Show TOC

Background documentationTypes and Content of Log Messages Locate this document in the navigation structure

 

Log messages can generally be divided into the following types:

  • Error messages

    If the processing of an application cannot proceed and corrective action needs to be taken, a log message describing the problem must be issued.

    The severity level of such a message depends on the severity of the error: If the application is still usable for other requests, the severity level has to be ERROR, whereas it must be FATAL, if the application is not useable anymore.

  • Event notifications

    If there are occasions in the software or hardware components that provide important information for the addressees, but it is not necessary immediate corrective action, this is called "event notification".

    Example Example

    Examples:

    • Information for security audits - a user has been locked due to too many logon attempts with an incorrect password;

    • Information about an almost full file system

    • Information about the reconfiguration of a software component, for example a buffer, with a different size.

    If a corrective action needs to be taken, the severity level must be WARNING, whereas if normally no corrective action is necessary, the severity level has to be INFO.

    End of the example.

  • Status recording

    You can indicate messages with the following types of information for status recording:

    • About startup and shutdown of software or hardware components

    • About the progress of an application. For example, the amount of documents, processed in conjunction with the amount of resources used.

    In both cases the severity level of these message types must be INFO.

  • Context information

    If additional information needs to be provided to solve problems, this is called "context information".

    The severity level of this message must be INFO.

Features

A good log message must have the following structure:

  • A short description of the error, event or status information. That is, you have to give a short answer to the question "What has happened?", respectively "What status is reached?".

  • Information about the location or source, to answer the question "Where has it happened?"

  • Information about the consequence. This is necessary if there are future impacts on hardware or software components.

  • Information about possible countermeasures to be performed and who (addressee/role) to solve the problem.

If solving the problem is complicated and requires a detailed description, an external information from traces is needed.

More information: Types and Content of Trace Messages