Use info or warning for everyday use. Enable debug briefly to reproduce a problem, then return to a lower log level after troubleshooting. Keep info or warning for normal use, switch to debug only during reproduction, export and redact the necessary segment, then switch back immediately.
First determine which logs you need
Whether you need rule, DNS, or connection details determines the log level. Also consider file growth and exposure of sensitive information.
- Do you need detailed rule matches?
- Do you need to observe DNS queries and the connection process?
- Is the log file growing too quickly?
- Could it record a sensitive URL, domain, or token?
When to use each level
- Keep info or warning for normal use
- Temporarily switch to debug before reproducing the issue
- Export and redact the necessary segment immediately after reproduction(See Security FAQ)
- After troubleshooting, return to info or warning and remove oversized log files(See Profiling engine)
debug logs increase disk writes and privacy exposure
The log level does not change the node's connectivity
Before sharing logs, search for token, secret, password, private-key, and related terms