Types and Content of Log Messages 

Log Message Types

Log messages can generally be divided into the following types:

●      Error messages

If the processing of an application cannot proceed and corrective action needs to be taken, a log message describing the problem must be issued.

The severity level of such a message depends on the severity of the error: If the application is still usable for other requests, the severity level has to be ERROR, whereas it must be FATAL, if the application is not useable anymore.

●      Event notifications

If there are occasions in the software or hardware components that provide important information for the addressees, but it is not necessary immediate corrective action, this is called “event notification”.

Examples:

■       Information for security audits – a user has been locked due to too many logon attempts with an incorrect password;

■       Information about an almost full file system

■       Information about the reconfiguration of a software component, for example a buffer, with a different size.

The severity levels of such messages must depend on the required action to solve the problem. If a corrective action needs to be taken, the severity level must be WARNING, whereas if normally no corrective action is necessary, the severity level has to be INFO.

●      Status recording

You can indicate messages with the following types of information for status recording:

○       About startup and shutdown of software or hardware components

○       About the progress of an application. For example, the amount of documents, processed in conjunction with the amount of resources used.

In both cases the severity level of these message types must be INFO.

●      Context information

If additional information needs to be provided to solve problems, this is called  “context information”.

The severity level of this message must be INFO.

Content of Log Messages

A good log message must have the following structure:

●      A short description of the error, event or status information. That is, you have to give a short answer to the question “What has happened?”, respectively “What status is reached?”. That includes a brief information about the object directly involved.

●      Information about the location or source, that is an answer to the question “Where did it happen?”

●      Information about the consequence. This is necessary if there are future impacts on hardware or software components.

●      Information about possible countermeasures to solve the problem. This usually includes a description of who (addressee/role) must perform countermeasures.

If solving the problem is complicated and requires a detailed description, an external information has to be considered.

More information: Types and Content of Trace Messages.