# Changing logging level at runtime

**URL:** <https://forum.keycloak.org/t/changing-logging-level-at-runtime/16974>\
**Category:** Getting advice\
**Created:** [August 18, 2022, 12:39pm UTC](https://forum.keycloak.org/t/changing-logging-level-at-runtime/16974 "2022-08-18T12:39:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bluefloyd](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bluefloyd/32/4989_2.png) [@bluefloyd](https://forum.keycloak.org/u/bluefloyd)\
**Post date:** [August 18, 2022, 12:39pm UTC](https://forum.keycloak.org/t/changing-logging-level-at-runtime/16974/1 "2022-08-18T12:39:21Z")

</div>

Is it still possible (now that Quarkus is used) to change the logging level of certain categories/packages at runtime (without a restart)?

Earlier I used this:

/opt/jboss/keycloak/bin/jboss-cli.sh --connect ‘/subsystem=logging/logger=org.keycloak.saml:add(level=TRACE)’

Thanks!

---

<div class="post-metadata">

**Author:** ![bluefloyd](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bluefloyd/32/4989_2.png) [@bluefloyd](https://forum.keycloak.org/u/bluefloyd)\
**Post date:** [May 9, 2024, 12:22pm UTC](https://forum.keycloak.org/t/changing-logging-level-at-runtime/16974/2 "2024-05-09T12:22:58Z")

</div>

I meanwhile figured it out: JMX can be used for this purpose (relying on the support from Quarkus).  
It’s a bit complicated but it works. E.g. if you use Keycloak in a Docker container:

`cd ./keycloak/utils` # a folder mounted to Keycloak via docker mapped to `/opt/keycloak/utils/` from the container  
wget [https://github.com/jiaqi/jmxterm/releases/download/v1.0.4/jmxterm-1.0.4-uber.jar](https://github.com/jiaqi/jmxterm/releases/download/v1.0.4/jmxterm-1.0.4-uber.jar)  
mv jmxterm\*.jar jmxterm.jar

```auto
docker exec -it keycloak bash # from here on all commands are inside the container
cd /opt/keycloak/utils/
java --add-exports jdk.jconsole/sun.tools.jconsole=ALL-UNNAMED -jar jmxterm.jar
open 1
bean java.util.logging:type=Logging
run setLoggerLevel org.keycloak.saml TRACE
run getLoggerLevel org.keycloak.saml
run setLoggerLevel org.keycloak.services.resources DEBUG
run getLoggerLevel org.keycloak.services.resources

```

Keycloak will start logging with TRACE/DEBUG after this!

Other useful JMX commands to try:

```auto
jvms
open PID_GOES_HERE
domains
domain java.util.logging
beans
bean java.util.logging:type=Logging
info
get LoggerNames
run getLoggerLevel org.keycloak.saml
run setLoggerLevel org.keycloak.saml TRACE

```

More details: [https://www.baeldung.com/jmx-mbean-shell-access](https://www.baeldung.com/jmx-mbean-shell-access)

You can obviously do this via remote JMX is as well (e.g. using JConsole) but for that you will need to change how you start up keycloak by adding the following JVM args:

`-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=9111 -Dcom.sun.management.jmxremote.rmi.port=9111 -Djava.rmi.server.hostname=127.0.0.1 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.local.only=false`

Make sure you don’t do this on environments exposed to the public internet, because you might accidentally expose JMX to the public internet (normally a firewall should keep this exotic port closed though)!