what should you log in many cases developers log the entry (and to lesser extentthe exit from function or method howeverit may also be useful to log what happens at branch points within function or method so that the logic of the application can be followed all applications should log all errors/exceptions although care is needed to ensure that this is done appropriately for example if an exception is caught and then re thrown several times it is not necessary to log it every time it is caught indeed doing this can make the log files much largercause confusion when the problem is being investigated and result in unnecessary overheads one common approach is to log an exception where it is first raised and caught and not to log it after that what not to log the follow on question to consider is 'what information should not log?one general area not to log is any personal or sensitive information including any information that can be used to identify an individual this sort of information is known as pii or personally identification information such information includes user ids and passwordsemail addressesdata of birthbirth placepersonally identifiable financial information such as bank account detailscredit card details etc biometric informationmedical/health informationgovernment issued personal information such as passport detailsdrivers license numbersocial security numbersnational insurance numbers etc official organisational information such as professional registrations and membership numbersphysical addressesphone (land-linenumbersmobile phone numbersverification elated information such as mother' maiden namepetsnameshigh schoolfirst schoolfavourite filmetc it also increasing includes online information relating to social media such as facebook or linkedin accounts all of the above is sensitive information and much of it can be used to identify an individualnone of this information should be logged directly that does not mean that you cannot and shouldn' log that user logged inyou may well need to do that howeverthe information should at least be obfuscated and should not include any information not required for example you may record that user represented by some id attempted to log in at specific time and whether they were successful or not howeveryou should not log their password and may