Reading wire logs

Step 6/7 · 15 min · Intermediate

Production debugging is log archaeology. The eval package is the right place to learn the patterns.

What logs show

Demo scripts print human-readable FIX: SOH (ASCII 0x01) often appears as | or a visible gap.

8=FIX.4.4|9=…|35=A|49=CLIENT|56=SERVER|34=1|52=…|98=0|108=30|10=…|

Read order: 8 → 35 → 49/56 → 34 before business tags.

Grep patterns that save time

# Session only
grep '|35=[0-9A-Z]|' server.log

# Heartbeats (noisy — filter out when hunting orders)
grep -v '|35=0|' server.log | grep '|35='

# Your orders
grep '|35=D|' client.log
grep '|11=ORD-' client.log

# Rejects
grep -E '\|35=3\||\|35=j\||\|150=8\|' *.log

Timestamps

Tag 52 (SendingTime) is engine time on send. Compare initiator vs acceptor logs to measure RTT and heartbeat skew — ties to Heartbeat lesson.

Capture tips

• Start server before client — avoids connection refused noise
• One clean restart clears most seqnum drama
• Save paired logs when opening a support ticket

Next steps

• Wire detective — quizzes on raw messages
• Reject clinic — decode 35=3 and 35=j
• ExampleBank TCP — expected message order