I've worked in shops where I've implemented Exception Handling into the event log, and into a table in the database.
我曾经在我已经在事件日志中实现异常处理的商店以及数据库中的表中工作过。
Each have their merits, of which I can highlight a few based on my experience:
每个都有它们的优点,我可以根据我的经验强调一些:
Event Log
- Industry standard location for exceptions (+)
- Ease of logging (+)
- Can log database connection problems here (+)
- Can build report and viewing apps on top of the event log (+)
- Needs to be flushed every so often, if alot is reported there (-)
- Not as extensible as SQL logging [add custom fields like method name in SQL] (-)
异常的行业标准位置(+)
易于记录(+)
可以在这里记录数据库连接问题(+)
可以在事件日志(+)之上构建报告和查看应用程序
需要经常刷新,如果有很多报道( - )
不像SQL日志那样可扩展[在SQL中添加方法名称等自定义字段]( - )
SQL/Database
- Can handle large volumes of data (+)
- Can handle rapid volume inserts of exceptions (+)
- Single storage location for exception in load balanced environment (+)
- Very customizable (+)
- A little easier to build reporting/notification off of SQL storage (+)
- Different from where typical exceptions are stored (-)
可以处理大量数据(+)
可以处理异常的快速卷插入(+)
负载平衡环境中的异常单存储位置(+)
非常可定制(+)
从SQL存储构建报告/通知更容易(+)
与存储典型异常的地方不同( - )
Am I missing any major considerations?
我错过了任何重大考虑因素吗?
I'm sure that a few of these points are debatable, but I'm curious what has worked best for other teams, and why you feel strongly about the choice.
我确信其中一些问题值得商榷,但我很好奇对其他团队最有效的方法,以及为什么你对这个选择有强烈的感觉。
4 个解决方案
#1
4
You need to differentiate between logging and tracing. While the lines are a bit fuzzy, I tend to think of logging as "non developer stuff". Things like unhandled exceptions, corrupt files, etc. These are definitely not normal, and should be a very infrequent problem.
您需要区分日志记录和跟踪。虽然线条有点模糊,但我倾向于将日志记录为“非开发人员”。像未处理的异常,损坏的文件等等。这些绝对不正常,应该是一个非常罕见的问题。
Tracing is what a developer is interested in. The stack traces, method parameters, that the web server returned an HTTP Status of 401.3, etc. These are really noisy, and can produce a lot of data in a short amount of time. Normally we have different levels of tracing, to cut back the noise.
跟踪是开发人员感兴趣的。堆栈跟踪,方法参数,Web服务器返回HTTP状态401.3等。这些实际上很嘈杂,并且可以在很短的时间内生成大量数据。通常我们有不同的追踪水平,以减少噪音。
For logging in a client app, I think that Event Logs are the way to go (I'd have to double check, but I think ASP.NET Health Monitoring can write to the Event Log as well). Normal users have permissions to write to the event log, as long as you have the Setup (which is installed by an admin anyway) create the event source.
对于登录客户端应用程序,我认为事件日志是要走的路(我必须仔细检查,但我认为ASP.NET Health Monitoring也可以写入事件日志)。普通用户有权写入事件日志,只要您具有安装程序(无论如何由管理员安装)创建事件源。
Most of your advantages for Sql logging, while true, aren't applicable to event logging:
Sql日志记录的大多数优点都是正确的,不适用于事件日志记录:
- Can handle large volumes of data: Do you really have large volumes of unhandled exceptions or other high level failures?
- Can handle rapid volume inserts of exceptions: A single unhandled exception should bring your app down - it's inherently rate limited. Other interesting events to non developers should be similarly aggregated.
- Very customizable: The message in an Event Log is pretty much free text. If you need more info, just point to a text or structured XML or binary file log
- A little easier to build reporting/notification off of SQL storage: Reporting is built in with the Event Log Viewer, and notification systems are, either inherent - due to an application crash - or mixed in with other really critical notifications - there's little excuse for missing an Event Log message. For corporate or other networked apps, there's a thousand and 1 different apps that already cull from Event Logs for errors...chances are your sysadmin is already using one.
可以处理大量数据:您是否真的有大量未处理的异常或其他高级别故障?
