomcat-9.0-doc/logging.html

## CIS Controls

| Controls Version | Control                                                                                                                                                                                                                                                                                 | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 8.5 Collect Detailed Audit Logs<br>Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. |      | ●    | ●    |
| v7               | 6.3 Enable Detailed Logging<br>Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.                                                                                |      | ●    | ●    |

## Profile

Level 1