How to Mask IP Addresses, URLs, and Credentials Before Sharing Logs

Sensitive information likely to be included in logs

• Source/destination IP address, internal host name, port number
• Customer number included in URL path or query string
• Authorization, Cookie, Session ID, JWT
• Email address, user name, device name, file path
• Package names and internal class names in stack traces

Masking While Preserving Diagnostic Value

The time, log level, thread, processing order, HTTP status, and exception type are useful for investigating the cause. If you replace the same value with the same alternative value without deleting everything, you can follow the same user or process flow.

1. Extract only the lines related to the required time period and event.
2. Choose your log format and mask IPs, URLs, identifiers, values, and comments.
3. Check the multi-line stack trace and JSON embedding.
4. Perform a full-text search for proper nouns and identifiers contained in the original data, and visually check to see if anything has been left behind.

Handling Timestamps and Record Counts

If you don't want to reveal the exact time of occurrence, you can add the same time difference to all rows and leave only the interval. For large logs, check not only the first few lines but also the end and rotated files.

Even if you mask a log, the access privileges of the original log and the retention period at the shared destination will not change. Prioritize your organization's log handling rules.

Specific example: Sharing access logs for authentication errors

Authentication error logs may place the source IP, user ID, session ID, request URL, and User-Agent on the same line. Preserve correlation across nearby lines while replacing values that could identify a person or environment.

If the same session ID is changed to a different value every time, logs cannot be followed chronologically. Preserve the mapping between original and masked values to retain traceability across multiple lines.

1. Extract only the period around the investigation time.
2. Check IP, URL query, cookies, Authorization, email address, hostname.
3. Choose a log format, maintain correspondence of identical values, and mask.
4. Also check the stack trace, SQL, and embedded JSON to see if any actual values remain.

If the password or access token is being output to the log, please not only replace it before sharing but also modify the log output settings themselves.

Frequently asked questions

Can I leave a timestamp?

Although useful for fault investigation, work status and usage times may be confidential. Add a certain amount of time if necessary, keeping only the spacing between lines.

Can I anonymize by hiding only the end of the IP address?

Depending on the use case, it may be inferred in combination with other information. If the scope of disclosure is broad, replacing it with a dummy IP while preserving only the mapping to the original value is safer.