When application logging is worth the effort

There is no clever trick in this one, just a handful of decisions worth making deliberately. Application logging is not free, and pretending otherwise leads to bad decisions.

Most development decisions are really maintenance decisions wearing a different hat. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

When it is worth it

Logs are what you have when something breaks at 2am. This is the sort of thing that compounds, quietly, in both directions. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

When it is not

If nothing downstream depends on it and nobody is complaining, it can wait. The cost of getting this wrong is rarely visible on the day it happens.

How to decide

Never log passwords, tokens, or full card numbers. The reasoning matters more than the rule, because the rule has exceptions. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

How to tell if yours is fine

The question is rarely whether something can be built, but what it costs to keep running afterwards. Three things worth confirming about application logging before you move on:

• Someone can say what the current setup is without going to look
• Structure them so they can be searched, not just read — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.