<p>Finally solved this issue by digging a lot in code:</p>
<p>The whole (unnecessary?) information is logged inside yii framework yii\log\Target:</p>
<p>method collect(...):</p>
<pre><code>if (($context = $this-&gt;getContextMessage()) !== '') {
  $this-&gt;messages[] = [$context, Logger::LEVEL_INFO, 'application', YII_BEGIN_TIME, [], 0];
}
</code></pre>
<p>When inspecting the getContextMessage() closer we can see that the variable <code>$this-&gt;logVars</code> controls which global variables are all logged regulary:</p>
<pre><code>protected function getContextMessage()
{
  $context = ArrayHelper::filter($GLOBALS, $this-&gt;logVars);
  ...
}
</code></pre>
<p>So basically the clean way to reduce which globals are logged is to specify <code>$this-&gt;logVars</code> via <code>app.php</code>:</p>
<pre><code>
return [
    'modules' =&gt; [
        'mymodule' =&gt; MyModule::class,
        // My modules mapped here
    ],
    'components' =&gt; [
        'log' =&gt; function() {
            return Craft::createObject([
                'class' =&gt; yii\log\Dispatcher::class,
                'targets' =&gt; [
                    [
                        'class' =&gt; codemix\streamlog\Target::class,
                        'url' =&gt; 'php://stderr',
                        'levels' =&gt; Craft::$app-&gt;getConfig()-&gt;general-&gt;devMode ?
                            (yii\log\Logger::LEVEL_ERROR | yii\log\Logger::LEVEL_WARNING | yii\log\Logger::LEVEL_INFO) :
                            (yii\log\Logger::LEVEL_ERROR | yii\log\Logger::LEVEL_WARNING),
                        'except' =&gt; [
                            'yii\base\View::renderFile',
                            'yii\db\Command::*',
                            'yii\db\Connection::*' // We don't want sql to be logged
                        ],
                        // don't log global variables like $_SERVER etc periodically in logs.
                        // See: yii\log\Target::class, collect method usually appends getContextMessage
                        'logVars' =&gt; []
                    ]
                ]
            ]);
        }
    ],
    'bootstrap' =&gt; [
        // My module names here
    ],
];

</code></pre>
<p>Note: we use <code>codemix\streamlog\Target::class</code> here to send the logs to docker stream such that they don't have to be looked up in the files inside the docker container.</p>

CC BY-SA 4.0
2021-01-22T16:39:24.323Z
2021-01-22T16:39:24.323Z
judos
<p>As someone who theoretically might inherit your site one day... and also as future-you trying to diagnose a problem... please don't try to limit what Craft logs. If you want a quicker way to look for critical problems, check out the Yii2 Debug Toolbar as discussed here <a href="https://nystudio107.com/blog/profiling-your-website-with-craft-cms-3s-debug-toolbar" rel="nofollow noreferrer">Profiling your Website with Craft CMS 3’s Debug Toolbar</a></p>
<p>You can use it to very quickly and easily see only errors, or only warnings, and so on. And then if the additional data that Craft logs is needed to help you diagnose a problem, it'll still be there.</p>
<p>To learn how to parse the Craft CMS log files quickly, check out the <a href="https://nystudio107.com/blog/zen-and-the-art-of-craft-cms-log-file-reading" rel="nofollow noreferrer">Zen and the Art of Craft CMS Log File Reading</a></p>
<p>If you do end up wanting to make your own logger, check out the <a href="https://nystudio107.com/blog/creating-a-custom-logger-for-craft-cms" rel="nofollow noreferrer">Creating a Custom Logger for Craft CMS</a> article</p>

