System logging

The system log contains information about what the system is doing. Main purpose of the system log is to provide information to sys-admins about the current status. This includes, but not restricted to status of outbound connections, authentication failiures, and requests to access resources.

Depending on the configuration set in log4j2.xml, log detail varies. To get detailed information on how to configure log-level, message formats and logfile rollover see log4j2 reference:

https://logging.apache.org/log4j/2.x/manual/configuration.html

Trace correlation

Contextual system logging sanitizes the message before appending correlation IDs such as traceId. A message ending in a sensitive field name such as password therefore does not cause the following valid correlation ID to be masked as its value. This keeps related log entries searchable while sensitive message values remain masked.

Correlation IDs are validated and sanitized separately. Only IDs containing 1–128 letters, digits, periods, underscores or hyphens pass format validation; other IDs are masked. Correlation metadata is not a channel for arbitrary text or secrets.