What to ask your agency about application logging
Every audit we run turns up some version of this. If you are briefing an agency or a freelancer on application logging, these questions are worth asking early.
The question is rarely whether something can be built, but what it costs to keep running afterwards. Doing this properly once is usually cheaper than doing it approximately three times.
Questions worth asking
- Who will actually do this work, and have they done it before?
- How will we know afterwards whether it worked?
- What happens if it needs changing in a year?
- What are you assuming that we have not confirmed?
What a good answer sounds like
Logs are what you have when something breaks at 2am. Small and consistent beats large and occasional here. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.
Never log passwords, tokens, or full card numbers. The cost of getting this wrong is rarely visible on the day it happens. Write the reasoning down alongside the decision, because the reasoning is what changes first.
How to tell if yours is fine
Most development decisions are really maintenance decisions wearing a different hat. Three things worth confirming about application logging before you move on:
- Someone can say what the current setup is without going to look
- Structure them so they can be searched, not just read — and you know whether that is true here
- There is a way to tell whether the last change to this helped
None of this needs a rewrite. Most of it is a morning's work once someone decides to do it.