# Debug Logging: Levels and Redaction

> Configure log level, file output, rotation and retention, and the sensitive-field redaction list — plus why Debug level is a temporary tool, not a default.

Source: https://totalshiftleft.ai/help-center/product-documentation/debug-logging

## Overview

**Debug Logging** controls how much the platform writes about its own behaviour, where it goes, and what gets redacted on the way out.

Nav path: **Settings → System & Monitoring → Debug Logging**. Requires Administrator access.

This is a diagnostic tool, not a monitoring one. For *who did what*, use [Audit logs](/help-center/product-documentation/audit-logs). For *why did this test fail*, use the [Detailed test report](/help-center/product-documentation/detailed-test-report). Reach for debug logging when the answer isn't in either — when the platform itself is behaving unexpectedly.

## Log Level Configuration

**Log Level** sets the verbosity:

| Level | Includes |
|-------|----------|
| **Error** | *"Only error messages"* |
| **Warning** | *"Errors and warnings"* |
| **Debug** | *"All messages including debug info"* |

**Debug is a temporary state.** Turn it on to investigate something specific, and turn it off when you're done. Left on, it produces volume that fills disks, rotates away the very history you'd want later, and buries real errors in noise. The instinct to "leave it on just in case" produces the opposite of what you want: more log, less signal.

**Warning** is a sound steady state for most installs. **Error** is quieter but drops the warnings that often precede a problem.

## File Logging Configuration

Where logs are written and how they're kept:

| Setting | What it does |
|---------|--------------|
| **Max File Size (MB)** | Rotate to a new file at this size. |
| **Max Number of Files** | How many rotated files to keep. |
| **Log Retention (days)** | How long to keep logs. |

These three together decide how far back you can actually look. Small files times few files equals a short window — and at **Debug** level that window can be hours. If you turn Debug on to catch an intermittent problem, check these numbers first, or you'll find the incident already rotated out by the time you look.

Also check the disk. Debug logging with generous rotation settings can consume more space than people expect.

## Sensitive Data Configuration

This is the section to read carefully.

Logs capture what the platform is doing, and what it's doing involves credentials. The sensitive-field list — placeholder `password, apiKey, token, secret` — names the fields to redact before anything is written.

Treat this list as a floor, not a ceiling. Add anything your APIs use that would be damaging in a log file: `authorization`, `cookie`, `clientSecret`, `refreshToken`, `ssn`, `pan`, or whatever your domain calls the things that shouldn't leak. The default list covers the obvious names; it can't know yours.

The reason this matters more at **Debug**: verbose logging captures far more request and response content, so the gap between "we redact passwords" and "we redact everything sensitive" gets much wider exactly when you've turned Debug on to investigate a production problem. Review this list *before* raising the level, not after.

Log files inherit the sensitivity of what's in them. If they contain unredacted secrets, they're now a credential store with none of the protections — and they get copied into tickets.

## Context and output

**Context Configuration** and **Output Configuration** control what contextual detail is attached to entries and where they go. **Log Files** lists what's currently on disk.

## Resetting

**Reset Debug Logging Settings** returns the section to defaults. Note this includes the sensitive-field list, so re-add your custom entries afterwards — a reset that silently drops your redactions is a bad surprise.

## Troubleshooting

- **Logs are enormous** — you're on **Debug**. Drop to **Warning**.
- **The log doesn't go back far enough** — rotation settings are too tight for the level. Raise **Max Number of Files** or **Log Retention (days)**.
- **Disk filling up** — Debug plus generous retention. Lower one or both.
- **A secret appeared in a log** — add the field name to the sensitive list, then treat the credential as compromised and rotate it. Redaction only applies going forward.
- **You reset settings and secrets started appearing** — the reset cleared your custom sensitive fields. Re-add them.
- **The page is unavailable** — you're not an Administrator.

## Related articles

- [Audit logs](/help-center/product-documentation/audit-logs)
- [Administration settings](/help-center/product-documentation/administration-settings)
- [Detailed test report](/help-center/product-documentation/detailed-test-report)
- [Help & version information](/help-center/product-documentation/help-version-information)
- [Secret managers](/help-center/product-documentation/secret-managers)