Logging Structure

Note: This content will be merged into the logging section of the next version of the manual. It describes the structure of log messages in Pathfinder.

Pathfinder log messages follow one of three different formats depending on the the log writer options selected and the type of message. If you choose UDP syslog as the log writer type, then the syslog structure is used. All other writer types use the standard log message structure. If the message type is one of the audit get or audit set message types the log message data is wrapped in an Audit log message structure.

Standard log message structure

By default log messages are composed of a timestamp, a message type id number, and a sap message:

<TimeStamp> <MessageTypeId> <sap message>

For example:

12-26-2023_11:45:00.001  6001  indi MemorySlots#0.MemorySlot#Time3 SlotValue=False

• Timestamp: Date and Time structured as: MM-dd-yyyy_HH:mm:ss.fff

• MessageTypeId: Each message item in the log writer editor checkboxes has an associated id number. So for example memory slot value changes have an id of 6001. This allows for easy filtering of specific message types.

• Message: Each message is a SapMessage comprised of an operator, object path, list of properties, and in some cases a list of system items. For more details on the structure of SapMessages see Appendix A of the Pathfinder manual.

Note: two spaces are used between the timestamp and the message type id and again between the message type id and the sap message data itself.

Audit log message structure

Audit log messages follow the same format as standard log messages except that the SapMessage wraps the original message with additional data:

01-03-2024_13:59:47.554  9012  indi AuditGet#[tcp://192.168.1.230:41202/] Direction=Incoming, Message="ClusterAdmin:get Devices#0 Ping<CR,LF>"
01-03-2024_13:59:49.230  9012  indi AuditGet#[tcp://192.168.1.230:9600/] Direction=Incoming, Message="<NoUser>:indi Devices#0 Ping=Pong<CR,LF>"

An audit log message will include an object path of AuditGet or AuditSet with a URL where the original audit message originated. Typically the url will begin with either tcp:// or ws:// for a tcp or websocket connection followed by the IP and Port. The Direction property indicates the direction of the message as incoming or outgoing. The message property itself will contain the user name used followed by a semi-colon and the original SapMessage. Outgoing messages may specify <NoUser> as the user since the outgoing message (especially if it is a change message) is not necessarily associated with a specific user. Carriage returns and line feeds in the original message are expressed as <CR,LF>.

Syslog message structure

When syslog is chosen for the log writer in Pathfinder, RFC 3164 format is used except that Pathfinder's time stamp portion of the message also includes the milliseconds.

<<severity>><timestamp> <localip> PFC: <MessageTypeId> <MessageObjectPath> <PropertyList>

<14>Jan 03 16:15:02.619 192.168.1.96 PFC: 6001 MemorySlots#0.MemorySlot#ttt SlotValue=B
<14>Jan 03 16:22:11.150 192.168.1.96 PFC: 9012 AuditGet#[ws://[::1]:56483/] Direction=Incoming Message="Admin:GET Devices#0 Ping<CR,LF>"

A syslog message is made up of a severity calculation followed by a date time stamp in the format: MMM dd HH:mm:ss.fff (normally RFS 3164 does not include the millisecond portion). Next comes a single space and the message portion which includes a tag (usually process name) and then the message data. We use PFC: for the tag for pathfinder core. The message itself is the object path and property list from the SapMessage as described in the standard and audit logging above. The operator and systems items from the SapMessage are not included when syslog options are selected.