Keep secrets out of application logs at the point where events are created. Record only the context needed to debug, investigate, or monitor an event, then apply tested redaction or pseudonymization before logs cross a trust boundary. Restrict access, protect log integrity, and set retention according to the application’s actual operational and legal requirements—not a universal number of days.
Design log events around a purpose
For every field, be able to name the operational, security, or investigation task it supports. OWASP’s Logging Cheat Sheet describes useful event context as “when, where, who and what”; the exact fields depend on the application and monitoring purpose.
As an Amazon Associate I earn from qualifying purchases.
A deliberate event schema might include a timestamp, service identity, event type, action, target, outcome, and the minimum actor identifier needed. For example, an authentication event can record that a sign-in attempt for an internal account reference failed, along with its time and service, without recording the password or the submitted request body.
Avoid logging complete request or response bodies by default. Review less obvious paths where sensitive values can appear:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Query parameters and URL paths, which may contain tokens or personal identifiers.
- Headers and cookies, including authorization and session values.
- Exception messages, debug output, and framework-generated telemetry.
- Database connection strings and other configuration values included in diagnostics.
OWASP’s Logging Cheat Sheet cautions that logs can expose personal data and sensitive implementation details. Treat each field as a data-collection decision, not as harmless because it is “only a log.”
Keep secrets out at the logging call site
Do not pass passwords, bearer tokens, API keys, private keys, session identifiers, database connection strings, encryption keys, payment-card data, or sensitive personal data to a logger as-is. OWASP advises removing, masking, sanitizing, hashing, or encrypting sensitive values rather than recording them directly. Prefer not to collect the value at all when the event can be understood without it.
If an investigation needs to correlate events, use an opaque internal reference or a carefully designed pseudonymous value that cannot be used as the credential itself. OWASP specifically suggests considering a hash of a session identifier for session-specific tracking instead of logging the session ID.
Recommended Free Tools
Ordinary hashing does not necessarily make an identifier anonymous. A predictable or low-entropy value, such as an email address or IP address, may be guessed and hashed to find a match. A keyed hash such as HMAC can make that guessing harder for parties without the key, but it requires secure key management and still produces a linkable pseudonymous identifier. OpenTelemetry Collector documentation describes HMAC options for redaction; decide whether this trade-off fits your purpose and threat model.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Treat identifiers as personal data
IP addresses, usernames, device identifiers, and similar fields may identify a person directly or become identifying when combined with other records. Keep them only when they support a defined need, and consider whether an internal identifier or pseudonym is sufficient.
Where identity is needed for a specific investigation, scope access to the identifying data and avoid making it available in every general-purpose log view. The OWASP Application Logging Vocabulary discusses optional event fields; the choice to include an actor identifier should be driven by the application’s requirements rather than copied indiscriminately from a schema.
Use redaction as defense in depth
Redaction can catch values that were missed at the call site, but it is not a substitute for preventing sensitive data from entering events. Apply filtering or transformation in the application or SDK when possible, before the event is persisted or exported. A processor downstream cannot protect an earlier file, queue, or service that already received the raw value.
OpenTelemetry documents SDK and Collector approaches to processing telemetry. Depending on the processor and configuration, attributes can be removed, modified, filtered, hashed, or otherwise transformed. A Collector gateway can provide a shared enforcement point. Elastic documents ingest redaction, and Dynatrace documents a Collector-gateway example for masking telemetry before it leaves a network. These are implementation examples, not evidence that one option is best for every system.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Compare approaches based on where they process data and what they actually cover:
| Approach | Processing point established by the documentation | What to verify for your deployment |
|---|---|---|
| Application or SDK processing | Can process data before it is exported; OpenTelemetry documents SDK processing options. | Whether processing occurs before local persistence; coverage of attributes, message bodies, URLs, and exceptions; behavior if the processor is absent or misconfigured. |
| OpenTelemetry Collector | Can process telemetry in a Collector, including at a gateway; OpenTelemetry documents removal, modification, filtering, hashing, and transformation options. | Whether every route to storage passes through the Collector; exact signal and field coverage; failure behavior and who can change its rules. |
| Vendor ingestion pipeline | Elastic documents ingest redaction; Dynatrace documents a Collector-gateway masking example before telemetry leaves a network. | Where processing occurs relative to vendor receipt; product, licensing, and regional availability; field coverage, failure behavior, and applicable contracts. |
The cited product documentation establishes that these options exist, but does not establish a universal capability matrix or a best choice. Confirm current feature coverage, deployment path, licensing, and behavior during outages or configuration errors for the version and service you operate.
Test the actual data paths
Redaction rules can miss fields, over-match harmless values, or cover structured attributes while leaving free text untouched. Test representative data through the same path used in production. Include structured fields, log message bodies, exception strings, and URLs, and verify that secrets are absent at each persistence and export boundary. Also test what happens if the redaction component is unavailable: the system should not silently send unredacted events when your policy requires them to be blocked.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Prevent forged or malformed log entries
Values supplied by users or other untrusted systems can contain carriage returns, line feeds, delimiters, or characters that alter the output format. Validate values against expected formats, neutralize characters that could create forged records or change event structure, and encode values for the destination format. This reduces the risk that attacker-controlled input will be interpreted as a separate event or corrupt the log record.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect log access, integrity, and availability
Logs can be attacked for confidentiality, integrity, availability, or accountability. Apply controls to readers and writers, and protect the pipeline as well as the final store.
- Use least privilege for log access and separate permissions for writing, reading, changing configuration, and deleting records where practical.
- Keep web logs outside publicly served directories. If a database stores logs, OWASP recommends a separate, restrictive account for writing log data.
- Use secure transmission when forwarding logs across untrusted networks.
- Protect stored records against unauthorized modification or deletion, and monitor access to them.
- Detect unexpected interruptions in logging or collection. Treat log access, collection changes, and deletion as security-relevant events.
These controls help keep logs available and trustworthy without broadening who can read sensitive operational information.
Set retention for the application and its obligations
Choose a retention period based on the operational purpose and applicable legal, regulatory, and contractual requirements. Delete logs when that period ends, including temporary debug logs and copies, subject to the retention policy that applies to them. The OWASP guidance does not establish one retention duration for every application, so a blanket “30,” “90,” or “365” day rule should not be presented as a universal OWASP requirement.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDocument which log categories have different needs, who approves their retention periods, and how deletion applies across primary storage, exports, and temporary locations. If a legal or contractual obligation applies, confirm the schedule for the relevant jurisdiction and data rather than assuming a general engineering recommendation settles it.
Quick Recap
Put the controls into a repeatable workflow
- Inventory fields: list the fields emitted by each application and telemetry source, including framework-generated events, and record the purpose for each.
- Remove unnecessary collection: change logging calls and defaults so passwords, credentials, raw session values, sensitive payloads, and unnecessary identifiers are not emitted.
- Choose correlation safely: use an opaque reference where possible; if pseudonymization is needed, assess linkability, low-entropy inputs, and key management.
- Enforce before export: add application, SDK, or Collector processing at a point before untrusted storage or services receive raw events.
- Test coverage and failure modes: check structured and free-text paths, and verify that a processor failure cannot cause prohibited unredacted data to escape.
- Harden the pipeline: restrict access, secure transport, protect records from tampering or deletion, and alert on unexpected logging interruptions.
- Review retention: map each category to its business purpose and applicable obligations, then ensure deletion covers copies and temporary logs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