可以处理异常的快速卷插入:单个未处理的异常应该会降低您的应用程序 - 它本身就是速率有限的。非开发人员的其他有趣事件应该类似地汇总。
非常可定制:事件日志中的消息几乎是免费文本。如果您需要更多信息,只需指向文本或结构化XML或二进制文件日志即可
更容易构建SQL存储的报告/通知:报告是使用事件日志查看器构建的,并且通知系统是固有的 - 由于应用程序崩溃 - 或与其他真正关键的通知混合在一起 - 没有什么借口缺少事件日志消息。对于企业或其他网络应用程序,有一千零一个不同的应用程序已经从事件日志中剔除错误......很可能你的系统管理员已经在使用一个。
For tracing, of which the specific details of an exception or errors is a part of, I like flat files - they're easy to maintain, easy to grep, and can be imported into Sql for analysis if I like.
对于跟踪,其中一个异常或错误的具体细节是其中的一部分,我喜欢平面文件 - 它们易于维护,易于grep,并且可以导入到Sql中进行分析,如果我喜欢的话。
90% of the time, you don't need them and they're set to WARN or ERROR. But, when you do set them to INFO or DEBUG, you'll generate a ton of data. An RDBMS has a lot of overhead - for performance (ACID, concurrency, etc.), storage (transaction logs, SCSI RAID-5 drives, etc.), and administration (backups, server maintenance, etc.) - all of which are unnecessary for trace logs.
90%的情况下,您不需要它们并且它们被设置为WARN或ERROR。但是,当您将它们设置为INFO或DEBUG时,您将生成大量数据。 RDBMS有很多开销 - 性能(ACID,并发等),存储(事务日志,SCSI RAID-5驱动器等)和管理(备份,服务器维护等) - 所有这些都是跟踪日志不必要。
#2
3
I wouldn't log straight to the database. As you say, database issues become tricky to log :)
我不会直接登录数据库。如你所说,数据库问题变得棘手的日志:)
I would log to the filesystem, and then have a job which bulk-inserts from files to the database. Personally I like having the logs in the database in the log run primarily for the scaling situation - I pretty much assume I'll have more than one machine running, and it's handy to be able to effectively have a combined log. (Each entry should state the machine it comes from, of course.)
我将登录到文件系统,然后有一个从文件批量插入到数据库的作业。就个人而言,我喜欢在日志运行中将数据库中的日志主要用于扩展情况 - 我几乎假设我将运行多台计算机,并且能够有效地获得组合日志非常方便。 (当然,每个条目都应该说明它来自的机器。)
Report and viewing apps can be done very easily from a database - there may be fewer log-specialized reporting tools out there at the moment, but pretty much all databases have generalised reporting functionality.
报告和查看应用程序可以通过数据库轻松完成 - 目前可能会有更少的日志专用报告工具,但几乎所有数据库都具有通用报告功能。
For ease of logging, I'd use a framework like log4net which takes a lot of the effort out of it, and is a tried and tested solution. Aside from anything else, that means you can change your output strategy with no code changes. You could even log to both the event log and the database if necessary, or send some logs to one place and some to the other. (I've assumed .NET here, but there are similar logging frameworks for many platforms.)
为了便于日志记录,我使用像log4net这样的框架,它需要付出很多努力,并且是一个久经考验的解决方案。除此之外,这意味着您可以在不更改代码的情况下更改输出策略。如有必要,您甚至可以同时登录事件日志和数据库,或者将一些日志发送到一个地方,一些日志发送到另一个地方。 (我在这里假设了.NET,但是对于许多平台都有类似的日志框架。)
#3
2
One thing that needs considering about event logging is that there are products out there which can monitor your servers' event logs (like Microsoft Operations Manager) and intelligently do notification, and gather statistics on their contents.
需要考虑事件记录的一件事是,有些产品可以监控服务器的事件日志(如Microsoft Operations Manager)并智能地进行通知,并收集有关其内容的统计信息。
A "minus" of SQL-based logging is that it adds another layer of dependencies to your application, which may or may not always be acceptable. I've done both in my career. I once or twice even used a MSMQ based message queue to queue log events and empty the queue into a MSSQL database to eliminate the need for my client software to have a connection to the DB.
