Practical Guide to Structured, Effective Logging in Production Apps

·1 views

A software developer with years of production debugging experience has shared a practical framework for writing better application logs. The guide emphasizes structured logging using JSON-formatted entries, which makes logs easier to query with tools like ELK Stack or AWS CloudWatch. It outlines the correct use of log levels — debug, info, warn, error, and fatal — stressing that overusing the info level creates noise that obscures real issues. The author also highlights best practices such as including request IDs, user IDs, and full error stack traces, while avoiding logging sensitive data like passwords or tokens. Performance is flagged as a concern, with a recommendation to aggregate logs rather than logging inside tight loops to prevent storage flooding and slowdowns.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

SnapMind App Shifts to Agent-Based Architecture in Major Rebuild

SnapMind, a desktop app that binds AI prompts to hotkeys, is undergoing a significant rebuild by its developer. The creator has decided to move away from a prompt-based model toward an agent-based architecture, citing rapid advancements in AI as the motivation. A key upcoming feature will allow users to create custom AI agents and assign them to hotkeys. The developer also plans to replace the current LLM provider service with a more robust solution, as frequent API endpoint changes have made the existing setup difficult to maintain. The latest release, v0.5.5, is available on the project's website and GitHub repository.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DeepSeek Harness Builds Entire Agent Framework as Cordis Plugins, Guide Explains

DeepSeek Harness, currently in Developer Preview, treats every core component — including the model adapter, tool registry, session log, and agent loop — as a Cordis plugin rather than privileged core code. A technical guide published on DEV Community, pinned to commit 141eb6f on the master branch, explains how developers should choose between services, events, effects, profiles, and bundles when extending the framework. Services are recommended for callable capabilities with replaceable providers, while events handle passive observation and effects manage resources that must be cleaned up on unload. GitHub released the dsh-v0.1.0-rc.8 pre-release on August 19, though npm still showed version rc.7 as of August 20, meaning package availability may lag behind source releases. The guide is intended for agent-framework developers and emphasizes that plugin readiness is governed by dependency declarations, not YAML list order, with Cordis managing the full lifecycle from PENDING through ACTIVE to DISPOSED.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LSHIY Campaign Exploited OAuth ROPC and IPv6 to Spray Passwords at Scale

A large-scale password-spraying campaign dubbed LSHIY targeted Microsoft Entra ID tenants by abusing OAuth's Resource Owner Password Credentials (ROPC) flow, which bypasses multi-factor authentication prompts entirely. Attackers harvested credentials from public sources and data leaks, then slowly tested one password against many accounts to avoid triggering lockouts. Over a two-week period, more than 81 million login attempts were recorded, resulting in at least 78 compromised accounts. To evade IP-based detection, the threat actors leveraged BYOIP infrastructure and vast IPv6 address ranges linked to entities such as LSHIY LLC, FranTech, and Tor exit nodes. No post-compromise activity was confirmed, suggesting the operation may have been focused on credential validation or resale rather than immediate exploitation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Complex Query Beats Ten Simple Ones for Testing PostgreSQL-ChatGPT Connections

When connecting PostgreSQL to ChatGPT, developers should not rely on multiple easy questions with plausible-sounding answers to validate the integration. A single well-designed business query — incorporating a known answer, tenant boundary, join, versioned metric, and a defined reporting cutoff — provides a far more rigorous acceptance test. The test should also verify identity, data freshness, query limits, truncation handling, and provenance of results. Negative test cases, such as unauthorized tenant access, stale replicas, and forced timeouts, must also be executed to expose failure modes. Critically, the system's responses should preserve incomplete, stale, or unknown states rather than silently collapsing them into empty or misleading output.

0 comments Read more at DEV Community