Chapter 9 setting up structured logging (I)

Chapter nine Set up structured logging （ One ）

IRIS Support structured logging .

Create multiple logs , Each log is used for a different purpose . Customers who have migrated from previous products can use these logs as before , But now you can import all the log information into a single 、 In the middle 、 Machine readable log files —— Structured log . You can then use this file with third-party analysis tools .

This article provides an overview of the information in structured logs , Shows a sample log , It also describes how to enable structured logging .

Information available in structured logs

When you enable structured logging , The system will write the same data to the structured log , It also writes to other logs （ No matter which ）. for example , The system writes the same lines to messages.log And structured logs .

After enabling structured logging , The structured log contains all the following information ：

• write in messages.log Information about . This includes alerts that need attention 、 Information about system startup and shutdown 、 About log files and WIJ Advanced information about files 、 About configuration changes (CPF) And license related information .
• Information written to the audit database . The details depend on the event being audited .

Sample output

This section shows sample output from the structured logging utility , For names / Value pair format and JSON Format .

name / It's worth it

The following output uses formatting options NVP（ name / It's worth it ）. This example has been edited for display purposes ; In actual output , Each entry occupies only one line , There are no blank lines between entries .

when="2019-08-01 18:43:02.216" pid=8240 level=SEVERE event=Utility.Event 
text="Previous system shutdown was abnormal, system forced down or crashed"

when="2019-08-01 18:43:05.290" pid=8240 level=SEVERE event=Utility.Event 
text="LMF Error: No valid license key. Local key file not found and LicenseID not defined."

when="2019-08-01 18:43:05.493" pid=8240 level=WARNING event=Generic.Event 
text="Warning: Alternate and primary journal directories are the same"

when="2019-08-01 18:46:10.493" pid=11948 level=WARNING event=System.Monitor 
text="CPUusage Warning: CPUusage = 79 ( Warnvalue is 75)."

In this format , Each line in the file contains a set of names separated by spaces / It's worth it . Each name / The format of the value pair is name=value, If value Contains space characters , be value Enclosed in brackets . The lines in the log file contain some or all of the following names / It's worth it ：

Name	Value
host	function ^LOGDMN The name of the host （ If... Is provided in the pipeline command ）.
instance	function ^LOGDMN The name of the instance of （ If... Is provided in the pipeline command ）.
when	Always include . Timestamp of the entry , The format is yyyy-mm-dd hh:mm:ss.sss
pid	Always include . Of the process that generated the entry ID
level	Always include . Log level for this entry . This has one of the following values ： - DEBUG2 For detailed debug messages （ For example, hexadecimal dump ）. - DEBUG For less detailed debug messages . - INFO For informational messages , Including all audit events . - WARNING Used to indicate problems that may require attention but do not interrupt the operation . - SEVERE For serious errors , Indicates that the operation is interrupted . -FATAL For fatal errors , Indicates that the system cannot run due to the problem .
event	Always include . Identifier of the code that generated the entry , Usually the class name .
text	Always include . A descriptive string that interprets an entry .
source	Components that act as audit event sources . For components , This is always %System. When application code writes to the event log ,source Indicates the components in the application code .
type	Classify the information of audit events .
group	Group of audit events （ If there is ）.
namespace	Generate the namespace of the entry . This is useful for checking namespace specific behavior , For example, application errors and activities of interoperability products .

JSON

The following output uses formatting options JSON. This example has been edited for display purposes ; In actual output , Each entry occupies only one line , There are no blank lines between entries .

{
     "when": "2019-08-07 14:11:04.904", "pid": "8540", "level": "SEVERE", "event": "Utility.Event", 
"text": "Previous system shutdown was abnormal, system forced down or crashed"}

{
     "when": "2019-08-07 14:11:08.155", "pid": "8540", "level": "SEVERE", "event": "Utility.Event", 
"text": "LMF Error: No valid license key. Local key file not found and LicenseID not defined."}

{
     "when": "2019-08-07 14:11:08.311", "pid": "8540", "level": "WARNING", "event": "Generic.Event", 
"text": "Warning: Alternate and primary journal directories are the same"}

{
     "when": "2019-08-07 14:16:13.843", "pid": "10816", "level": "WARNING", "event": "System.Monitor", 
"text": "CPUusage Warning: CPUusage = 84 ( Warnvalue is 75)."}

In this format , Each line in the file is a with a set of attributes JSON object . Name of property （ And the value contained in the attribute ） And the name in the previous section / Value pairs are listed with the same name .