How should logging be handled according to basic standards?

• A. Log at appropriate levels, avoid sensitive data, ensure log readability, and keep logs structured and searchable
• B. Log everything, including secrets
• C. Disable logging in production
• D. Logs should be unstructured plain text

Answer: (A)

Effective logging balances providing enough information to diagnose issues with protecting sensitive data and making the logs easy to analyze. Logging at appropriate levels means you record events with the right granularity: routine operations are logged at a normal level, warnings indicate potential problems, errors capture failures, and detailed debugging information is available only when needed. This keeps noise down and makes real problems stand out.

Avoid including sensitive data in logs because logs often travel across systems, are stored longer, or are accessible by more people than your application’s internal state. Redacting or masking secrets, and avoiding personal or payment data, helps prevent leaks and compliance issues.

Readability and structure matter for quick understanding and for automated tools to process logs. Using a consistent, structured format (like including timestamps, service name, request identifiers, and correlation IDs) makes logs searchable and allows you to stitch together events across services. Structured logging enables effective filtering, aggregation, and alerting.

Why the other approaches don’t fit: logging everything including secrets creates security risks; disabling logging in production eliminates visibility needed for monitoring and issue resolution; and unstructured plain text makes it hard for machines to parse or search, slowing down debugging and monitoring.