What is a log and what is a trace?

Question

The words "log" and "trace" are used regularly for describing information, written to an external file during execution of a program, but is there a fix and firm definition?

Some examples in my career:

• When working for a telecom company, I learnt that a "trace" is a piece of information, written to an external file during the execution of a program. A "log", however, is a summary of a complete handling of some data (e.g. a telephone call enters the computer program, the program does some handling (connecting calling parties, playing announcements, invoicing, ...) and at the end, a log is created, which can also be written to an external file.
• When working for another software company, working with the NLog library, it seems that logs are pieces of information, written to an external file during the execution of a program. As a complete handling is impossible to follow, it's not possible to make a summary of the entire handling of some data. The word trace does exist in the NLog library, as a log level.
• While working in the telecom related field, I have dealt regularly with snippers. There information, caught at the gateways of a computer, seem to be called "traces".

So my question: is there a formal definition for the word "log" or "trace", or more general, is there any official worldwide website, explaining some software engineering related words?

Answer 1

There's a summary in this article that I broadly agree with. It's a subjective classification.

Logs are human-readable flat text files that are used by developers to capture useful data. Logs messages occur at a single point in time (though not necessarily at every point in time)

Traces are also known as distributed traces. They traverse network, process, and security boundaries, to give you a holistic view of your system.

That is, "log" refers to the more adhoc style of recording what the software is doing for the user to debug, and "trace" refers to a more systematic, structured data capture organized around requests.

Answer 2

I think OpenTelemetry would be the most "authoritative" source. As it defines common concepts and standars for application observability.

It defines :

Logs

A log is a timestamped message emitted by services or other components. Unlike traces, they aren’t necessarily associated with any particular user request or transaction. You can find logs almost everywhere in software. Logs have been heavily relied on in the past by both developers and operators to help them understand system behavior.

Distributed traces

A distributed trace, more commonly known as a trace, records the paths taken by requests (made by an application or end-user) as they propagate through multi-service architectures, like microservice and serverless applications.

What you describe is more specific to telecom industry or possibly specific system you had worked on. But OTEL is relatively new as a standartisation, so older systems are likely to use different definitions.

Answer 3

I think Euphoric's answer sets a good baseline, however:

Logs

I think the definition of a log is missing a defining characteristic, specifically that the log as a whole (rather than the individual message) identifies the thread of execution.

Meaning that if you have an application/service deployed to a set of servers each of which have multiple processes, each of which have multiple threads. It is typically possible to filter the log to a specific server, specific process on that server and a specific thread within that process.

Once this filtering is applied, you are able to see what the thread is doing as a list of sequential steps.

Note: Depending upon the use case, the thread may be identified based on the request/transaction it is servicing rather than an explicit Thread-Id. Additionally logging onto the correct server and examining the correct file may be sufficient to filter down to the server and process you are looking for.

Trace

Euphoric gives a good definition of a "Distributed Trace".

However the term "Trace" can be used in many contexts, so per the OP's original question, I don't think a firm definition exists for a generic "Trace" without any qualifying context, some contexts might be:

• A distributed trace.
• A stack trace.
• The act of tracing a bug.

The only commonality, I see in the various usages of the word "trace" is it usually refers to a context where someone has access to the source code and/or extremely detailed knowledge of the flow of execution of the software.

Answer 4

I imagine there's a distinction in telecoms between "logging" a call (as would be done for routine billing activity), and "tracing" a call (as would occur internally only for systemic reasons, or as a special effort for criminal investigation etc.).

In broader usage, a "log" also has the connotation of a recording activity performed specifically by human action, whereas a "trace" tends to imply the remnants of a physical activity which are caused or left behind incidentally.

In a typical computing context, I don't think there would be a basis to precisely distinguish the meanings of the words, except that if both are used in one context then "trace" should imply the generally more detailed data which is less meaningful or collected for less specific purposes than are "logs".