Your Logs Are a Product and Nobody Owns Them

I would like to say the incident's duration was the problem, because that would be a shorter post, but it started at the incident.

This is the thesis: the logs are a product, and the product has users, and the users are the engineers at three in the morning, and the product has no owner, and the no owner is the reason the product does not work when it is needed.

This is an opinion, and the constraint that makes logging feel unownable is real, and the rule of thumb at the end is where I land.

Why the logs have no owner

The logging is the everyone's, and the everyone's is the nobody's, and the nobody's is the absence, and the absence is the reason, because the logging is written by whoever writes the code, and the code is the feature's, and the feature is the engineer's, and the engineer's is the line, and the line is the log, and the log is the local decision, and the local is the inconsistent, and the inconsistent is the product's incoherence.

The logging feels like the plumbing, and the plumbing is the invisible, and the invisible is the unowned, and the unowned is the unmaintained, and the unmaintained is the decay, and the decay is the three formats, and the three formats are the search's failure, and the failure is the incident's cost, and the cost is the ownership's argument, and the argument is the reason to treat the logs as the product.

The logging is also the unmeasured, and the unmeasured is the unimproved, and the unimproved is the stale, and the stale is the useless, and the useless is the volume, and the volume is the cost, and the cost is the bill, and the bill is the only metric, and the metric is the wrong one, because the logs' value is the incident's duration, and the duration is not on the invoice.

Why the product framing changes it

The product has the users, and the users are the on-call, and the on-call is the three in the morning, and the morning is the stress, and the stress is the search, and the search is the product's usability, and the usability is the design, and the design is the owner's job, and the job is the missing, and the missing is the incident.

The product has the requirements, and the requirements are the findable and the readable and the correlatable, and the three are the schema, and the schema is the standard, and the standard is the owner's, and the owner's is the enforcement, and the enforcement is the review, and the review is the discipline, and the discipline is the fix.

The product has the feedback, and the feedback is the incident's review, and the review is the question, and the question is the did the logs answer it, and the answer is the measurement, and the measurement is the improvement, and the improvement is the owner's, and the owner's is the accountability, and the accountability is the product's health.

This is the same distinction as the trace granularity that made one agent step debuggable, same mechanism, different costume.

The constraint that makes it hard

The honest constraint is the distribution, because the logging is written in a hundred places by a hundred authors, and the hundred is the standard's difficulty, and the difficulty is the enforcement's cost, and the cost is the real, and the real is the argument against the central owner, and the against is the legitimate.

The legitimate is the narrower than it looks, because the owner is not the writer, and the not writer is the standard's author, and the author is the schema and the library and the review, and the three are the leverage, and the leverage is the hundred authors' enablement, and the enablement is the cheap, and the cheap is the argument, because the owner writes the library once and the hundred use it.

Where no owner exists, the honest answer is that the logs are the accidental, and the accidental is the inconsistent, and the inconsistent is the incident's cost, and the cost should be stated rather than absorbed silently by whoever is on call.

The working rule

The logs are a product whose users are the engineers under pressure, and the product needs an owner for the schema, the library and the review, and the three are the leverage that makes a hundred authors coherent.

Define the schema. The fields are the standard, and the standard is the timestamp and the level and the request identifier and the service, and the four are the searchable, and the searchable is the fix, and the fix is the document, and the document is the owner's.

Ship the logging library. The library is the schema's enforcement, and the enforcement is the automatic, and the automatic is the consistent, and the consistent is the fix, and the fix is the code, and the code is the owner's, and the owner's is the one implementation the hundred import.

Require the correlation identifier. The identifier is the trace, and the trace is the request's path, and the path is the diagnosis, and the diagnosis is the fix, and the fix is the propagation, and the propagation is the library's, and the library's is the owner's.

Review the logs in the incident. The review asks what the logs did not answer, and the ask is the gap, and the gap is the backlog, and the backlog is the improvement, and the improvement is the owner's, and the owner's is the accountability, and the accountability is the product's health.

Measure the time to answer, not the volume. The time is the value, and the value is the metric, and the metric is the owner's, and the owner's is the improvement's target, and the target is the fix, because the volume is the cost and the time is the benefit, and the benefit is the reason the logs exist.

Where I land

Nobody needs to own every log line, and somebody needs to own the schema, the library and the review, because the three are what make a hundred authors produce one readable product. The logs are the incident's primary interface, and an unowned interface is the reason the data exists and the answer does not.

The terabytes were there and the answer was not, because three services logged the same event in three formats and nobody had decided which fields mattered. Get that property wrong and every layer above it lies to you politely.

Related reading: The Alert That Fires Every Day Is Not an Alert explores a connected angle.

Related reading: The Blameless Postmortem With a Name in It explores a connected angle.

Related reading: The Estimate Was Wrong and Nobody Updated It explores a connected angle.

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud