I'm looking for a style guide to log messages:
For example:
i.e. what makes a good / bad log message string
I'm particularly interested in what make a good log string - beyond including the TIME, SEVERITY and COMPONENT, as I tend to use log4j which gives me this information for free.
The 10 Commandments of Logging is the perfect introduction into the world of logging.
This website will teach you the do's & dont's of creating your own log files.
Whatever you decide, if it's a text log, start each line with a good timestamp in, preferably, ISO format:
YYYY-MM-DDTHH:MM:SS.mmm
In all likelihood, you will want to follow the timestamp with a severity code.
Some good logging guidelines can be found here:
http://watchitlater.com/blog/2009/12/logging-guidelines/
and here
http://download.oracle.com/docs/cd/B32110_01/web.1013/b28952/logging.htm
That really depends on your application. I may draw inspiration from anything at /var/log/*
Effective logging is an art, but there are a few major items that can help:
Thread ID: Enterprise applications are often executed in a multithreaded environment. With thread ID information, you can distinguish one request from another.
Caller identity: The identity (or principal) of the caller is also an important piece of information. Because different users have different privileges, their execution paths could be very different. Putting the user's identity in the log messages can be a great help for a security-aware application.
Timestamp: Generally, users can only approximate the time at which a problem occurred. Without a timestamp, it's difficult for the support personnel to identify the problem.
Source code information: This includes class name, method name, and line number.
(These tips taken from this IBM article on Java logging.)
On the convention side, for a few years I've been formatting my logs as:
severity timestamp source message
With severity being symbols for:
(-) Info
(!) Warning
(*) Error
E.g.:
(-) 2010-10-13T18:53:42 foo: Starting up...
(!) 2010-10-13T18:54:11 foo: bar: Unable to lock file "quux", will try again in 4 seconds.
(-) 2010-10-13T18:56:13 foo: Loading plugin "baz"...
(*) 2010-10-13T18:57:39 foo: baz: Error 0xbaadbeef during RPC.
(-) 2010-10-13T18:58:04 foo: Shutting down...
I found out it's easier to glance-search for specific message classes (all errors, all warnings), especially while browsing the logs using a pager in a terminal.
