The SaaS Founder's Guide to Logging: What to Log and What Not to Log

The SaaS Founder's Guide to Logging: What to Log and What Not to Log

Logs are your eyes in production. Without them, you cannot diagnose issues, understand user behavior, or comply with audit requirements. But too many logs are noise — they make it harder to find the important information. This article is the SaaS founder's guide to what to log, what not to log, and how to make logs useful.

The direct answer is that SaaS logging has three principles: log the right things (requests, errors, business events), do not log the wrong things (secrets, PII), and use structured logging (JSON, not plain text) for searchability. For more on logging, see our article on the logging gap.

What to Log

1. Requests

Log every HTTP request (method, URL, status, duration, IP, user ID):

{
  "level": "info",
  "time": "2026-09-15T10:00:00Z",
  "type": "request",
  "method": "POST",
  "url": "/api/users",
  "status": 201,
  "duration_ms": 45,
  "ip": "1.2.3.4",
  "userId": "123",
  "requestId": "abc-123"
}

This lets you answer: "How many requests per minute?" "What is the average response time?" "Which endpoints are slowest?"

2. Errors

Log every error (message, stack trace, request ID, user ID):

{
  "level": "error",
  "time": "2026-09-15T10:00:00Z",
  "type": "error",
  "message": "Database connection failed",
  "stack": "Error: Database connection failed\n    at ...",
  "requestId": "abc-123",
  "userId": "123"
}

This lets you answer: "What errors occurred in the last hour?" "Which user was affected?" "What was the stack trace?"

3. Business Events

Log significant business events (signup, payment, plan change, cancellation):

{
  "level": "info",
  "time": "2026-09-15T10:00:00Z",
  "type": "business_event",
  "event": "payment_succeeded",
  "userId": "123",
  "amount": 29.00,
  "plan": "pro"
}

This lets you answer: "How many payments succeeded today?" "How many users upgraded to Pro?" "How many cancellations occurred?"

What NOT to Log

1. Secrets

Never log secrets (API keys, passwords, tokens, connection strings). If you log console.log(process.env), all your secrets appear in the logs, which is a security incident.

2. PII (Personally Identifiable Information)

Do not log PII (email addresses, phone numbers, addresses, credit card numbers). GDPR and CCPA require you to protect PII, and logging it creates a compliance risk.

If you need to log a user identifier, use the user ID (not the email): userId: "123" (not email: "[email protected]").

3. Request Bodies

Do not log full request bodies, because they might contain secrets or PII (e.g., passwords in login requests, credit card numbers in payment requests). Log the request method and URL, but not the body.

4. Verbose Debug Output

Do not log verbose debug output in production. Set the log level to INFO (not DEBUG), which filters out debug messages. If you need debug output for a specific issue, temporarily set the level to DEBUG for that component.

How to Log: Structured Logging

Use structured logging (JSON format), not plain text. Structured logs are searchable, filterable, and machine-readable:

// Bad (plain text)
console.log('User 123 logged in from 1.2.3.4');

// Good (structured)
logger.info({
  type: 'auth',
  event: 'login',
  userId: '123',
  ip: '1.2.3.4',
});

Use a structured logger:

• Node.js: pino (fast, JSON output, built-in redaction)
• Python: structlog (JSON output, structured fields)
• Go: slog (standard library, JSON output)

For more on structured logging, see our article on the logging gap.

How to Search Logs

With structured logs, you can search by any field:

• Find all errors: level: "error"
• Find errors for a specific user: level: "error" AND userId: "123"
• Find errors for a specific request: requestId: "abc-123"
• Find slow requests: duration_ms > 1000
• Find business events: type: "business_event" AND event: "payment_succeeded"

Deployxa's dashboard includes a log viewer that supports search and filtering. You can also access logs via the CLI (deployxa logs) or the MCP server. For more, see our article on how we built the logging pipeline.

Log Levels

Use log levels to control verbosity:

• DEBUG. Detailed information for debugging (disabled in production).
• INFO. Normal events (requests, business events). Default level in production.
• WARN. Potential issues (e.g., rate limit exceeded, deprecated API used).
• ERROR. Errors that need attention (e.g., database connection failed).
• FATAL. Errors that crash the app (e.g., cannot start the server).

In production, set the level to INFO (which filters out DEBUG). When debugging an issue, temporarily set the level to DEBUG for the affected component.

Common Pitfalls and Troubleshooting

The first pitfall is logging secrets. If you log process.env or request bodies, secrets appear in the logs. The fix is to use a logger that supports redaction (like pino) and to redact sensitive fields.

The second pitfall is logging PII. If you log email addresses or phone numbers, you create a compliance risk. The fix is to log user IDs (not emails) and to never log PII.

The third pitfall is too many logs. If you log every database query, the logs are overwhelming and hard to search. The fix is to log at the INFO level (requests, errors, business events) and to use DEBUG for detailed information.

The fourth pitfall is not using structured logging. Plain-text logs are hard to search and filter. The fix is to use a structured logger (JSON format).

The fifth pitfall is not including request IDs. Without request IDs, you cannot trace a single request through the logs. The fix is to generate a unique request ID for each request and include it in every log entry.

