Logging and monitoring

In plain English

A log is a timestamped record of what a system did, which you can search later to answer questions such as who logged in or why a request failed. Structured logging writes each entry as a set of named fields in a machine-readable format such as JSON, so monitoring tools can filter and alert on specific values instead of scanning free text. You should log important events like authentication attempts, permission changes, failed requests and errors, but never log secrets, which are credentials such as passwords, API keys and session tokens that an attacker could reuse if the logs leak. Alert fatigue happens when too many noisy alerts fire all the time, so people start ignoring them and miss the one that matters, which is why alerts should be few, precise and actionable. Retention is how long logs are kept before deletion, balancing the need to investigate later incidents against storage cost and privacy obligations.

Step by step

1. 1Decide the handful of events worth recording, such as logins, permission changes and errors.
2. 2Emit each entry as structured fields instead of one long string.
3. 3Add a redaction step that strips known secret field names before writing.
4. 4Define a few precise alerts for conditions that need a human response.
5. 5Set a retention period and delete logs you no longer need.

function log(event, fields) {
  const safe = {}
  for (const key of Object.keys(fields)) {
    if (key === 'password' || key === 'token' || key === 'authorization') continue
    safe[key] = fields[key]
  }
  console.log(JSON.stringify({ time: new Date().toISOString(), event, ...safe }))
}

Common mistakes

• Logging a password or session token in a request body turns an access bug into a full credential leak.
• Writing free-text sentences instead of structured fields makes later searching and alerting unreliable.
• Creating an alert for every error soon trains people to ignore all alerts, including the serious ones.
• Keeping logs forever without a retention policy grows storage cost and increases what a breach can expose.