Addressees of Log Messages 

Since logs provide valuable information about an IT system functioning, administrative or investigative personnel reads log messages. At least the following groups can be identified (with their associated tasks):

●      System operation group

The tasks of this group are to provide reliable hardware and software components. If a technical component is unavailable or is not functioning properly in cooperation with other components, this group’s task is to recognize and solve the problems. Therefore, this user group requests information that can help to identify problems or critical situations of the technical component. Also, information related to activities performed by the operator is normally recorded (for example, starting or stopping an operated component). Accordance to these characteristics, this group is only interested in the types of messages mentioned above.

●      Application operation group

All tasks necessary to monitor and manage real business applications on top of technical components belong to this group. Such a task, for example, is the management of regular background jobs or the monitoring of business interfaces. In general, a mixture of technical and non-technical application know-how is necessary to perform these tasks. This type of problem information is mainly about covering non-technical business components of a software system.

Keep in mind the distinction between application operators and application users. The latter group is mostly interested in messages related to their current application use (for example, incorrect value in an input field) and messages describing the success of their deployment (for example “Document NNN created” ).

The document creation message is normally not written to a log, but is presented in the user’s UI instead, whereas the update termination message needs to be stored in a log for later problem analysis.

●      System expert

If errors occur in a technical component, they need to be investigated. If the error is not obviously related to an administrative task, additional information is necessary to understand the problem. Therefore, it is necessary to provide context as well as status information regularly to enable a better understanding of the problem.

Bare in mind, that the context and status information has to be chosen and provided carefully to escape loading the reader with unimportant information.

The information provided in logs must be enough to understand how to setup tracing to analyze the problem in detail.

●      Application expert

This group works over tasks of the System expert group plus covering problems of complete applications.