Logging & Observability interview question · Most asked
What should never be logged, and how do you prevent it?
Summary
Never log secrets (passwords, tokens, API keys, session cookies), full payment card data, or unnecessary personal data. Prevent it with redaction in the logging library, allow-listed fields, code review and automated scanning of logs.
Longer Answer
Leaked credentials in logs are a common breach path because logs are widely accessible and long-lived. Configure redaction paths (e.g., Pino redact, structlog processors, Monolog processors), avoid dumping whole request bodies or headers, and mask identifiers where possible. Comply with GDPR/PCI retention rules and restrict log access.
Key Points
- No secrets, tokens, card data
- Minimize PII
- Library-level redaction
- Restricted access and retention policies
More most-asked Logging & Observability questions
- What are the three pillars of observability, and how do they differ?
- What is structured logging and why is it preferred over plain text logs?
- What is a correlation (request) ID and how do you propagate it?
- What is distributed tracing and how does OpenTelemetry fit in?
- What are the RED, USE and Four Golden Signals methods?
- What are SLIs, SLOs and error budgets?
- Walk through how you would investigate a sudden latency spike in production.