On Thu, Apr 25, 2019 at 6:19 AM Kamal Ezzaki <kamalezzaki1@gmail.com> wrote:
in my case centos7 , i add this line into /etc/rsyslog.conf for guacd
# vi /etc/rsyslog.conf

if $programname == 'guacd' then {

but i want also the output the containt [http-bio-8080-exec-9] for login attemps and users connections , any ideas ? 

You'd have to configure Tomcat to redirect its output to Syslog.  I'm sure it's possible, but I'm not familiar with how to do it off the top of my head.