What is the best way to 'log' Windows Service activity, should I use Windows Log Event Viewer, or just use plain txt file. If I use event log, I think there is a chance of being the event log full.
My new favourite logging framework is Serilog. We make use of ELK for log aggregation and so Serilog is setup to write logs JSON format, e.g.
{"Level":"Information","MessageTemplate":"Service Started","Timestamp":"2017-07-27T11:29:54.3948669+01:00"}
{"Level":"Information","MessageTemplate":"Service Stopped","Timestamp":"2017-07-27T11:31:14.8305763+01:00"}
These logs are then sent for aggregation and are visible and searchable via a web interface - we don't bother logging to the event log because nobody logs onto these boxes.
If you only have a couple of services then log aggregation might be overkill - its easy enough to have Serilog write to other formats instead (e.g. to the event log, or non-json formatted files which are easier for humans to read).
Definitely use a logging framework (log4net is also good, I've also heard good things about NLog but never used it myself). Any good logging framework will let you selectively log important messages to the event log.
I would use the NLog library.
link
Then you are free to choose File or EventViewer depending on the customer expectations.
From the support people point of view I would use the event viewer because it is easy to reach. (but do not flood it with info messages, just error)
Related
I want to implement logging in a console application. And since I'm using libraries that expect ILogger, I need to provide one.
For reasons I don't quite fully understand, every article seems to recommend I use SeriLog rather than writing my own logger. But no one has provided a convincing reason why.
In either case, I need the following:
Logged information should go to the console.
Logged information should go to a log file.
After my application runs, I want to put all the information logged into an email.
Can anyone tell me how I could accomplish all three, and if I really need something like SeriLog to do so?
NOTE: I do not think it makes sense to read from the log file and use that to email the log. The log file could include logging from many sessions and I only want to email data from the most recent session.
Based on the requirements you listed, it seems Serilog would be a perfect fit for you, as you can leverage a combination of the existing sinks such as Console, File, and possibly Memory - though you don't need the last one... You can easily create a unique log file per session, read that file and send over email if that's what you want to achieve...
If you're really particular about the last part, you can write your own Serilog sink that buffers the log events the way you want and then send by email at the end.
That said, sending logs to yourself via email is not really something people do anymore these days... There are better sinks that you can use to send logs directly to a store/service that can continuously ingest logs automatically and provide great UIs and APIs to query your logs... You might want to take a look at Seq, Sentry, DataDog, and others...
Serilog is a well designed library, very widely used, and thoroughly tested, with close to 27,000 open-source projects and hundreds of contributors, as of this writing.
If you think you can innovate on how logging is done and take it to the next level, then that would be a good reason to roll your own library, otherwise seems like a waste of time reinventing the wheel.
Innovation is actually how Serilog came about... Other widely used logging libraries such as Log4Net and NLog existed before, but Serilog made semantic logging mainstream in the .NET space coupled with a well designed way of creating extensions (sinks, enrichers, destructurers, ...). The rest is history... NLog soon after followed the footsteps of Serilog, and over time Log4Net became obsolete and is legacy at this point.
I'm trying to create a simplified API for both logging (errors, warnings, info) and tracing (debug, analytics) to the Windows Event Log so I can use Windows Event Viewer to work with the logs. I found the EventLog class and started coding against it, and it works for logging to the Application log. I can't find any documentation on specifying the log subcategory with this class, though. I need to push trace info to the Analytic and Debug logs, and I'd like to let the application choose whether logged events go to the Admin or Operational logs.
I then learned about the EventSource class, and various blogs on MSDN indicate that it does allow you to specify the logging "channel", but I don't know whether the channel is another word for the log subcategory.
This is the only thread I could find comparing the two classes, and it didn't seem to answer what I need to know:
Can I use either EventLog or EventSource for logging to a specific to WEL subcategory?
Is one of them recommended over the other in the .NET 4.5 framework? i.e. is EventLog considered to be deprecated, or is it meant only for non-trace use?
Yes you can use EventLog as shown here or EventSource as shown here and here. I know of no official recommendation, but in my opinion it is easier to write a strong typed log message with EventSource. It also has more features and with this you can even use it with .Net 3.5 if you want.
