Overview

Debug Logging controls how much the platform writes about its own behaviour, where it goes, and what gets redacted on the way out.

Nav path: Settings → System & Monitoring → Debug Logging. Requires Administrator access.

This is a diagnostic tool, not a monitoring one. For who did what, use Audit logs. For why did this test fail, use the Detailed test report. Reach for debug logging when the answer isn't in either — when the platform itself is behaving unexpectedly.

Log Level Configuration

Log Level sets the verbosity:

Level	Includes
Error	"Only error messages"
Warning	"Errors and warnings"
Debug	"All messages including debug info"

Debug is a temporary state. Turn it on to investigate something specific, and turn it off when you're done. Left on, it produces volume that fills disks, rotates away the very history you'd want later, and buries real errors in noise. The instinct to "leave it on just in case" produces the opposite of what you want: more log, less signal.

Warning is a sound steady state for most installs. Error is quieter but drops the warnings that often precede a problem.

File Logging Configuration

Where logs are written and how they're kept:

Setting	What it does
Max File Size (MB)	Rotate to a new file at this size.
Max Number of Files	How many rotated files to keep.
Log Retention (days)	How long to keep logs.

These three together decide how far back you can actually look. Small files times few files equals a short window — and at Debug level that window can be hours. If you turn Debug on to catch an intermittent problem, check these numbers first, or you'll find the incident already rotated out by the time you look.

Also check the disk. Debug logging with generous rotation settings can consume more space than people expect.

Sensitive Data Configuration

This is the section to read carefully.

Logs capture what the platform is doing, and what it's doing involves credentials. The sensitive-field list — placeholder password, apiKey, token, secret — names the fields to redact before anything is written.

Treat this list as a floor, not a ceiling. Add anything your APIs use that would be damaging in a log file: authorization, cookie, clientSecret, refreshToken, ssn, pan, or whatever your domain calls the things that shouldn't leak. The default list covers the obvious names; it can't know yours.

The reason this matters more at Debug: verbose logging captures far more request and response content, so the gap between "we redact passwords" and "we redact everything sensitive" gets much wider exactly when you've turned Debug on to investigate a production problem. Review this list before raising the level, not after.

Log files inherit the sensitivity of what's in them. If they contain unredacted secrets, they're now a credential store with none of the protections — and they get copied into tickets.

Context and output

Context Configuration and Output Configuration control what contextual detail is attached to entries and where they go. Log Files lists what's currently on disk.

Resetting

Reset Debug Logging Settings returns the section to defaults. Note this includes the sensitive-field list, so re-add your custom entries afterwards — a reset that silently drops your redactions is a bad surprise.

Troubleshooting

Logs are enormous — you're on Debug. Drop to Warning.
The log doesn't go back far enough — rotation settings are too tight for the level. Raise Max Number of Files or Log Retention (days).
Disk filling up — Debug plus generous retention. Lower one or both.
A secret appeared in a log — add the field name to the sensitive list, then treat the credential as compromised and rotate it. Redaction only applies going forward.
You reset settings and secrets started appearing — the reset cleared your custom sensitive fields. Re-add them.
The page is unavailable — you're not an Administrator.

Debug Logging: Levels and Redaction