ZagTrader

Reading and Analyzing QuickFIX Logs: messages.log and event.log

Written and maintained by ZagTrader. Last reviewed . How this page is sourced and checked

Every QuickFIX session writes two logs: the messages log, with each FIX message sent or received, and the event log, with what the session did (logons, resends, rejects, disconnects). Most problems are solved by reading the two side by side. This guide shows where they are, how to read them, and how to open them in the parser and the log analyzer.

Where the files are

EngineFiles in FileLogPathLine format
QuickFIX/JFIX.4.4-SENDER-TARGET.messages.log, FIX.4.4-SENDER-TARGET.event.log20261020-09:30:00.037: 8=FIX.4.4... (messages carry a time only with FileIncludeTimeStampForMessages=Y)
QuickFIX/nFIX.4.4-SENDER-TARGET.messages.current.log, .event.current.log20261020-09:30:00.037 : 8=FIX.4.4...
QuickFIX C++FIX.4.4-SENDER-TARGET.messages.current.log, .event.current.log, backups in FileLogBackupPath20261020-09:30:00.037000000 : 8=FIX.4.4...
  • The file name is the session ID with your SenderCompID first. That is how you, and the parser, tell which messages are yours: lines from SENDER are outgoing.
  • QuickFIX/J writes messages without a timestamp by default. Set FileIncludeTimeStampForMessages=Y and FileIncludeMilliseconds=Y before you need the log.
  • Many QuickFIX/J deployments log through SLF4J instead of files. The categories are quickfixj.msg.incoming, quickfixj.msg.outgoing, quickfixj.event and quickfixj.errorEvent, each line prefixed with the session ID such as FIX.4.4:SENDER->TARGET.
  • QuickFIX/n 1.14 added logging through the .NET ILogger API; the file log is still available.
  • Messages are written with the real SOH delimiter, which most editors show as a control character. The parser reads SOH, |, ^A and the other common replacements.

Reading the messages log

A QuickFIX/J messages log with timestamps: logon, a new order, its acknowledgement and fill
20261020-09:30:00.037: 8=FIX.4.4|9=70|35=A|49=BUYSIDE|56=SELLSIDE|34=1|52=20261020-09:30:00.037|98=0|108=30|10=090|
20261020-09:30:00.048: 8=FIX.4.4|9=70|35=A|49=SELLSIDE|56=BUYSIDE|34=1|52=20261020-09:30:00.048|98=0|108=30|10=092|
20261020-09:30:01.085: 8=FIX.4.4|9=140|35=D|49=BUYSIDE|56=SELLSIDE|34=2|52=20261020-09:30:01.085|11=ORD-1001|21=1|55=MSFT|54=1|60=20261020-09:30:01.085|38=200|40=2|44=187.50|59=0|10=005|
20261020-09:30:01.096: 8=FIX.4.4|9=162|35=8|49=SELLSIDE|56=BUYSIDE|34=2|52=20261020-09:30:01.096|37=OID-1|11=ORD-1001|17=EXEC-1|150=0|39=0|55=MSFT|54=1|38=200|151=200|14=0|6=0|60=20261020-09:30:01.096|10=109|
20261020-09:30:01.341: 8=FIX.4.4|9=184|35=8|49=SELLSIDE|56=BUYSIDE|34=3|52=20261020-09:30:01.341|37=OID-1|11=ORD-1001|17=EXEC-2|150=F|39=2|55=MSFT|54=1|38=200|32=200|31=187.50|151=0|14=200|6=187.50|60=20261020-09:30:01.341|10=138|

SOH (0x01) is shown as |.

Open this log in the parser
  • Follow MsgSeqNum (34) in each direction separately. A jump is a gap; a lower number than before is a reset or a restart.
  • Pair each request with its answer through ClOrdID (11) and OrigClOrdID (41). The parser's Blotter view does this for every order.
  • The time at the start of the line is when QuickFIX wrote the message; SendingTime (52) inside the message is when the sender sent it. A large difference points at a slow application or clocks that disagree.

