A maximally useful log message contains a number of fixed items, usually in a fixed-format header of some sort, and text for the human reader to use to understand the implications of the problem.
From memory, the fixed information includes enough to allow for mechanical sorting by nastiness and occasionally mechanical processing:
- date/time
- origin, meaning machine- or domain-name
- source, in some detail,, including the executable name
and process id as a minimum, if applicable,
and optionally the file, function and line, it is good to make this one token, for ease of
parsing and resilience when one line has
"sendmail:parse.c:parse_it:332:1948" and another has
only "mconnect:1293"
- pre-classification, meaning the application type, error type and severity. DFAs can switch on this, and should.
The old ARPA format was error type source and severity
as three decimal digits, which you still see when
smtp says "250 ok". The 2 was permanent success, the 5
meant "the app", in this case smtp, and 0 was the severity.
I prefer ascii, not numbers (;-))
- then the text for the human, saying the meaning of the error,
the same way you're supposed to write the **meaning**
of code in comments, not just say what the code does.
Syslog does about half of this, metze's did most of it.
One very handy pair was the ARPA command and return-code standard.
A command was four letters or less at the beginning of a line (record, packet), often monocase, so it could be treated as a 4-byte integer and switched on.
For example, smtp starts ups with
helo localhost
250 froggy Hello localhost [127.0.0.1], pleased to meet you
The "HELO" is the command, and the next line the response.
the first character is an ascii digit, where
1 means "informational message", and is rare
2 means permanent success
3 means partial success, as in a series of steps.
4 means temporary failure, such as "no space", and
5 means permanent failure
The second digit is 5 for "this app" and 9 for "the OS"
The third digit is the severity, so
599 I must close down, my CPU is on fire
is a very sever and permanent error (:-))
The fourth character is an ascii blank if the reply is
complete on this line, a "-" if it continues to additional lines.
For example, smtp has a help command:
help
214-2.0.0 This is sendmail version 8.12.8+Sun
214-2.0.0 Topics:
214-2.0.0 HELO EHLO MAIL RCPT DATA
214-2.0.0 RSET NOOP QUIT HELP VRFY
214-2.0.0 EXPN VERB ETRN DSN
214-2.0.0 For more info use "HELP ".
214-2.0.0 To report bugs in the implementation contact Sun Microsystems
214-2.0.0 Technical Support.
214-2.0.0 For local information send email to Postmaster at your site.
214 2.0.0 End of HELP info
The three digits and the "-" for continuation allows one to write as simple or as complex a DFA as you like, by doing trivial masking on fixed-length strings.
Does anyone actually subscribe to
I actually had a prospective employer ask me to list the best threads I've been a part of (my job is technical marketing and one of the things I do is look around for things related to my current job to clear up when they are misstated).
I have something like 750 posts, but non-subscribers only get to see a 25 comment history. If you are a subscriber, I would love it if you could page through my comment history and mail me the results.
Yeah, you don't owe me anything, but if you're reading this you probably got here because you either very much agreed or very much disagreed with my comments. If you're in the former category and are a subscriber, maybe you'll take pity.
If not, maybe I'll do it some day
Ok, so I finally figured out what my next job should be
Come on
Seriously, is it just
Think it though a bit more, everyone will thank you.
A quick thread that pretty well sums up how I feel about the way
http://slashdot.org/comments.pl?sid=101442&cid=8655929
...
Pasted here in case the above link ever dies but I may miss parts of the discussion because of it
...
Re:Yeesh (Score:1)
by thesaur (681425) on Wed Mar 24, '04 08:57 AM (#8655929)
However, that cannot prevent an attack by Google. You wouldn't want to block requests referred by google.com, because you do want people to find your site, right?
As reported in a previous story [slashdot.org], Google linked their main logo graphic to an information academic site and brought it down [swin.edu.au]. Subsequently, Slashdot hit [swin.edu.au], but it didn't hold a candle to Google. Fortunately, such attacks by Google are rare. Of course, there is no way to determine your risk for a Google attack, unlike slashdot attacks.
The best idea is to always keep your server ready to handle any load.
I'll probably get modded down for this, but so be it.
[ Reply to This | Parent ]
Most people can't afford to keep their personal servers ready to handle 1% of the load that Google's image fiasco or 10% of a popular article on
Should those people be penalized by not being able to have their own site (rather than surrendering control to a bunch of web farm monkeys)? No, sites like
Wow
And who cares about being modded down? *laugh*
[ Reply to This | Parent ]
Perhaps
Perhaps Google could add a new piece to the stale robots.txt standard like "cache-link-only" so that Google would know the author was only interested in being in the Google engine if Google directed all links to it's own cache for that particular site.
Both are opt-in programs that allow the rest of us to have good conscience when viewing tiny sites via links from beasts like Google and
BTW, I don't want people to get me wrong
Tonight mcrbids commented on my signature ("It is more productive to voice thoughtful opinions (reply) than to judge (moderate) others.") being a "crock"
A semi-lively debate ensued between mcrbids, Darth and myself. Maybe this journal entry will be useful to someone who is confused by the signature. I don't know who would be confused by it's meaning unless they are -looking- to twist it's meaning (even taken purely literally it does not have the extra nuances they implied and in my opinion a literal interpretation actual refutes their view of it), but hey, it's already happened twice in one night.
See this offtopic mini-thread for the clarification. If you care
I think there's a world market for about five computers. -- attr. Thomas J. Watson (Chairman of the Board, IBM), 1943