Most important point: any log message that doesn't identify some property of the request that originated it (so that you can identify requests leading to erroneous conditions) is cause for immediate defenestration.
How To Write Good Log Messages
11–20 of 57 posts
Re: How To Write Good Log Messages
#12time is expressed in seconds? My computer does about 3 billion things every second. I think milliseconds or preferably microseconds would be much better. Different domains have different needs, though, I'm sure. Also, I'd prefer the log specify the time zone it thinks it's in, rather than just convert to UTC automatically. pid - yes, knowing the process id is good, but knowing the thread is also useful. version - out…
> Also, I'd prefer the log specify the time zone it thinks it's in, rather than just convert to UTC automatically. But my computer thinks it's clock is in UTC, and it only converts to a timezone for human readable dates.
This.
UTC is not only unambiguous, but on some systems measurably faster to capture.
My experience has taught me to work in UTC everywhere possible, local time is typically only relevant for direct human interaction.
Re: How To Write Good Log Messages
#13time is expressed in seconds? My computer does about 3 billion things every second. I think milliseconds or preferably microseconds would be much better. Different domains have different needs, though, I'm sure. Also, I'd prefer the log specify the time zone it thinks it's in, rather than just convert to UTC automatically. pid - yes, knowing the process id is good, but knowing the thread is also useful. version - out…
Thanks for the feedback. I'm with you on the milliseconds and threads bits. As for hostname / version... how are you getting those into your logs? I've found having version in the logs very useful (and wished I had it when it wasn't there).
Couldn't you output the host and version at the beginning of the log? Any tool that transforms the logs (splicing together logs from different servers) should include these bits in it's output.
Also, why don't you use a sortable form for time? (With the most significant parts first.)
Re: How To Write Good Log Messages
#14Earlier quoted context omitted.
> Also, I'd prefer the log specify the time zone it thinks it's in, rather than just convert to UTC automatically. But my computer thinks it's clock is in UTC, and it only converts to a timezone for human readable dates.
This. UTC is not only unambiguous, but on some systems measurably faster to capture. My experience has taught me to work in UTC everywhere possible, local time is typically only relevant for direct human interaction.
A caveat here as well is you also need to make sure your various clocks in the data center are synched. This is one of those common but overlooked scenarios which lead to hilarious discussions about latency when really there was just a clock synch problem. Additionally the fallacies of distributed computing come into play here (namely, transport cost is 0) so you need to take extra care when looking at measurements across different systems and machines. Even machines in the same data center. The pipe that you are communicating across could be oversubscribed for example.
Re: How To Write Good Log Messages
#15time is expressed in seconds? My computer does about 3 billion things every second. I think milliseconds or preferably microseconds would be much better. Different domains have different needs, though, I'm sure. Also, I'd prefer the log specify the time zone it thinks it's in, rather than just convert to UTC automatically. pid - yes, knowing the process id is good, but knowing the thread is also useful. version - out…
Thanks for the feedback. I'm with you on the milliseconds and threads bits. As for hostname / version... how are you getting those into your logs? I've found having version in the logs very useful (and wished I had it when it wasn't there).
I don't think outputting the version is overkill at all. It's much easier and simpler to deal with it this way. Probably the nanosecond business is very much overkill, that only matters for a smaller subset of problem domains.
Re: How To Write Good Log Messages
#16Earlier quoted context omitted.
Thanks for the feedback. I'm with you on the milliseconds and threads bits. As for hostname / version... how are you getting those into your logs? I've found having version in the logs very useful (and wished I had it when it wasn't there).
Couldn't you output the host and version at the beginning of the log? Any tool that transforms the logs (splicing together logs from different servers) should include these bits in it's output. Also, why don't you use a sortable form for time? (With the most significant parts first.)
My issue with host and version at the beginning of the log is that they'll roll away when your logs rotate. If you've got a service that's rarely taken down, anything written to the front of the logs is likely long gone by the time you have a problem. That said, there may be a better way to handle these two. I certainly don't like repeating information if it's not necessary.
Re: How To Write Good Log Messages
#17 "08-08-2012-20:27:59"
cut -d ' ' -f2- foo.log | sort
Please use YYYY-MM-DD. It's sortable and more intuitive for everyone outside of the USA. See also http://en.wikipedia.org/wiki/ISO_8601
Re: How To Write Good Log Messages
#18"08-08-2012-20:27:59" Which 08 is the day or the month? cut -d ' ' -f2- foo.log | sort Great, now it's sorted by (month, day, year) or (day, month, year). If my logs span multiple years, the sorting is useless. Please use YYYY-MM-DD. It's sortable and more intuitive for everyone outside of the USA. See also http://en.wikipedia.org/wiki/ISO_8601
[deleted]
Re: How To Write Good Log Messages
#19"08-08-2012-20:27:59" Which 08 is the day or the month? cut -d ' ' -f2- foo.log | sort Great, now it's sorted by (month, day, year) or (day, month, year). If my logs span multiple years, the sorting is useless. Please use YYYY-MM-DD. It's sortable and more intuitive for everyone outside of the USA. See also http://en.wikipedia.org/wiki/ISO_8601
[deleted]
I'm not advocating internationalization.
I'm advocating for using a well-known formatting standard used by almost every mature library which is unambiguous and useful for sorting.
Re: How To Write Good Log Messages
#20"08-08-2012-20:27:59" Which 08 is the day or the month? cut -d ' ' -f2- foo.log | sort Great, now it's sorted by (month, day, year) or (day, month, year). If my logs span multiple years, the sorting is useless. Please use YYYY-MM-DD. It's sortable and more intuitive for everyone outside of the USA. See also http://en.wikipedia.org/wiki/ISO_8601
[deleted]
More like the author was lazy and not thinking about correct ordering of the date there. It should absolutely be yyyy-mm-dd. I'll be updating the post w/ feedback from the comments sometime today or tomorrow. So expect to see that change.