Common Industry Term For Negative Logging?

Question

It is one thing to log something that happened in code, a process, or procedure. It is another thing to log something that didn't happen. For example, if your ETL system is supposed to receive a file every hour for import, and a file did not arrive at the usual appointed time, then it would be good to log "what didn't happen."

I've called this negative logging, but I'm curious if there is an industry common term for this - a term which means "log both what happened and what didn't happen." Any idea?

Answer 1

You literally cannot log something that didn't happen. It is a physical impossibility.

What you are logging is just another type of failure - i.e. that a particular trigger was fired and the corresponding operation failed to execute. That is simply an error like any other.

Technically you're actually logging a pair of events: (a) the trigger and (b) the result of the operation. If the result log entry does not exist, then you infer a failure. This may seem pedantic, but it's actually an important distinction. You don't actually know for certain that the operation didn't execute; you just can't confirm that it did execute, and you're making an assumption.

There are two patterns for this, although I don't think they're officially-named "design patterns". They are the watchdog pattern, which repeatedly polls an endpoint to make sure that it is online and/or reporting some status, and also the heartbeat pattern, in which the endpoint itself is responsible for pushing status updates, and if the heartbeat monitor does not receive one, it logs an error.

Every instance of "negative logging" I've seen involves one of those patterns.

Answer 2

I've never heard of "negative logging", but the thing that would be writing to the log sounds like a watchdog process/thread. When talking about it I'd probably refer to the "watchdog log" and not really think about the whole positive/negative aspect of it.