What's worth logging
Authentication. Successes as well as failures. A successful login from a new country is only interesting if you record successes.
Authorisation failures. The most under-collected signal there is. One user getting a 403 is a bug report; the same user getting forty across different object IDs is someone testing for broken object-level authorisation. You only see the pattern if you log the individual events.
Account changes. Password, email, MFA enrolment, and API key creation. These are the steps in a takeover and they should be visible.
Administrative actions. Anything privileged, with the acting user recorded rather than a service account.
Data access at scale. Not every read, but bulk exports and unusual volumes.
Each entry wants: timestamp with timezone, user identifier, source address, action, target, outcome, and a request or correlation ID that ties it to the rest of the trace.
What must never be logged
Passwords, in any form, including failed attempts, people mistype their password into the username field constantly.
Session tokens, JWTs, API keys, refresh tokens. Anyone with log access gets a working credential.
Card numbers, national identifiers, health data. Logs are usually retained longer and secured less carefully than the database.
Full request bodies on authentication endpoints, which is how passwords end up in logs by accident.
Redact at the logging layer rather than trusting each call site. A denylist of field names applied centrally is far more reliable than remembering at every log statement.
Log injection
User-controlled data written into a log line can forge entries:
username=admin\n2026-01-01 12:00:00 INFO Login successful user=admin
Structured logging in JSON avoids this. The value stays a field rather than becoming a line. If you're writing plain text, escape newlines.
Centralise and protect
Logs on the box you're investigating are logs an attacker can edit. Ship them somewhere separate with append-only access.
Retention has two pressures: incidents are often discovered months later, and personal data in logs falls under retention obligations. Ninety days hot with longer cold storage is a common landing point, but check what your regulator expects.
Alert on patterns
Volume alone isn't detection. A handful of rules covers most of what matters: many authorisation failures from one user, credential stuffing shape across many accounts, privilege changes outside working hours, a first login from a new country.
The thing people skip
Test that logging works before you need it. Trigger an authorisation failure in staging and confirm it arrives, with the fields you expect. Discovering a gap during an incident is the worst possible time.