Log in one place versus multiple logs

Question

For a web app or a standalone server app, which would you recommend, and why?

• have the giant application.log, where everything is logged;
• have many smaller logs:
  • security.log
  • performance.log
  • lifecycle.log
  • integration.log

Answer 1

I like using databases for logging. Four useful features:

1. You don't lose the time-ordering, as you'd experience when looking at multiple log files at once.
2. You can still filter by specific message types, if you want to.
3. You get integrity, so if your computer crashed just as you were writing a log file, you won't get a corrupted log, and it'll be replayed off the journal when your database starts up again.
4. Pruning the log is really easy! No need to use hacky log rotation programs that require your daemons to be SIGHUPed or anything.

Your mileage may vary. :-)