How to Mask IP Addresses, URLs, and Credentials Before Sharing Logs

Sensitive information likely to be included in logs

• Source/destination IP address, internal host name, port number
• Customer number included in URL path or query string
• Authorization, Cookie, Session ID, JWT
• Email address, user name, device name, file path
• Package names and internal class names in stack traces

Masking While Preserving Diagnostic Value

The time, log level, thread, processing order, HTTP status, and exception type are useful for investigating the cause. If you replace the same value with the same alternative value without deleting everything, you can follow the same user or process flow.

1. Extract only the lines related to the required time period and event.
2. Choose your log format and mask IPs, URLs, identifiers, values, and comments.
3. Check the multi-line stack trace and JSON embedding.
4. Perform a full-text search for proper nouns and identifiers contained in the original data, and visually check to see if anything has been left behind.

Handling Timestamps and Record Counts

If you don't want to reveal the exact time of occurrence, you can add the same time difference to all rows and leave only the interval. For large logs, check not only the first few lines but also the end and rotated files.

Even if you mask a log, the access privileges of the original log and the retention period at the shared destination will not change. Prioritize your organization's log handling rules.