Event logging
 | This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages)
|
Event logging provides system administrators with information useful for diagnostics and auditing. The different classes of events that will be logged, as well as what details will appear in the event messages, are often considered early in the development cycle. Many event logging technologies allow or even require each class of event to be assigned a unique "code", which is used by the event logging software or a separate viewer (e.g., Event Viewer) to format and output a human-readable message. This facilitates localization and allows system administrators to more easily obtain information on problems that occur.
Because event logging is used to log high-level information (often failure information), performance of the logging implementation is often less important.
A special concern, preventing duplicate events from being recorded "too often" is taken care of through event throttling.
Difficulties in making a clear distinction between event logging and software tracing arise from the fact that some of the same technologies are used for both, and further because many of the criteria that distinguish between the two are continuous rather than discrete. The following table lists some important, but by no means precise or universal, distinctions that are used by developers to select technologies for each purpose, and that guide the separate development of new technologies in each area:
| Event logging | Software tracing |
|---|---|
| Consumed primarily by system administrators | Consumed primarily by developers |
| Logs "high level" information (e.g. failed installation of a program) | Logs "low level" information (e.g. a thrown exception) |
| Must not be too "noisy" (containing many duplicate events or information that is not helpful for its intended audience) | Can be noisy |
| A standards-based output format is often desirable, sometimes even required | Few limitations on output format |
| Event log messages are often localized | Localization is rarely a concern |
| Addition of new types of events, as well as new event messages, need not be agile | Addition of new tracing messages must be agile |
References
 | This article has not been added to any content categories. Please help out by adding categories to it so that it can be listed with similar articles. (July 2024) |