Skip to content

Logging and PCI-aware Logging

Core can produce application logs, traffic logs, trace logs, and module decision logs.

Log controls

Key Purpose
traffic_log_enabled Enables traffic logging.
trace_enabled Enables detailed trace logging. Use carefully.
log_headers Logs request headers when enabled.
log_body_enabled Logs body prefix when enabled and permitted.
log_json Emits JSON-style records when enabled.
pci_redaction_enabled Redacts sensitive values from logs.
sensitive_headers Header names to redact.
sensitive_query_keys Query keys to redact.
sensitive_body_keys Body keys to redact.
log_rotate_bytes Rotate logs after this size.
log_retention_days Keep logs for this many days.

Always redact authorization headers, cookies, API keys, activation tokens, passwords, card fields, and session identifiers.

Example sensitive keys

sensitive_headers=authorization,cookie,set-cookie,x-api-key,x-auth-token
sensitive_query_keys=token,access_token,api_key,password,session
sensitive_body_keys=password,secret,token,api_key,cardnumber,cvv

Best practices

  • Keep trace logging off by default in production.
  • Forward logs to a SIEM when possible.
  • Set retention according to customer policy and regulatory requirements.
  • Do not log full request bodies unless explicitly required and approved.