LogLogic/Chuvakin Log Checklist

Anton A. Chuvakin, www.chuvakin.org, June 9th, 2008

Editor’s note: I asked Anton A. Chuvakin, of LogLogic, to review my Log4J Best Practices page. He responded with his own list of general logging best practices. His own list blew mine away, and so, with his permission, I’m posting it here!
Here’s a link to the checklist straight from the horse’s mouth.

Best Logs:

  1. Tell you exactly what happened: when, where, and how.
  2. Suitable for manual, semi-automated, an automatated analysis.
  3. Can be analyzed without having the application that produced them at
    hand.
  4. Don’t slow the system down.
  5. Can be proven reliable (if used as evidence).

Events To Log

  1. Authentication/Authorization Decisions (including logoff)
  2. System Access, Data Access
  3. System/Application Changes (especially privilege changes)
  4. Data Changes:
    -Add Data
    -Edit Data
    -Delete Data
  5. Invalid Input (possible badness/threats)
  6. Resources (RAM, Disk, CPU, Bandwidth, any other hard or soft limits)
  7. Health/Availibility
    -Startups/Shutdowns
    -Faults/Errors
    -Delays
    -Backups success/failure

What To Log - Every Event Should Have:

  1. Timestamp + TZ (when)
  2. System, Application, or Component (where)
  3. IP’s and contemporaneous DNS lookups of involved parties
    -Names/Roles of involved systems (what servers are we talking to?)
    -Name/Role of local application (what is this server?)
  4. User (who)
  5. Action (what)
  6. Status (result)
  7. Priority (severity, importance, rank, level, etc)
  8. Reason

Here’s a fictional log example that tries to adhere to Anton’s checklist.