Our logger data has gotten a bit out of hand, so I am trying to find ways to trim out unnecessary log information.
What I've found is that the programmer who implemented the logs (no longer working with us) used a lot of user input to log application activity.
I was under the impression that logging user data was a bad idea - because it increases the chances of it being exposed to a malicious attacker, and because it is just informative, and not all that helpful with actual logging.
Assuming the user input data is non-volatile, and that we do have the space to output as much of it as possible (we don't, but this is hypothetical), is it useful at all to log all user input? Are there any common sense rules for user input that should not be logged?