Audit History Is Different from Application Logging

Wed, 01 Nov 2017 00:00:00 +0000

When a cart appears to expire, support may ask:

Which cart changed?
What was its prior state?
What state followed?
Who or what caused the transition?
Which policy allowed it?

An engineer investigating the same report may ask:

Which request handled it?
Which worker retried?
How long did the database call take?
Which exception and stack occurred?
What else happened on that host?

Both groups need evidence. They do not need the same record.

Logging Is a Workload, Not a Side Effect

Tue, 01 Mar 2016 00:00:00 +0000

One system was writing roughly a thousand log lines per second to local disk. Debug records were part of that stream. The individual call sites were small; the combined stream was not.

It was not cheap in aggregate. Every record still had to be constructed, serialized, copied through handlers, written, rotated, and eventually removed or archived. Whether anyone queried it later did not change that work.

We made log levels configurable, kept debug output on internal nodes where it was useful, and added rotation and archival. The important shift was not from “many logs” to “few logs.” It was from treating logging as harmless commentary to treating it as a workload with a budget.

Logging on Brian Faust

Audit History Is Different from Application Logging

Logging Is a Workload, Not a Side Effect