CC BY-SA 4.0
2020-08-19T13:37:55.620Z
Ok thanks for the information. Leaving sensitive information such as access keys and password in logs is not acceptible in our case. But I know what you mean about removing logs. Generally for development isn't there an approach like in java/spring? In CraftCMS on production: sure log as much as possible, but otherwise i would want class/package specific log levels which help me accomplish my task and understand what is going on...
judos
CC BY-SA 4.0
2020-08-22T17:09:18.760Z
Passwords should already be sanitized in the logs, but sure, you can add a custom logger as described in the last link, and do whatever you like.
andrew.welch
CC BY-SA 4.0
2020-10-15T16:53:39.547Z
A custom logger is not really what I want to write. How come passwords are anyhow logged together with the whole $_SERVER, $_SESSION, $_COOKIE and other arrays? Any idea about that? I get those arrays for every single line of log I would want to actually read.
judos
CC BY-SA 4.0
2021-01-22T16:48:56.333Z
Added my found solution. Also note: Passwords are only sanitized as specified by the $maskVars variable in yii\log\Target::class. So that's why I anyhow saw a lot of sensitive information in the logs
judos
CC BY-SA 4.0
2020-08-07T01:34:30.607Z
2020-08-07T01:34:30.607Z
andrew.welch
<p>Whenever I have PHP problems I'm looking into the Craft CMS logs. However, at first I noticed there's a ton of stuff getting logged which is useless for me. Under this amount of logs, I can't find what I'm looking for so I want to get Craft CMS to stop logging parts.</p>
<p>Mainly the issue is that each and every POST, FILES, COOKIE, and SERVER variable present for any request is being logged. Which adds around 2 pages of text between the useful logging statements.</p>
<p>In the logs it looks as following:</p>
<pre><code>2020-07-31 11:10:35 [-][-][-][info][DEV_migration_import_users] My useful message

$_POST = []

$_FILES = []

$_COOKIE = []

$_SERVER = [
    'HOSTNAME' =&gt; '...',
    'PHP_VERSION' =&gt; '7.2.32'
    'APACHE_CONFDIR' =&gt; '/etc/apache2'
    'PHP_MD5' =&gt; ''
    'PHP_INI_DIR' =&gt; '/usr/local/etc/php'
[AND ALL PASSWORDS, DB KEYS, SINGING ETC... at least 2 pages of text]
</code></pre>
<p>So I want to remove all these Variables from the logs. How can I do this?</p>
<p>I already tried to find the code where these Variables are logged and found vendor/yiisoft/yii2/base/ErrorHandler.php. But there are other things like &quot;Previous exception:&quot; which are not logged in my case. So this is not the correct code those Server variables are written (commenting out this confirmed it does not help).</p>
<p>PS. Related Problem but solved:</p>
<p>I had the same issue with every single SQL statement ever executed, was logged as well.
To remove these SQL statements I found this post: <a href="https://craftcms.stackexchange.com/questions/33763/is-it-possible-to-allow-logging-at-level-info-without-logging-all-the-sql-querie?newreg=12f0fc741457415383a5b4a95e59f4b9">Is it possible to allow logging at LEVEL_INFO without logging all the SQL queries?</a></p>
<p>Which did help and reduce the huge amount of logs already quite a bit.</p>

<craft3><config><logging>
Cleanup Craft Logs
# Cleanup Craft Logs

(Asked by: username_0 on 2020-07-31)

Whenever I have PHP problems I'm looking into the Craft CMS logs. However, at first I noticed there's a ton of stuff getting logged which is useless for me. Under this amount of logs, I can't find what I'm looking for so I want to get Craft CMS to stop logging parts.
Mainly the issue is that each and every POST, FILES, COOKIE, and SERVER variable present for any request is being logged. Which adds around 2 pages of text between the useful logging statements.
In the logs it looks as following:
2020-07-31 11:10:35 [-][-][-][info][DEV_migration_import_users] My useful message

$_POST = []

$_FILES = []

$_COOKIE = []

$_SERVER = [
    'HOSTNAME' => '...',
    'PHP_VERSION' => '7.2.32'
    'APACHE_CONFDIR' => '/etc/apache2'
    'PHP_MD5' => ''
    'PHP_INI_DIR' => '/usr/local/etc/php'
[AND ALL PASSWORDS, DB KEYS, SINGING ETC... at least 2 pages of text]

So I want to remove all these Variables from the logs. How can I do this?
I already tried to find the code where these Variables are logged and found vendor/yiisoft/yii2/base/ErrorHandler.php. But there are other things like "Previous exception:" which are not logged in my case. So this is not the correct code those Server variables are written (commenting out this confirmed it does not help).
PS. Related Problem but solved:
I had the same issue with every single SQL statement ever executed, was logged as well.
To remove these SQL statements I found this post: Is it possible to allow logging at LEVEL_INFO without logging all the SQL queries?
Which did help and reduce the huge amount of logs already quite a bit.

