Audit History Is Different from Application Logging

Wed, 01 Nov 2017 00:00:00 +0000

When a cart appears to expire, support may ask:

Which cart changed?
What was its prior state?
What state followed?
Who or what caused the transition?
Which policy allowed it?

An engineer investigating the same report may ask:

Which request handled it?
Which worker retried?
How long did the database call take?
Which exception and stack occurred?
What else happened on that host?

Both groups need evidence, but making one record answer both sets of questions usually gives you a bloated audit trail and strangely incomplete logs. Audit history explains durable business change. Application logs explain software execution.

Logging Is a Workload, Not a Side Effect

Tue, 01 Mar 2016 00:00:00 +0000

One system was writing roughly a thousand log lines per second to local disk. Debug records were part of that stream. The individual call sites were small; the combined stream was not.

It was not cheap in aggregate. Every record still had to be constructed, serialized, copied through handlers, written, rotated, and eventually removed or archived. Whether anyone queried it later did not change that work. Calling the record debug did not exempt it from arithmetic.

Logging on Brian Faust

Audit History Is Different from Application Logging

Logging Is a Workload, Not a Side Effect