Looks like I misinterpreted the Help/TechNet info on these logs. There are the Windows Logs -- Application Security, Setup, System, ForwardedEvents -- and then there are custom Applications and Services Logs. Only the latter may have a subtype: Admin, Operational, Analytic, Debug. The Windows Logs don't have subtypes, and they're intended only for logging (not tracing), so they don't accept a logging level that equates to "Debug" or "Trace".
That being said, the EventLog class suits my needs for logging, but it doesn't seem to provide enough features to interface with ETW for tracing. If I want to write to trace-worthy logs, I'll have to use ETW and the EventSource class is better equipped for that.
You don't need an API - it's built in to .Net. Consider TraceSource and the EventLogTraceListener. You can apply filters to message types to send only those messages which are 'event log worthy' to the event log, and use ETW and custom trace listeners to capture transient debug data. Reconfiguration can be done at runtime to help with debugging. Also an upside - there are a ton of TraceSources built in to the .net framework.
See this SO answer, and this blog post for more on why TraceSource is a good option
I have a web application, and I would like to audit most of the users actions on the application, for example login, insertion to db, update to db, fired exceptions, etc.
One of my senios suggested using a queue for faster performance, so you just enqeue an event and it is then processed automatically without having to wait for it to be processed.
What are your suggestions? How should I process them? Enqueueing them is no problem, but I'm not sure how they will be processed then without no body calling a method.
I am using C# with .NET 4.0
I've been working on a library that can probably help.
Audit.NET and its extensions to audit different systems (WCF, MVC, WebApi, EF) and store logs in different data storages (SQL, MongoDB, DocumentDB, File, EventLog) will give you the flexibility to configure what do you want to audit and where do you want to store the audit logs.
I would simply recommend an off the shelf logging framework that is stable and supported. Have you considered a logging framework, like log4net?
You could write a custom appender for logging into MSMQ if you'd like.
An alternative logger is called TracerX. It is written in C# and fast and flexible. Because the source code is available it means you can modify it as you wish to suit your needs. It comes with a viewer that allows for filtering the output.
https://github.com/MarkLTX/TracerX and an article on how to use it:
http://www.codeproject.com/KB/dotnet/TracerX.aspx
Two topics of interest actually:
Asynchronous logging
Aspect Oriented Features
Asynchronous logging may speed-up heavy processing 100-fold. Use a writer thread that dumps the queue into log sink every,say 100ms however that Logging engine must be deterministically started and stopped so it can flush the sinks on application stop.
Aspect Oriented Programming addressed your cross-cutting concern - audit/log calls shall be invoked in desired operation prologues/epilogues - look at PostSharp project.
(Little late on the answer, this post shows up high in google, so I thought it may be worth looking at some of the options)
If you are looking to actually audit. (By this I mean to record that an action took place, who did it and when, and for that auditable log to be able to be used as evidence to an external auditor)
(Debug Logging vs Auditing logging)
If so, you can consider some options, such as:
use an Audit logging library
adopt an EventStore database
use a logging library that fails loudly
1. using an audit library
Audit.NET has already been mentioned here and has an impressive number of downloads and is very feature-rich
auditable - an alternative to the above (disclaimer, its written by me)
both are pretty cool, as they allow you to bring your own datastore
2. Eventsourcing
EventStore
Postgres with Marten
The design here (which can impact your architecture to embrace Events) is that Events are immutable, and if you store them then you have an auditable store of things that happened in your system
note this does not look to solve the question above, but it does solve how to audit, so I have mentioned it
3. Logging library
Serilog - Issue
you have to confirm that the logging library if it fails to add an Audit Log, it will throw an exception.
if it does not do that then you will be missing auditable logs, which then you cannot build trust with your Auditors
Side note 1 - with options 1 and 3, you may need to ensure that the log is written in the same transaction as your primary data store. to ensure that all of the information is ACID. (this is similar to the issue people have with publishing an event which is outside of the database transaction)
Side note 2 - that audit logs should be able to identify who did what, so you may/should need to encrypt the datastore they eventually end up in.
In my team there is discussion about web application exception logging, regarding whether we should log to a text file or the event log.
Can anyone please tell me which is the better way of exception logging occuring in the application? Either one of the two I've already mentioned or is there a better option?
Don't reinvent the wheel - use an already existing logging library/tool such as log4net or ELMAH instead of writing your own logging library. Both give you multiple choices for where you log exceptions to, it's up to you which you prefer.