Common Pitfalls and Troubleshooting

When working with the saas founder's guide to logging what to log and what not to log, several common pitfalls can undermine effectiveness. The first is over-automation. Automating everything sounds appealing, but some tasks require human judgment. The fix is to automate repetitive tasks (monitoring, diagnosis, deployment) while keeping humans in the loop for decisions that affect customers, billing, or security. The second is not testing changes before applying them. Whether it is a configuration change, a code change, or an infrastructure change, untested changes can break production. The fix is to always test in staging before applying to production, and to have a rollback plan. The third is not monitoring the automation itself. If your automated system goes down, you are flying blind. The fix is to monitor the automation system (e.g., with a dead man's switch) and to alert if it stops running. The fourth is not documenting the process. If the process is in your head, it does not exist for anyone else. The fix is to document the process in a runbook that anyone can follow. For more on documentation, see our article on how to build a deployment process your future team can inherit. The fifth is not reviewing regularly. Processes that work today might not work tomorrow (as the product grows, the traffic changes, the team changes). The fix is to review the process monthly and to adjust as needed.

Advanced Patterns and Best Practices

Beyond the basics of the saas founder's guide to logging what to log and what not to log, several advanced patterns can improve outcomes. The first is incremental implementation. Rather than implementing everything at once, start with the minimum viable version and iterate. This reduces risk (smaller changes are easier to debug) and delivers value faster. The second is automation. Manual processes are error-prone and do not scale. The fix is to automate repetitive tasks (deployment, testing, monitoring) using CI/CD pipelines and automated tools. For more on CI/CD, see our article on how we built the CI/CD pipeline. The third is documentation. A process that is not documented does not exist for anyone else. The fix is to document processes in runbooks that anyone can follow. For more on documentation, see our article on how to build a deployment process your future team can inherit. The fourth is testing. Untested changes can break production. The fix is to write tests (unit, integration, end-to-end) and to run them in CI/CD before every deployment. For more on testing, see our article on the testing void. The fifth is continuous improvement. Processes that work today might not work tomorrow. The fix is to review processes regularly (monthly) and to adjust based on lessons learned from incidents, feedback, and changing requirements.

When This Approach Is Not the Right Choice

While the saas founder's guide to logging what to log and what not to log is a valuable practice, it is not always the right approach. For very small projects (hobby projects, prototypes), the overhead of implementing best practices might not be worth the effort. The fix is to implement the minimum viable version and to add more as the project grows. For teams with limited resources (solo founders, small teams), prioritizing features over infrastructure might be the right call in the short term. The fix is to implement the highest-impact practices first (security, backups) and to defer the rest until the team grows. For projects with strict compliance requirements (HIPAA, SOC 2), the standard approach might not be sufficient, and you might need to implement additional controls (audit logging, access reviews, penetration testing). The key is to match the approach to your project's stage, resources, and requirements. For more on prioritization, see our article on the production checklist before your SaaS takes its first customer. For more on compliance, see the SaaS founder's guide to compliance.

Additional Considerations and Best Practices

When working with the saas founder's guide to logging what to log and what not to log, there are several additional considerations that can significantly impact your success. The first is the importance of starting simple and iterating. Many teams try to implement everything at once, which leads to complexity, bugs, and delayed launches. The fix is to start with the minimum viable version, verify it works, and then add features incrementally. This approach reduces risk, delivers value faster, and makes debugging easier because changes are smaller. The second consideration is the importance of documentation. A process that is not documented does not exist for anyone else on the team. Document your configuration, your deployment process, your rollback procedure, and your incident response plan. Use runbooks that anyone can follow, not just the person who set up the system. For more on documentation, see our article on how to build a deployment process your future team can inherit.

The third consideration is testing. Untested changes are the leading cause of production incidents. Before deploying any change, test it locally, test it in staging, and run your automated test suite. If you do not have automated tests, start by writing tests for your most critical paths (signup, login, payment). For more on testing, see our article on the testing void. The fourth consideration is monitoring. Without monitoring, you cannot detect issues until customers complain. Set up health checks, structured logging, metrics tracking, and alerts for error rate and response time. For more on monitoring, see our article on monitoring your SaaS without hiring a DevOps engineer.

The fifth consideration is security. Security is not optional when you are handling customer data and payment information. Ensure all secrets are in environment variables (never hardcoded), enforce HTTPS, set security headers, use rate limiting on auth endpoints, and hash passwords with bcrypt or argon2. For more on security, see our article on a practical security checklist for early-stage SaaS. The sixth consideration is backups and recovery. Your database should be backed up daily, backups should be stored off-site, and backup restore should be tested regularly. An untested backup is not a backup. For more on backups, see our article on how to rehearse a database restore before you need one.

The seventh consideration is cost management. Cloud costs can creep up over time, and without monitoring, they can exceed revenue. Track your monthly hosting cost, set a budget, and use fixed pricing (like Deployxa at $9/month for 15 apps) to avoid surprise bills. For more on cost management, see our article on how to estimate deployment costs for a small SaaS. The eighth consideration is team communication. When things go wrong, communication is as important as the fix. Set up a status page, communicate transparently during incidents, and publish post-mortems after. For more on communication, see our article on the SaaS founder's guide to status pages.

These considerations apply regardless of your specific technology stack, team size, or business model. By addressing each one systematically, you reduce the risk of outages, data loss, security breaches, and cost overruns, which protects your revenue and your customers' trust.

Conclusion: Log Smart, Not More

Logs are your eyes in production, but too many logs are noise. By logging the right things (requests, errors, business events), not logging the wrong things (secrets, PII), and using structured logging (JSON), you can make your logs useful for debugging, monitoring, and compliance. The key is quality, not quantity.

Ready to improve your logging? Install a structured logger, add request IDs, and review what you are logging. For more, see the logging gap and monitoring your SaaS without hiring a DevOps engineer. Explore our free developer tools to speed up your workflow.