**Tags:** craft3, config, logging


---

## 2 answers

### Answer by username_0 on 2021-01-22. Score: 1 | Accepted answer

Finally solved this issue by digging a lot in code:
The whole (unnecessary?) information is logged inside yii framework yii\log\Target:
method collect(...):
if (($context = $this->getContextMessage()) !== '') {
  $this->messages[] = [$context, Logger::LEVEL_INFO, 'application', YII_BEGIN_TIME, [], 0];
}

When inspecting the getContextMessage() closer we can see that the variable $this->logVars controls which global variables are all logged regulary:
protected function getContextMessage()
{
  $context = ArrayHelper::filter($GLOBALS, $this->logVars);
  ...
}

So basically the clean way to reduce which globals are logged is to specify $this->logVars via app.php:

return [
    'modules' => [
        'mymodule' => MyModule::class,
        // My modules mapped here
    ],
    'components' => [
        'log' => function() {
            return Craft::createObject([
                'class' => yii\log\Dispatcher::class,
                'targets' => [
                    [
                        'class' => codemix\streamlog\Target::class,
                        'url' => 'php://stderr',
                        'levels' => Craft::$app->getConfig()->general->devMode ?
                            (yii\log\Logger::LEVEL_ERROR | yii\log\Logger::LEVEL_WARNING | yii\log\Logger::LEVEL_INFO) :
                            (yii\log\Logger::LEVEL_ERROR | yii\log\Logger::LEVEL_WARNING),
                        'except' => [
                            'yii\base\View::renderFile',
                            'yii\db\Command::*',
                            'yii\db\Connection::*' // We don't want sql to be logged
                        ],
                        // don't log global variables like $_SERVER etc periodically in logs.
                        // See: yii\log\Target::class, collect method usually appends getContextMessage
                        'logVars' => []
                    ]
                ]
            ]);
        }
    ],
    'bootstrap' => [
        // My module names here
    ],
];


Note: we use codemix\streamlog\Target::class here to send the logs to docker stream such that they don't have to be looked up in the files inside the docker container.


---

### Answer by username_1 on 2020-08-07. Score: 2

As someone who theoretically might inherit your site one day... and also as future-you trying to diagnose a problem... please don't try to limit what Craft logs. If you want a quicker way to look for critical problems, check out the Yii2 Debug Toolbar as discussed here [Profiling your Website with Craft CMS 3’s Debug Toolbar](https://nystudio107.com/blog/profiling-your-website-with-craft-cms-3s-debug-toolbar)

You can use it to very quickly and easily see only errors, or only warnings, and so on. And then if the additional data that Craft logs is needed to help you diagnose a problem, it'll still be there.

To learn how to parse the Craft CMS log files quickly, check out the [Zen and the Art of Craft CMS Log File Reading](https://nystudio107.com/blog/zen-and-the-art-of-craft-cms-log-file-reading)

If you do end up wanting to make your own logger, check out the [Creating a Custom Logger for Craft CMS](https://nystudio107.com/blog/creating-a-custom-logger-for-craft-cms) article

> **Comments:**
> **username_0**: Ok thanks for the information. Leaving sensitive information such as access keys and password in logs is not acceptible in our case. But I know what you mean about removing logs. Generally for development isn't there an approach like in java/spring? In CraftCMS on production: sure log as much as possible, but otherwise i would want class/package specific log levels which help me accomplish my task and understand what is going on...  
> **username_1**: Passwords should already be sanitized in the logs, but sure, you can add a custom logger as described in the last link, and do whatever you like.  
> **username_0**: A custom logger is not really what I want to write. How come passwords are anyhow logged together with the whole $_SERVER, $_SESSION, $_COOKIE and other arrays? Any idea about that? I get those arrays for every single line of log I would want to actually read.  
> **username_0**: Added my found solution. Also note: Passwords are only sanitized as specified by the $maskVars variable in yii\log\Target::class. So that's why I anyhow saw a lot of sensitive information in the logs  

---

