Every programmer should understand who are the user of their application. Not only end-user or operator (sometimes called as admin) of the application, but they also need to consider all IT folks who maintain and support this application: system administrators, technical support, and maintainers (programmers who will add features or troubleshoot).
For this reason we should consider what we should write in log messages. What we log if error or exception happen, so the troubleshooter have clear picture about the problem, or if they need to recover - from which state? Log messages are needed by system administrators to detect problems as early as possible. First level technical support must also make a decision whether the problem can be resolved through a restart, data patch maybe? or bug fixing is needed? And maintainers can make adjustment based on the information he/she able to dig from the logs.
Logging is a way to monitor what is happen inside an application. By using logging, we can find out important events in the application and even what is inside a variable. The ability to know how the application working, which process are running (and etc) will help us to do performance tuning, detect the bottleneck, identify the source of the problem, and so on.
What we must consider:
- At which point we should put the log
- What information should be written in the log
- Where to write logs: console, file, database, syslog/Event Viewer?
- How we format log messages so that they are easy to trace?
- How to filter logs to show only certain severity?
- How to filter logs to only cover certain modules?
Good logging framework will helping us in number 4 to 6, so we only just need to think about number 1 and 2.
Where to write logs: console, file, database, syslog/Event Viewer?
Permanent storage is preferred over console for long term archiving. In case we need to filter and search for past information, we can extract it from our log archives, meanwhile console is only temporary and will be close if application is terminated. Permanent media can be files or database. Sometimes we also want to integrate our application logs with the operating system log. In Unix environment we use syslog, whereas in our Windows have Event Viewer. This approach make system administrators able to easily detect any problem with the application from single log monitor.
How we format log messages so that they are easy to trace?
Different needs expecting different format of log messages. As example, for audit we need to see which user initiate the operation. For troubleshooting needs, we might need to look at time of an error occurred, in which module the error happen, and more information related to those error.
How to filter logs to show only certain severity?
This is related with the flexibility to turning logs on/off. Log messages that we want to capture in the development phase certainly different from what we want to capture in the production phase. In development phase, we want to see the contents of variables, method call parameters, state of an object, and various other detailed information. Not all of these details is needed in production phase. We want to log everything from DEBUG, INFO, and ERROR. In production phase, what more important is information about events and error occurred. Mostly we only want to log certain INFO and ERROR. More than that, will logs too many things, and the "important messages" will be buried under those "unrelevant informations".
How to filter logs to only cover certain modules?
We need the flexibility to choose which part of the application which we want to log. If the application to be monitored consists of several modules, we may have different log strategy for different modules. For example, in module A we want to see only error message complete with the date and time it's occurred, directed to the file. For module B, we want to see the complete information, and save those to the database.