0

Our logger data has gotten a bit out of hand, so I am trying to find ways to trim out unnecessary log information.

What I've found is that the programmer who implemented the logs (no longer working with us) used a lot of user input to log application activity.

I was under the impression that logging user data was a bad idea - because it increases the chances of it being exposed to a malicious attacker, and because it is just informative, and not all that helpful with actual logging.

Assuming the user input data is non-volatile, and that we do have the space to output as much of it as possible (we don't, but this is hypothetical), is it useful at all to log all user input? Are there any common sense rules for user input that should not be logged?

  • 1
    This question goes directly into detail without first telling why you would want to log what... – Jan Doggen Jul 29 '15 at 15:34
2

"User input data" is a rather broad collection of information, so it is hard to say. You should review logging at all layers of your system.

As a starting point, I would consider logging all actionable data at the point you take action. You should use log levels to control the verbosity of your logs. At the end of the day, logging won't be very useful if you aren't logging the data that led to the failure/exception/bug.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.