Recording what happened, usefully.
WHAT TO LOG
Errors and exceptions, with a stack trace
Significant actions: payments, account changes, administrative operations
External service calls and their outcomes Scheduled task runs and results
WHAT NOT TO LOG
Passwords, tokens, card details Personal data beyond what you need Everything, indiscriminately, which fills the disk and buries the useful entries
MAKING LOGS USEFUL
Include a timestamp with the timezone Include a request identifier so entries from one request can be correlated Include the user, where applicable Use consistent severity levels
ROTATION
Logs grow. Configure rotation or clear them periodically, or they consume your disk quota.
This is a common cause of a site failing with no apparent reason: the disk filled with logs.
REVIEWING
A log nobody reads is pointless. Check errors periodically, or send critical ones somewhere you will see.
RETENTION
Keep enough to investigate something noticed a week later.
PRIVACY
Logs frequently receive less protection than databases while containing similar data. Treat them accordingly.
