{"id":458,"date":"2011-09-08T10:05:43","date_gmt":"2011-09-08T18:05:43","guid":{"rendered":"http:\/\/raffy.ch\/blog\/?p=458"},"modified":"2011-09-07T19:37:24","modified_gmt":"2011-09-08T03:37:24","slug":"logging-guidelines-enable-action","status":"publish","type":"post","link":"https:\/\/raffy.ch\/blog\/2011\/09\/08\/logging-guidelines-enable-action\/","title":{"rendered":"Logging Guidelines Enable Actions"},"content":{"rendered":"

\"LogAnalyzing log files can be a very time consuming process and it doesn’t seem to get any easier. In the past 12 years I have been on both sides of the table. I have analyzed terabytes of logs and I have written a lot of code that generates logs. When I started writing Loggly’s middleware, I thought it was going to be really easy and fun to finally write the perfect application logs. Guess what, I was wrong. Although I have seen pretty much any log format out there, I had the hardest time coming up with a decent log format for ourselves. What’s a good log format anyways? The short answer is: “One that enables analytics or actions.” <\/p>\n

I was sufficiently motivated to come up with a good log format that I decided to write a paper about application logging guidelines<\/a>. The paper has two main parts: Logging Guidelines and a reference architecture for a cloud service. In the first part I am covering the questions of when<\/strong> to log, what<\/strong> to log, and how<\/strong> to log. It’s not as easy as you might think. The most important thing to constantly keep in mind is the use of the logs. Especially for the question on what to log you need to keep the log consumer in mind. Are the logs consumed by a human? Are they consumed by a log management tool? What are the people looking at the logs trying to do? Debugging the application? Monitoring performance? Detecting security violations? Depending on the answers to these questions, you might change the places in your code that you emit log records. (Or even better you log in all places and add a use-case indicator as a field to your logs.)<\/p>\n

The paper is a starting point and not a definite guide. I would expect readers to challenge it and come up with improvements and refinements of use-cases and also the exact contents of the log records. I’d love to hear from practitioners and get a dialog going.<\/p>\n

As a side note: CEE, the Common Event Expression<\/a> standard, covers parts of what I am talking about in the paper. However, the paper’s focus is mainly on defining guidelines for application developers; establishing a baseline of when log entries should be recorded and what information should be included.\n<\/p>\n

Resources: Cloud Application Logging for Forensics<\/strong> – Paper<\/a> – Presentation<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Analyzing log files can be a very time consuming process and it doesn’t seem to get any easier. In the past 12 years I have been on both sides of the table. I have analyzed terabytes of logs and I have written a lot of code that generates logs. When I started writing Loggly’s middleware, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,3],"tags":[],"class_list":["post-458","post","type-post","status-publish","format-standard","hentry","category-log-analysis","category-programming"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t