Eventlog and Syslog

If you’re a Windows system administrator or a power user on Windows, you’ve visited the Window eventlog system at some point.  Every Windows operating system be it a desktop, workstation, server, domain or controller has an eventlog service running that stores system events as structured records. The eventlog service is accessible to all components of the operating system. Kernel mode drivers can write events to the eventlog. User mode daemons can write events to the eventlog. Authenticated clients can read and write records to the eventlog. Because the eventlog functions as an RPC server,  that means authenticated remote clients can access the eventlog.  In the days of Windows 2000. I remember Jim Allchin sending out directives to all developers in Windows to ensure that the quality of events that were written into the eventlog were system administrator relevant and more importantly actionable.  Developers with poor engineering hygiene were soundly chastised for misusing the eventlog.  The structured record storage model implied that you could do eventlog analysis in a deterministic fashion. Note however that the eventlog was not build on top of a database. The eventlog is still a flat file. Thus to do analysis, a client program has to sequentially scan the eventlog and filter events that match its requirements.

Even with this limitation, the deterministic and structured storage of the eventlog  in Windows allows for robust analysis, troubleshooting and problem diagnostics.

I’ve spent the last two years working on Linux and UNIX operating systems and I do miss structured system events which are deterministic. The logs are by nature text based and while I haven’t done much analysis myself, I wonder  whether text logs make it easy auto diagnostic systems to detect system anomalies. I also find it troubling when logs in general have developer debugging information. It adds to the noise.  Granted logs can be an invaluable aid to debugging, but I would be expect administrator logs to be different from developer logs. In any case, there are a host of companies that have built businesses around simplifying and reducing the noise-to-signal ratio UNIX log files.