Addressees of Log Messages 

Since log messages provide valuable information of the functioning of an IT system, administrative or investigative personnel reads log messages. Because the IT systems are complex, each staff member respectively separate staff groups are specialized in specific tasks or components. At least the following groups can be identified (with their associated tasks):

·        System operation group

The tasks of this group are to provide reliable hardware and (technical) software components. If a technical component is unavailable or is not functioning properly in cooperation with other components, it is the task of this group to recognize and solve the problems. Therefore this user group requests information that can help to identify problems or critical situations of the technical component. Also status and activity information related to activities performed by the operator is normally recorded (for example, starting or stopping an operated component). In accordance with these characteristics, this group is only interested in the types of messages mentioned above. If there is no problem to solve or no relevant status information related to an activity of a group member, it is better to provide no further information to not confuse the reader and not complicate the task of checking a log.

·        Application operation group

All tasks necessary to monitor and manage real business applications on top of technical components fall into this group. This can be, for example, a task like the management of regular background jobs or the monitoring of business interfaces. In general, a mixture of technical and non-technical application know-how is necessary to perform these tasks. The type of information (problems, critical situations, status & activity information) is similar to the information recorded for the system operation group, with the difference that it is mainly covering the non-technical, business components of a software system.

A design issue to be considered is the distinction between application operators and application users. The latter group is mostly interested in messages related to their current application use (for example, incorrect value in an input field) and messages describing the success of their doing (for example, “Document NNN created” respectively “Update termination occurred”). The document creation message is normally not written to a log, but is presented to the user in the UI instead, whereas the update termination message needs to be presented to the user in the UI and needs to be stored in a log for later problem analysis.

·        System expert

If errors occur in a technical component, they need to be investigated in order to be solved. If the error is not obviously related to an administrative task immediately performed before (or still in process), additional information is necessary to understand the problem and its context “post-mortem”. Therefore it is necessary to provide context as well as status information regularly to enable a better understanding of the problem. Please keep in mind, that the context and status information has to be chosen and provided carefully to not flood the reader with most often unimportant information. Writing out detailed information has to be reserved for real tracing. The information provided in logs must be enough to understand how to setup tracing to analyze the problem in more detail.

The analysis of logs is very often the starting point for a problem analysis done by the support or development organization.

·        Application expert

Same as “System analysis expert”, but for non-technical business components or even complete applications.