What is the appropriate way for applications (for example Node) to log under Linux? With Windows there is the event log which applications can write to.

Should we just create log files under var/log for each application?

  • 1
    Are you writing an application and want to make sure it is behaving properly, or are you trying to determine where a given application may have placed logs you want to view? – music2myear May 6 '19 at 17:07
  • @music2myear i'm asking as a developer who plans to create applications under Unix operating systems in future and looking for best practices. – F.H. May 6 '19 at 19:07
  1. The traditional API on Unix-like systems is syslog(3).

    openlog("myapp", 0, LOG_DAEMON);
    syslog(LOG_INFO, "Thing '%s' happened", thing->name);

    Using the syslog() API will send messages to the currently installed system logger, which then allows the sysadmin to filter messages, apply rotation policies, forward to a remote server, and so on.

    The corresponding Node module appears to be node-syslog, but you can implement it manually by sending messages to the /dev/log Unix socket.

  2. Many Linux distributions also have systemd-journal with its own API, which allows metadata to be attached (for example, all messages about a single request can be marked with a metadata field "MYAPP_REQUEST_ID=[...]" and then easily looked up later).

    sd_journal_send("MESSAGE=Thing '%s' happened", thing->name,
                    "PRIORITY=%i", LOG_INFO,

    There is a Node module called systemd-journald that provides access to this API.

  3. A simple option is to write all log messages to stderr. Ideally it should use a simple format with just one message per line – no colours, no timestamps, no fancy prefixes/markers; the service manager will add its own. In this mode the only thing you should add is the syslog-style priority number (e.g. 3 corresponding to LOG_ERR):

    <3>Something bad happened.
  4. For general-purpose messages, creating your own file and especially inventing your own log format is not recommended; it'll make life harder for the sysadmin. On the other hand, it is a good idea to do so when you're about to log massive amounts of messages which would otherwise overwhelm the syslog. (For example, webservers like Apache will log every request to the /var/log/apache/access.log file by default.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.