I’ve recently read the article The Problem with logging and was wondering about my current logging strategy.
Usualy I use Log4J in my projects and just have to decide which line/attributes I would like to log.
This strategy worked well for me in the past for all my projects without user-interaction.
Now I want to set up logging for a WebApp with user-interaction like login, session-management,
personalized user pages, etc. and was wondering what would be best practice.
To clarify:
I don’t ask you to help me decide what informations I have to log because that I know for myself (or find
information in articles on this site or google).
I’m asking about the things connected with this topic:
- should I bind every log message to the corresponding user for traceability
- should I open up a new log file for every session
- are there other good libraries especially for logging webapps
- should I only log fatal errors in file and handle minor errors inside the view (e.g. show user)
- and how chatty should I be in those messages shown to the user
I also know that this is a broad topic and that this question can easily be answered by
“it’s personal flavor” or “it depends” but I would highly appreciate anyone who’s willing to give me
some useful hints.
Thanks in advance
You’re right in that this question is very much answered by, “what are your requirements”, but this is my opinion.
Be sure that any event initiated by a user is traceable back to the user. Each logged event should state who is executing the event, or at least contains a transaction ID that can be traced back to the user creating the transaction. This will allow you to fulfill non-repudiation requirements where a user would not be able to deny creating the transaction.
I wouldn’t recommend creating a new log file for each session. A better approach would be to create new log files once they reach a certain size (10 MB for instance). Or, just creating a new log file each day or week (depending on the size of the files). If there a lot of events being logged, a database may be better as it can handle large volumes of data easier and you will be able to query the results as needed.
For libraries, there are plenty out there for Java EE. Log 4J is fine. I’ve also used Apache’s Commons Logging, but I prefer the combination of SLF4J and Logback personally – they are easy to use and integrate well with other logging frameworks.
You may also want to look into Aspect Oriented Programming to create the common logging events that will appear in a lot of methods. Specifically, AOP can help create debug logging for method enter / exit / throw. I’ve done AOP with Spring and can say it is very helpful keeping the code clean.
Speaking of logging levels, it will be very beneficial to make good use of each level as appropriate and create a secure way to change the level at runtime if you are experiencing issues.
Log only errors that would be beneficial to have logged. Tautological, maybe, but logging can often get out of hand. Having too many records to sift through means you will not be able to identify outliers or actual problems. Logging too little means you may miss an issue (if you didn’t log it, it never happened), so, make good use of logging levels for these reasons as well. There may be no reason to log a user validation error (e.g., creating a new password less than the allowable number of chacters), but system errors should always be logged (e.g., unable to contact the database).
Likewise, only notify the user of what they need to know. They will need to know if the password they entered failed validation and why, but they don’t need to know if the database is down (they only need to know that the site is experiencing issues and what they can do in the mean time – i.e., call a support number). Chattiness to the user should be kept to a minimum as constant error notifications that they can’t personally resolve would be a poor user experience.
I suggest you take a look at OWASP’s Logging Cheat Sheet for some more information on logging best practices.
1