title: Logging/Security considerations and sensitive data
body: <p>I am working on general "architecture" related to logging and security of web applications. As far as I know, it is considered the best practice to log all request/response data (not only access logs, but the body of the requests/responses). It's good for security analysis, debugging purposes, audit and many more things.</p>
  
  <p>There is an issue, that sensitive information is transferred in some requests, for example, passwords and/or credit card data.</p>
  
  <p>(Please note: of course, I am using HTTPS, but passwords and/or credit card data will appear as plain text in logging or log files. And by the way, I do not store credit card data, because I am not PCI DSS compliant, we transfer this data to our partner, who is PCI DSS compliant).</p>
  
  <p>Currently, I log and store offsite access logs (so logs without request/response bodies, but with GET parameters data) and I log request/response body data in application code (so I am able do decide what kind of data goes to log, and erase sensitive data before writing it to log).</p>
  
  <p>However, I am thinking to implement the logging (of request/response bodies) outside the application, lets say on the server level via some module (for example, mod_dumpio or something similar), but in this case, logging the sensitive information might be a big issue.</p>
  
  <p>How should I implement/configure it?</p>