TL;DR
Without proper logging, you can't detect an attack while it's happening, investigate one after the fact, or prove compliance when someone asks. Log security-relevant events: logins, failures, permission changes. Never log passwords, tokens, or PII. A tool like LogTail, Datadog, or Sentry makes the searching and alerting someone else's problem.
What Is Insufficient Logging?
Insufficient logging means your app doesn't record enough to detect attacks or investigate incidents after the fact. When something goes wrong, you're left guessing what happened.
What Should You Log?
| Log This | Don't Log This |
|---|---|
| Login attempts (success/failure) | Passwords (even failed ones) |
| Permission changes | Full credit card numbers |
| Access to sensitive resources | Session tokens |
| Configuration changes | API keys |
| Error conditions | Personal data (SSN, etc.) |
Example Logging Implementation
// Log authentication events
logger.info('auth.login.success', {
userId: user.id,
ip: req.ip,
userAgent: req.headers['user-agent'],
timestamp: new Date().toISOString()
});
logger.warn('auth.login.failed', {
email: maskEmail(email), // user@e*****.com
ip: req.ip,
reason: 'invalid_password',
timestamp: new Date().toISOString()
});
Never log: Passwords, tokens, API keys, credit cards, SSNs, or other sensitive data. If your logs leak, that data leaks with them.
Setting Up Alerts
Logs are only useful if someone looks at them. Set up alerts for:
- Multiple failed login attempts (brute force detection)
- Admin actions from new IP addresses
- Unusual error rates
- Access patterns outside business hours
How long should I keep logs?
Depends on your compliance requirements, but 90 days to a year is common. Most breaches aren't discovered until weeks after they happen, and short retention means you've already lost the evidence by the time you go looking.
What logging service should I use?
For vibe-coded apps, LogTail, Sentry, and Datadog are the easiest to bolt on. You get search, alerting, and a dashboard, and you don't have to run any of it yourself.
Check Your Logging
Our scanner checks for missing security logging patterns.