How to log/debug bad requests in tomcat?

Question

In our system (closed system, java web application in tomcat 6 as server, java fat clients) our clients show occasionally "400 - Bad Request" responses. I would like to debug this on the server side, but since the requests seem to be invalid, I don't see them anywhere. I configured the AccessLogValve for the complete tomcat host, but the requests don't appear there. I don't even see anything in catalina.out.

I would love to get these requests logged and even better would be to dump requests based on certain criteria.

Any ideas?

My server.xml looks like this:

<Server port="8005" shutdown="SHUTDOWN">
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="off" />
  <Listener className="org.apache.catalina.core.JasperListener" />
  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  <Listener className="org.apache.catalina.mbeans.JmxRemoteLifecycleListener"
rmiServerPortPlatform="9098"
rmiRegistryPortPlatform="9099"
useLocalPorts="true" />
  <Service name="Catalina">
    <Connector port="8020" protocol="HTTP/1.1" redirectPort="8010" connectionTimeout="20000" />
    <Engine name="Catalina" defaultHost="localhost" jvmRoute="cc1">
      <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="false"
         deployOnStartup="true" xmlValidation="false" xmlNamespaceAware="false">
        <Valve className="org.apache.catalina.valves.AccessLogValve"
               directory="logs" prefix="access_log."
               suffix=".txt" pattern="combined" resolveHosts="false" />
      </Host>
    </Engine>
  </Service>
</Server>

Answer 1

long time ago - but anyway: Tomcat has different Valves that may help to achieve that: http://tomcat.apache.org/tomcat-6.0-doc/config/valve.html#Request_Dumper_Valve

Another option would be tcpdump since it is HTTP and a response code it seems possible to filter the raw requests that cause this.