Log information best practice

Question

I am doing production support, relying much on log to troubleshoot. I found that the log information is quite messy for now.

Could you provide the best practice or guide to write log information?

BTW: we're using log4Net. Do you have any suggestion on alternative library?

Thanks.

Answer 1

Ideally, your log messages should include details of When, What, Where, Who, and some indication of how serious the event that triggered the message was.

• Include the date as well as the time. If your application is distributed across timezones include a time zone indicator as well. It'll remove confusion if everyone know exactly what time 03:11:04 is in their timezone.
• Include the logging severity level.
• Include some indication of the module or class that triggered the log massage in the log message.
• If possible, encourage the developers to include specific information in the messages: e.g., 'File corrupt', is a lot less useful than, 'File corrupt: "C:\foo\bar.dat"'
• If possible, have the developers include some sort of session or transaction ID in the error message. It is handy to be able to filter the logs for messages from the transaction that had an error and ignore all the transaction that were fine.
• It is often a good idea to include an error code in the log messages for errors.

I'd second the advice gave @Oded in keeping the messages tidy. For the routine stuff, date & time, log level, error code, I'd try to format them to be a fixed width, and put them at the start. It makes scanning the logs much easier.

As regards good guides on log message formatting, the only thing I have come across is chapter 17, of the book 'Release It!': http://www.pragprog.com/titles/mnee/release-it A lot of the above advice is based on that.

Answer 2

ELMAH is a very good logging library and not a bad alternative to log4net.

In regards to the formatting of your logs (you say the information is "messy", though you don't explain exactly what that means) - make sure each entry is clearly separated from others and that it is formatted in a readable manner (spacing, linebreaks etc...).