4 ms·

While I see the point the author is trying to make, I'm not really sure I agree. Most users don't even read error messages, never mind logs. At best, logs are s

While I see the point the author is trying to make, I'm not really sure I agree. Most users don't even read error messages, never mind logs. At best, logs are something they need for compliance, for most, the concept doesn't exist at all. I do agree that the logs should help you understand what went wrong and why, but in that regard the principle is the same for both sysadmins and developers and I don't really see the difference?

hk__2 8mo ago
> Most users don't even read error messages, never mind logs. Yes, see all the questions on StackOverflow with people posting their error message without reading it, like “I got an error that says ‘fail! please install package xyz!’, what should I do?!?”.
- dexwiz 8mo ago
  That question is more likely how do I install, not what to install.
  - dylan604 8mo ago
    I think that's being very generous. If you've ever been in tech support, you'll be amazed at how often you'll be asked what to do when it tells me to do X. If they don't know how to do X, then they should be able to look up how to do X. If it's something like install 3rd party library, then that's not the first party's responsibility. Especially OSS for different arch/distros. They are all different. Look up the 3rd party's repo and figure it out. But no, it's contact support straight away.
    - dexwiz 8mo ago
      I've worked in tech support. I get that 25-50% of the cases appear to be "read the docs to me." But the majority of those is because docs are poorly written, are overwhelming for new users, or they don't understand them and won't admit that directly.
  - john_strinlai 8mo ago
    on friday i got 2 calls saying "my phone is no longer showing me my emails, please fix" when the error message they received was roughly "please reenter your password to continue using outlook". on wednesday i got a call saying "the CRM wont let me input this note, please fix" when the error message was "you have included an invalid character, '□' found in description. remove invalid characters and resubmit".
butterbomb 8mo ago
Oddly enough though, my journey into computers was greatly assisted by my curiosity at random log files that were being dumped to my desktop constantly.
tempest_ 8mo ago
Sysadmins needs logs that tell them what action they can do fix it. Developers need logs that tell them what a system is doing. Generally a sysadmin needs to know "is there an action I can do to correct this" where as a dev has the power to alter source code and thus needs to know what and where the system is doing things.
EvanAnderson 8mo ago
In my sysadmin work I curse every developer who makes me fire up strace, tcpdump, procmon, Wireshark, etc, because they couldn't be bothered to actually say what file couldn't be found, what TCP connection failed to be established. etc.
- lucianbr 8mo ago
  I get the impression that often it isn't laziness but the concept that error details leak information to an attacker and are therefore a vulnerability. I disagree with this view, but it definitely exists.
  - superjan 8mo ago
    Yeah, along those lines we have requirements on never logging PII, and not logging anything that potentially contains PII, such as folder names.
    - justinclift 8mo ago
      Maybe tokenise the PII part of the folder name when outputting it? ie `$HOME`/.config/foo/stuff.cfg` rather than `/home/joebloggs/foo/stuff.cfg`?
      - Terr_ 8mo ago
        Or have an encrypted data portion, so that the sensitive details can be revealed as-needed, and redaction occurs by rotating a key. Obviously that depends on the messages being infrequent in production logging levels.
  - EvanAnderson 8mo ago
    In a message returned by a server to a client I suppose it's defensible. For writing to syslog, event log, a log file, etc, it's not.
PunchyHamster 8mo ago
> Most users don't even read error messages, never mind logs. They don't need to. The log message is so helpdesk have something actionable, or so it can be copy pasted into google to find people with similar problem maybe having solution.
ragall 8mo ago
> but in that regard the principle is the same for both sysadmins and developers and I don't really see the difference? No, it's very different: developers generally want to know about things they control, so they want detailed debugging info about a program's internal state that could have caused a malfunction. Sysadmins don't care about that (they're fine with coalescing all the errors that developers care about under a general "internal error"), and they care about what in the program environment could have triggered the bug, so that they may entirely avoid it or at least deploy workarounds to sidestep the bug.

hk__2 8mo ago

> Most users don't even read error messages, never mind logs. Yes, see all the questions on StackOverflow with people posting their error message without reading it, like “I got an error that says ‘fail! please install package xyz!’, what should I do?!?”.

dexwiz 8mo ago
That question is more likely how do I install, not what to install.
- dylan604 8mo ago
  I think that's being very generous. If you've ever been in tech support, you'll be amazed at how often you'll be asked what to do when it tells me to do X. If they don't know how to do X, then they should be able to look up how to do X. If it's something like install 3rd party library, then that's not the first party's responsibility. Especially OSS for different arch/distros. They are all different. Look up the 3rd party's repo and figure it out. But no, it's contact support straight away.
  - dexwiz 8mo ago
    I've worked in tech support. I get that 25-50% of the cases appear to be "read the docs to me." But the majority of those is because docs are poorly written, are overwhelming for new users, or they don't understand them and won't admit that directly.
- john_strinlai 8mo ago
  on friday i got 2 calls saying "my phone is no longer showing me my emails, please fix" when the error message they received was roughly "please reenter your password to continue using outlook". on wednesday i got a call saying "the CRM wont let me input this note, please fix" when the error message was "you have included an invalid character, '□' found in description. remove invalid characters and resubmit".

butterbomb 8mo ago

Oddly enough though, my journey into computers was greatly assisted by my curiosity at random log files that were being dumped to my desktop constantly.

tempest_ 8mo ago

Sysadmins needs logs that tell them what action they can do fix it. Developers need logs that tell them what a system is doing. Generally a sysadmin needs to know "is there an action I can do to correct this" where as a dev has the power to alter source code and thus needs to know what and where the system is doing things.

EvanAnderson 8mo ago

In my sysadmin work I curse every developer who makes me fire up strace, tcpdump, procmon, Wireshark, etc, because they couldn't be bothered to actually say what file couldn't be found, what TCP connection failed to be established. etc.

lucianbr 8mo ago
I get the impression that often it isn't laziness but the concept that error details leak information to an attacker and are therefore a vulnerability. I disagree with this view, but it definitely exists.
- superjan 8mo ago
  Yeah, along those lines we have requirements on never logging PII, and not logging anything that potentially contains PII, such as folder names.
  - justinclift 8mo ago
    Maybe tokenise the PII part of the folder name when outputting it? ie `$HOME`/.config/foo/stuff.cfg` rather than `/home/joebloggs/foo/stuff.cfg`?
    - Terr_ 8mo ago
      Or have an encrypted data portion, so that the sensitive details can be revealed as-needed, and redaction occurs by rotating a key. Obviously that depends on the messages being infrequent in production logging levels.
- EvanAnderson 8mo ago
  In a message returned by a server to a client I suppose it's defensible. For writing to syslog, event log, a log file, etc, it's not.

PunchyHamster 8mo ago

> Most users don't even read error messages, never mind logs. They don't need to. The log message is so helpdesk have something actionable, or so it can be copy pasted into google to find people with similar problem maybe having solution.

ragall 8mo ago

> but in that regard the principle is the same for both sysadmins and developers and I don't really see the difference? No, it's very different: developers generally want to know about things they control, so they want detailed debugging info about a program's internal state that could have caused a malfunction. Sysadmins don't care about that (they're fine with coalescing all the errors that developers care about under a general "internal error"), and they care about what in the program environment could have triggered the bug, so that they may entirely avoid it or at least deploy workarounds to sidestep the bug.