Security Logging and Monitoring for Web Applications

Why logging is a security control

Many breaches go unnoticed for a long time because nobody was watching. Logs are how you detect an attack in progress, understand what happened afterwards and prove what did not happen. Without them, a small team facing a suspected incident cannot answer basic questions: which accounts were accessed, what data was read and when it started. Logging and monitoring failures appear in the OWASP Top 10 for exactly this reason.

Good security logging does not mean logging everything. It means recording the events that matter, in a consistent format, in a place attackers cannot easily alter, and reviewing them through alerts and regular checks. A small team can achieve this with a hosted log service or the logging tools built into its cloud platform, without a dedicated security operations centre.

What to log, and what never to log

Log security-relevant events with enough context to investigate: who did it, what happened, when, from where and whether it succeeded. Use structured formats such as JSON so logs can be searched and filtered, include a request ID to follow one action across services and record times in UTC with the time zone clear.

Never log passwords, full card numbers, one-time codes, session tokens, API keys or full authorisation headers. Be careful with personal data such as Aadhaar numbers, national IDs, health details and precise locations, and keep only what you need for security and support. Privacy laws such as India's Digital Personal Data Protection Act and the EU and UK GDPR apply to personal data in logs too, so agree retention periods with whoever handles compliance.

• Logins, failed logins, logouts and password or MFA changes
• Permission denied responses and access to sensitive records
• Admin actions such as role changes and data exports
• Validation failures that suggest probing, and rate limit triggers
• Changes to security settings, keys and configuration

Structured logging with redaction

Build a small helper for security events so every developer logs them the same way, and add redaction so sensitive fields never reach storage even if someone passes them by mistake. The example below is minimal and illustrative. In a real project, use your framework's logging configuration or a structured logging library, and add redaction at the logging layer rather than relying on every caller to remember.

# Illustrative Python: structured security event logging
# with simple redaction of sensitive fields.
import json
import logging

logger = logging.getLogger("security")
logging.basicConfig(level=logging.INFO, format="%(message)s")

SENSITIVE = {"password", "token", "card_number", "otp", "authorization"}

def security_event(event: str, **fields) -> None:
    safe = {k: ("[REDACTED]" if k.lower() in SENSITIVE else v)
            for k, v in fields.items()}
    logger.info(json.dumps({"event": event, **safe}))

security_event("login_failed", user_id="u_123", ip="203.0.113.7",
               reason="bad_password", password="should-not-appear")
# {"event": "login_failed", "user_id": "u_123", "ip": "203.0.113.7",
#  "reason": "bad_password", "password": "[REDACTED]"}

Monitoring and alerts that work

Send logs from all servers and services to one central place, separate from the application servers, with access restricted so an attacker who compromises an app server cannot quietly delete the evidence. Keep logs for long enough to investigate incidents discovered weeks later, in line with your retention policy. Monitor the health of logging itself, because a silent failure in log shipping looks exactly like a quiet day.

Start with a few high-value alerts rather than many noisy ones. Useful first alerts include a spike in failed logins, many permission denied errors from one account, a new admin account being created, unusual data exports and errors from the payment webhook. Route alerts to a channel someone checks, with a named person on duty. XDQ Labs teams review alert noise monthly and tune or remove alerts nobody acts on, because ignored alerts train people to ignore the real one.

Check your understanding

Turn what you learn into monthly income

Resell AI agents and apps under your own brand. Up to 30% off credits, up to 30% recurring share, and apps built by XDQ Labs for your clients. Free to join.