Two things to consider:
1 - Where do you log to if you're logging to the database, but the database is unavailable / under heavy load?
2 - Windows Event Logging is very light-weight and event log forwarding means you can automagically aggregate logs from multiple machines without writing any code.
Another great and easy to use Logging-Library is NLOG
From the site:
"Supported targets include:
Files – single file or multiple, with
automatic file naming and archival
Event Log – local or remote
Database
– store your logs in databases
supported by .NET
Network – using
TCP, UDP, SOAP, MSMQ protocols
Command-line console – including
color coding of messages
E-mail – you
can receive emails whenever
application errors occur
ASP.NET trace
… and many more
Other key features:
very easy to configure, both through configuration file and programmatically
easy-to-use logger pattern known from log4xxx
advanced routing using buffering, asynchronous logging, load balancing, failover, and more
cross-platform support: .NET Framework, .NET Compact Framework and Mono (on Windows and Unix)"
I prefer a text file because it allows for more flexibility and easier navigation. I suppose it's a matter of preference, but the navigation between errors in the Windows event log seems very cumbersome. In addition to the cumbersome navigation it includes errors that you don't care about. If you can define the format and the content then it's much more efficient.
At the app I work, we are used to log every exception at the database, so this way is easier to link the exceptions details to the "user error report" they are requested to fill (which is at our the default error page). It helps us on statistics and as already said, linking exception details to the user description of the error (like, which steps he took to get that error, etc...)
Disclaimer: i am the developer of KissLog.net logging application.
log4Net and Elmah are very good, but they have limited capabilities.
Elmah doesn't support trace / log messages, and logs only the exceptions, and log4Net doesn't provide a user interface to navigate through the logs.
You can try to use KissLog.net, it is an application where i tried to aggregate all the necessary logging features (capture errors, log / trace messages, easy to use user-interface)
I'm building a C#/Asp.Net (FW 2.0) web application and I was wondering where I should store my error logs entry.
I could write it on a file on the server, but that doesn't seems right to me. It would be insconsistent with the idea of a database.
The other obivous answer is on the database, but what happened if I do not have any connection with the database. If the client get a connection error to the database what do I do(because the server and the database aren't on the same machine obviously)?
Your suggestions are appreciated.
Than you
Edit : I'm talking about basic error logging here, please do not refer such things as big frameworks like log4net.
System Event log with appropriate event source (logging channel)
http://support.microsoft.com/kb/307024
Compared to logging to a DB log4net or nlog are not "big frameworks". Keep it simple and these two provide exactly what you need, with very little ramp up period.
Having a fallback mechanism is a very valid scenario. Logging to the windows event log is often not practical, because it isn't easy to analyze to logs, as is with relational databases. But allowing events to be logged to the event log when your database fails is not a luxury option IMO.
This scenario is one of the reasons I built a logging framework (I won't reference it, just as you requested). It supports a concept called 'fallbackProvider' that allow the event to be logged to an alternative logger in case the main logger fails. When you write your own logging mechanism, you could embrace such a concept.
Good luck.
Store it in the event log; it is designed for this purpose after all! Its the place most people would look for errors, messages and warning regardless of what they know about the application.
The enterprise library provides a framework for logging which you can use Enterprise Library. This allows you to change how/where events are logged based on a configuration file so you don't have to make a decision where events are logged.
In addition to this, if you use the exception handling block you can also log errors to the eventlog with minimal effort
I guess you really have three options:
Use a small database to store all the error logs on the local machine using something light-weight like SQLlite or SQLServer Compact.
Save it to a flat file (xml, or what have you) where you can view it.
Send it straight to the Event Log. (I'd probably do this).
log to the database and xml as a fallback, asp.net account will need perms to log errors to eventviewer which may not be such a good idea on the web server unless it is absolutely neccessasy.
If you're willing to consider a simple commercial product, take a look at Gibraltar. It stores logs locally then uploads them to a web service when a connection is available. The logs are then indexed in an embedded database and an analysis tool lets you review errors and other information at whatever level of detail you require.
I see that you're a student, Frank. Email me directly to discuss the possibility of us offering you a free license.
-System Event Viewer
-you may cache your error to local & lightweight db file (can be SqLite/Sql Compact), then when connection is available, you send it to server