Secure Logging on a Shoestring Budget
What to log, what not to log, and how to keep observability useful without creating a second data problem.
Contents
Category
Article
Tags
Contents
Small teams usually over-log first and clean up later. That works until the logs become another sensitive system with no owner.
The better approach is to decide which events matter before the service grows. This is especially true when threat modeling a personal tech stack, as excess telemetry creates clutter without improving safety.
Log decisions, not secrets
Useful logs answer questions like:
- who did what
- when it happened
- which system accepted the action
- whether the action was allowed or denied
Logs should not contain raw credentials, session tokens, full request bodies, or personal data unless there is a documented reason.
Keep the format structured
Text blobs are easy to produce and hard to search. Structured logs make it easier to feed downstream analysis systems, which is critical for implementing any future agentic SIEM framework that relies on clean telemetry. Specifically, structured data helps:
- filter by user or request
- trace an incident
- connect service-level events
- build alerts that are less noisy
If the same event can be emitted in one line of JSON, use one line of JSON.
Separate operational and security signals
Not every warning is a security alert. Mixing everything together makes both problems harder to see.
- operational logs: latency, errors, retries
- security logs: auth failures, permission denials, admin actions
- audit logs: changes to identity, access, configuration, or data exports
The categories should be obvious enough that someone can build alerts from them later.
Set a retention policy early
Retention is a security decision because it defines how much sensitive history exists.
The baseline should answer:
- how long logs are kept
- who can read them
- whether they are exported
- how they are deleted
If the logs are never reviewed, they are just an expensive liability.
Outcome
Good logging gives a small team enough evidence to act without turning observability into a data retention problem. As operational scale grows, this structured logging baseline can feed into a modern cloud-native security operations platform to drive automated containment.