introduction to logging not log the actual userid--instead you may log an id that can be used to map to their actual userid you should also be careful about directly logging data input too an application directly into log file one way in which malicious agent can attack an application (particularly web applicationis by attempting to send very large amounts of data to it (as part of field or as parameter to an operationif the application blindly logs all data submitted to itthen the log files can fill up very quickly this can result in the file store being used by the application filling up and causing potential problems for all software using the same file store this form of attack is known as log (or log fileinjection attack and is well documented (see www owasp org/index php/log_injection which is part of the well respected open web application security projectanother point to note is that it is not merely enough to log an error this is not error handlinglogging an error does not mean you have handled itonly that you have noted it an application should still decide how it should manage the error or exception in general you should also aim for empty logs in production systemthat is only information that needs to be logged in production system should be logged (often information about errorsexceptions or other unexpected behaviourhoweverduring testing much more detail is required so that the execution of the system should be followed it should therefore be possible to select how much information is logged depending on the environment the code is running in (that is within test environment or within production environmenta final point to note is that it is important to log information to the correct place many applications (and organisationslog general information to one log fileerrors and exceptions to another and security information to third it is therefore important to know where your log information is being sent and not to send information to the wrong log why not just use printassuming that you want to log information in your application then next question is how should you do thatthrough this book we have been using the python print(function to print out information that indicates results generated by our code but also at times what is happening with function or method etc thus we need to consider whether using the print(function the best way to log information in actual factusing print(to log information in production system is almost never the right answerthis is for several reasonsthe print(function by default writes strings out to the standard output (stdoutor standard error output (stderrwhich by default directs output to the consoleterminal for examplewhen you run an application within an idethe output is