Note: This content will be merged into the logging section of the next version of the manual. It describes the structure of log messages in Pathfinder.
Pathfinder log messages follow one of three different formats depending on the the log writer options selected and the type of message. If you choose UDP syslog as the log writer type, then the syslog structure is used. All other writer types use the standard log message structure. If the message type is one of the audit get or audit set message types the log message data is wrapped in an Audit log message structure.
By default log messages are composed of a timestamp, a message type id number, and a sap message:
<TimeStamp> <MessageTypeId> <sap message>
For example:
Timestamp: Date and Time structured as: MM-dd-yyyy_HH:mm:ss.fff
MessageTypeId: Each message item in the log writer editor checkboxes has an associated id number. So for example memory slot value changes have an id of 6001. This allows for easy filtering of specific message types.
Message: Each message is a SapMessage comprised of an operator, object path, list of properties, and in some cases a list of system items. For more details on the structure of SapMessages see Appendix A of the Pathfinder manual.
Note: two spaces are used between the timestamp and the message type id and again between the message type id and the sap message data itself.
Audit log messages follow the same format as standard log messages except that the SapMessage wraps the original message with additional data:
An audit log message will include an object path of AuditGet or AuditSet with a URL where the original audit message originated. Typically the url will begin with either tcp:// or ws:// for a tcp or websocket connection followed by the IP and Port. The Direction property indicates the direction of the message as incoming or outgoing. The message property itself will contain the user name used followed by a semi-colon and the original SapMessage. Outgoing messages may specify <NoUser> as the user since the outgoing message (especially if it is a change message) is not necessarily associated with a specific user. Carriage returns and line feeds in the original message are expressed as <CR,LF>.
When syslog is chosen for the log writer in Pathfinder, RFC 3164 format is used except that Pathfinder's time stamp portion of the message also includes the milliseconds.
<<severity>><timestamp> <localip> PFC: <MessageTypeId> <MessageObjectPath> <PropertyList>
A syslog message is made up of a severity calculation followed by a date time stamp in the format: MMM dd HH:mm:ss.fff (normally RFS 3164 does not include the millisecond portion). Next comes a single space and the message portion which includes a tag (usually process name) and then the message data. We use PFC: for the tag for pathfinder core. The message itself is the object path and property list from the SapMessage as described in the standard and audit logging above. The operator and systems items from the SapMessage are not included when syslog options are selected.