Event log lines worth searching for

Text (QuickFIX/J wording)Meaning
Initiated logon request, Received logonA logon in progress and its success.
MsgSeqNum too low, expecting X but received YFatal sequence error, followed by a Logout. See MsgSeqNum too low.
MsgSeqNum too high, expecting X but received YA gap: QuickFIX sends a ResendRequest. Normal after a reconnect.
Reject sent for message N: <reason>:<tag>Your side rejected a message. The reason names the check that failed.
Session state is not current; resettingThe store belonged to an earlier schedule period and was reset at start-up.
Logon attempt not within session timeA Logon arrived outside the schedule.
Disconnecting: <reason>Why the connection closed, for example a heartbeat timeout.

QuickFIX/n and QuickFIX C++ use the same wording for the sequence errors; other events are worded slightly differently.

Open the logs in the parser

  1. Open the parser and drop the .messages.log file on it, or use Open. Plain, .gz and .zip files work, and the parser reads the QuickFIX/J, QuickFIX/n and QuickFIX C++ file formats, the screen logs, and SLF4J or log4j lines from QuickFIX/J.
  2. Open one messages log at a time. With a single file, the parser takes your side from the QuickFIX file name and marks each message as sent or received.
  3. Every message is checked against the dictionary of its FIX version, and session problems are flagged: sequence gaps and numbers that go back, rejects, resend requests, bad BodyLength or CheckSum. To check against the counterparty's customised dictionary, load it with Venue dictionary in the toolbar.
  4. Open the .event.log on its own to list the session events under How this log was read. If you select both files together they are read one after the other, not merged by time.
  5. For a log that is still being written, use the live tail option (Chrome or Edge on a computer). New lines are read every 1.5 seconds.
  6. Before sharing, turn on Anonymise: CompIDs, accounts, order IDs, user names, passwords and free text are replaced with placeholders in the share link and exports.

The log is read in your browser and nothing you load is uploaded. Logs up to 512 MB open in one tab; split larger ones first.

Statistics with the log analyzer

The log analyzer and the parser's Analytics view turn the same log into numbers: message rate, order outcomes, order latency, reject reasons and session health.

  • Latency is measured on a clock you choose: the log timestamp, SendingTime (52) or TransactTime (60). A QuickFIX/J messages log without timestamps can still be measured on SendingTime.
  • The Flow view draws the messages between the CompIDs as a ladder diagram, and Compare logs matches your log against the counterparty's, message by message, to show what is missing or different on one side.
  • To produce the same statistics from your own systems, the analyzer API accepts a FIX log over HTTP and returns JSON.

Questions

Where are QuickFIX log files?
In the directory set by FileLogPath, one messages log and one event log per session, named after the session ID, for example FIX.4.4-SENDER-TARGET.messages.log in QuickFIX/J.
Why do my QuickFIX/J message logs have no timestamps?
QuickFIX/J only writes timestamps on message lines when FileIncludeTimeStampForMessages=Y. Add FileIncludeMilliseconds=Y for milliseconds.
How can I view a QuickFIX log with the fields decoded?
Open the .messages.log file in the ZagTrader FIX Parser. It reads the QuickFIX/J, QuickFIX/n and QuickFIX C++ formats and shows every tag with its name and meaning, in your browser.

The FIX side of the problem

What the error means on any FIX engine, with example messages you can open in the parser:

Reference

Sources

  1. QuickFIX/J source: FileLogFactory.java (log settings and defaults)
  2. QuickFIX/J source: SLF4JLog.java (log categories)
  3. QuickFIX/J source: Session.java (setting names, defaults, logout and reject texts)
  4. QuickFIX/J user manual: Configuration
  5. QuickFIX/n documentation: Configuration
  6. QuickFIX/n release notes
  7. QuickFIX C++ source: FileLog.cpp (log file names)
  8. QuickFIX C++ documentation: Configuration

Setting names, defaults and message texts were checked against the projects' source code and documentation on the review date shown at the top of the page. Behaviour can change between releases; check the version you run. This guide is independent and not affiliated with the QuickFIX projects.

See also

More QuickFIX guides