Logging

Within the fixed UTC interval from 10:00 inclusive to 11:00 exclusive, request one has a failed attempt then a successful completion; request two has a failed attempt and failed completion; request three completes successfully. Three error events correspond to only one failed completed request out of three.

Give a log query a question and a denominator

A useful logging design starts with a question precise enough to become a query. “Show errors” is different from “How many checkout requests finally failed between ten and eleven UTC?” The first locates diagnostic events. The second needs a population of completed requests, a definition of failure, and a time rule. Collecting more text does not supply these missing semantics automatically. ...

After a log pathname is renamed, the existing writer still points to the old archive inode; the replacement active file remains empty. Closing and reopening the active path is the required handoff.

Log rotation needs writer handoff and a retention budget

Log rotation divides a continuing stream into files that can be retained, searched, compressed, and eventually removed. A useful policy defines both when to rotate and which history to keep. It must also account for how the application holds its output file open. Renaming a pathname and successfully redirecting future log records are separate steps in that operational contract. ...