基于SQL的日志记录的“减号”是它为您的应用程序添加了另一层依赖项,这可能是也可能不会是可接受的。我在我的职业生涯中都做过。我曾经有一两次甚至使用基于MSMQ的消息队列来排队日志事件并将队列清空到MSSQL数据库中,以消除我的客户端软件与数据库连接的需要。
#4
1
One note about writing to the event log: that requires certain permissions for your application users that in some environments may be restricted by default.
关于写入事件日志的一个注意事项:这需要您的应用程序用户的某些权限,在某些环境中,默认情况下可能会受到限制。
Where I'm at we do most of our logging to a database, with flat files as backup. It's pretty nice, we can do things like get an RSS feed for an app to watch for a few days when we make a change.
在我所在的地方,我们将大部分日志记录到数据库,并将平面文件作为备份。这非常好,我们可以做一些事情,比如在我们做出改变时,让应用程序的RSS源观看几天。
#1
4
You need to differentiate between logging and tracing. While the lines are a bit fuzzy, I tend to think of logging as "non developer stuff". Things like unhandled exceptions, corrupt files, etc. These are definitely not normal, and should be a very infrequent problem.
您需要区分日志记录和跟踪。虽然线条有点模糊,但我倾向于将日志记录为“非开发人员”。像未处理的异常,损坏的文件等等。这些绝对不正常,应该是一个非常罕见的问题。
Tracing is what a developer is interested in. The stack traces, method parameters, that the web server returned an HTTP Status of 401.3, etc. These are really noisy, and can produce a lot of data in a short amount of time. Normally we have different levels of tracing, to cut back the noise.
跟踪是开发人员感兴趣的。堆栈跟踪,方法参数,Web服务器返回HTTP状态401.3等。这些实际上很嘈杂,并且可以在很短的时间内生成大量数据。通常我们有不同的追踪水平,以减少噪音。
For logging in a client app, I think that Event Logs are the way to go (I'd have to double check, but I think ASP.NET Health Monitoring can write to the Event Log as well). Normal users have permissions to write to the event log, as long as you have the Setup (which is installed by an admin anyway) create the event source.
对于登录客户端应用程序,我认为事件日志是要走的路(我必须仔细检查,但我认为ASP.NET Health Monitoring也可以写入事件日志)。普通用户有权写入事件日志,只要您具有安装程序(无论如何由管理员安装)创建事件源。
Most of your advantages for Sql logging, while true, aren't applicable to event logging:
Sql日志记录的大多数优点都是正确的,不适用于事件日志记录:
- Can handle large volumes of data: Do you really have large volumes of unhandled exceptions or other high level failures?
- Can handle rapid volume inserts of exceptions: A single unhandled exception should bring your app down - it's inherently rate limited. Other interesting events to non developers should be similarly aggregated.
- Very customizable: The message in an Event Log is pretty much free text. If you need more info, just point to a text or structured XML or binary file log
- A little easier to build reporting/notification off of SQL storage: Reporting is built in with the Event Log Viewer, and notification systems are, either inherent - due to an application crash - or mixed in with other really critical notifications - there's little excuse for missing an Event Log message. For corporate or other networked apps, there's a thousand and 1 different apps that already cull from Event Logs for errors...chances are your sysadmin is already using one.
可以处理大量数据:您是否真的有大量未处理的异常或其他高级别故障?
可以处理异常的快速卷插入:单个未处理的异常应该会降低您的应用程序 - 它本身就是速率有限的。非开发人员的其他有趣事件应该类似地汇总。
非常可定制:事件日志中的消息几乎是免费文本。如果您需要更多信息,只需指向文本或结构化XML或二进制文件日志即可
更容易构建SQL存储的报告/通知:报告是使用事件日志查看器构建的,并且通知系统是固有的 - 由于应用程序崩溃 - 或与其他真正关键的通知混合在一起 - 没有什么借口缺少事件日志消息。对于企业或其他网络应用程序,有一千零一个不同的应用程序已经从事件日志中剔除错误......很可能你的系统管理员已经在使用一个。
For tracing, of which the specific details of an exception or errors is a part of, I like flat files - they're easy to maintain, easy to grep, and can be imported into Sql for analysis if I like.
对于跟踪,其中一个异常或错误的具体细节是其中的一部分,我喜欢平面文件 - 它们易于维护,易于grep,并且可以导入到Sql中进行分析,如果我喜欢的话。
90% of the time, you don't need them and they're set to WARN or ERROR. But, when you do set them to INFO or DEBUG, you'll generate a ton of data. An RDBMS has a lot of overhead - for performance (ACID, concurrency, etc.), storage (transaction logs, SCSI RAID-5 drives, etc.), and administration (backups, server maintenance, etc.) - all of which are unnecessary for trace logs.
90%的情况下,您不需要它们并且它们被设置为WARN或ERROR。但是,当您将它们设置为INFO或DEBUG时,您将生成大量数据。 RDBMS有很多开销 - 性能(ACID,并发等),存储(事务日志,SCSI RAID-5驱动器等)和管理(备份,服务器维护等) - 所有这些都是跟踪日志不必要。
#2
3
I wouldn't log straight to the database. As you say, database issues become tricky to log :)
我不会直接登录数据库。如你所说,数据库问题变得棘手的日志:)
I would log to the filesystem, and then have a job which bulk-inserts from files to the database. Personally I like having the logs in the database in the log run primarily for the scaling situation - I pretty much assume I'll have more than one machine running, and it's handy to be able to effectively have a combined log. (Each entry should state the machine it comes from, of course.)
我将登录到文件系统,然后有一个从文件批量插入到数据库的作业。就个人而言,我喜欢在日志运行中将数据库中的日志主要用于扩展情况 - 我几乎假设我将运行多台计算机,并且能够有效地获得组合日志非常方便。 (当然,每个条目都应该说明它来自的机器。)
Report and viewing apps can be done very easily from a database - there may be fewer log-specialized reporting tools out there at the moment, but pretty much all databases have generalised reporting functionality.
报告和查看应用程序可以通过数据库轻松完成 - 目前可能会有更少的日志专用报告工具,但几乎所有数据库都具有通用报告功能。
For ease of logging, I'd use a framework like log4net which takes a lot of the effort out of it, and is a tried and tested solution. Aside from anything else, that means you can change your output strategy with no code changes. You could even log to both the event log and the database if necessary, or send some logs to one place and some to the other. (I've assumed .NET here, but there are similar logging frameworks for many platforms.)
为了便于日志记录,我使用像log4net这样的框架,它需要付出很多努力,并且是一个久经考验的解决方案。除此之外,这意味着您可以在不更改代码的情况下更改输出策略。如有必要,您甚至可以同时登录事件日志和数据库,或者将一些日志发送到一个地方,一些日志发送到另一个地方。 (我在这里假设了.NET,但是对于许多平台都有类似的日志框架。)
#3
2
One thing that needs considering about event logging is that there are products out there which can monitor your servers' event logs (like Microsoft Operations Manager) and intelligently do notification, and gather statistics on their contents.
需要考虑事件记录的一件事是,有些产品可以监控服务器的事件日志(如Microsoft Operations Manager)并智能地进行通知,并收集有关其内容的统计信息。
A "minus" of SQL-based logging is that it adds another layer of dependencies to your application, which may or may not always be acceptable. I've done both in my career. I once or twice even used a MSMQ based message queue to queue log events and empty the queue into a MSSQL database to eliminate the need for my client software to have a connection to the DB.
基于SQL的日志记录的“减号”是它为您的应用程序添加了另一层依赖项,这可能是也可能不会是可接受的。我在我的职业生涯中都做过。我曾经有一两次甚至使用基于MSMQ的消息队列来排队日志事件并将队列清空到MSSQL数据库中,以消除我的客户端软件与数据库连接的需要。
#4
1
One note about writing to the event log: that requires certain permissions for your application users that in some environments may be restricted by default.
关于写入事件日志的一个注意事项:这需要您的应用程序用户的某些权限,在某些环境中,默认情况下可能会受到限制。
Where I'm at we do most of our logging to a database, with flat files as backup. It's pretty nice, we can do things like get an RSS feed for an app to watch for a few days when we make a change.
在我所在的地方,我们将大部分日志记录到数据库,并将平面文件作为备份。这非常好,我们可以做一些事情,比如在我们做出改变时,让应用程序的RSS源观看几天。