How the Logging Facility Works

Setting Up the Logging Process

To use the SAS logging facility, you must set up your logging environment:

Define a logging configuration, which configures appenders and loggers. You can define the configuration by setting up an XML file or by using SAS language elements. If you perform a planned deployment, then logging configuration files are provided for your SAS servers.
Specify the LOGCONFIGLOC= system option to enable logging, if you are using configuration files. If you perform a planned deployment, then this system option is included in the SAS configuration files for your SAS servers.
Issue log events in a format that can be processed by the logging facility, if you are developing your own SAS programs.

Note: You can experiment with the logging facility without creating logging configuration files. SAS provides three basic logging configurations that write messages to either a file, the current console, or to the traditional SAS log using the root logger. For more information, see LOGCONFIGLOC= System Option.

The Logging Process

After your logging environment is in place, the SAS logging facility begins processing as follows:

A SAS process (for example, a SAS server process) issues a log event. Each event includes the following attributes: a name that indicates the message category, a diagnostic level, and a message that describes the context for the event.
The logging facility receives the log event and determines which logger to assign it to, based on the event's name attribute.
The log event's level is compared to the threshold that is specified for the logger in the logging configuration. If the event's level is at or above the specified threshold, then processing continues. If the level is below the threshold, then the event is ignored.

If no threshold is specified for the event's logger, then the event inherits the threshold setting of the nearest ancestor logger. For example, if an Audit.Meta.Security event is being processed, then inheritance occurs as follows:
1. The event's level is compared to the threshold for the Audit.Meta.Security logger.
2. If no threshold is specified for Audit.Meta.Security, then the threshold for Audit.Meta is applied.
3. If no threshold is specified for Audit.Meta, then the threshold for Audit is applied.
4. If no threshold is specified for Audit, then the threshold for Root is applied.
If no thresholds are assigned to the logger or its ancestors, then the event is ignored.
The log event is processed by the appenders that are assigned to the logger and any of its ancestors in the logging configuration. For example, an Audit.Meta.Security event is processed by the appenders that are assigned to the following loggers: Audit.Meta.Security, Audit.Meta, Audit, and Root.

Each of these appenders processes the event according to the appender's configuration as specified in the logging configuration. Appender processing is performed as follows:
1. If the appender configuration includes a threshold, then the event's level is compared to the threshold. If the event's level is at or above the threshold, then processing continues. If the level is below the threshold, then processing stops.
2. If the appender configuration includes a filter, then the event is compared to the filtering criteria. Processing either continues or stops depending on the results of the comparison.
3. The event is written to the output destination using the specifications that are defined in the appender configuration. Appender specifications include parameters such as pattern layouts, log directories, log filenames, rolling policies, locales, and encoding.