Production Checklist

Before going live, check each of the following security configurations to ensure the logging system is secure and reliable.

Basic Configuration

• [ ] Log level -- Set to LevelInfo or higher in production
• [ ] Output format -- Use FormatJSON for easier log collection and analysis
• [ ] File rotation -- Configure reasonable size limits and retention policies
• [ ] Buffer flushing -- Ensure Flush() or Close() is called before program exit

logger, _ := dd.New(dd.Config{
    Level:  dd.LevelInfo,
    Format: dd.FormatJSON,
})
defer logger.Close()

Security Filtering

• [ ] Enable sensitive-data filtering -- Use DefaultSecurityConfig() or higher
• [ ] Custom patterns -- Add business-specific sensitive-field patterns
• [ ] Filter-statistics monitoring -- Periodically check filter stats to spot anomalies

logger.SetSecurityConfig(dd.DefaultSecurityConfig())

File Security

• [ ] Log permissions -- File mode 0600, directory mode 0700 (library defaults; directories need the execute bit to be enterable)
• [ ] Path validation -- Ensure log paths are not controllable by user input
• [ ] Symlinks -- Forbid symlinks in production
• [ ] Disk space -- Configure a rotation policy to prevent filling the disk

Audit & Integrity

• [ ] Audit logging -- Enable audit logging to record security events
• [ ] Integrity signing -- Enable HMAC signing to ensure logs are tamper-evident
• [ ] Audit-log separation -- Store audit logs separately from business logs

audit, _ := dd.NewAuditLogger(dd.DefaultAuditConfig())
defer audit.Close()

cfg, _ := dd.DefaultIntegrityConfigSafe()
signer, _ := dd.NewIntegritySigner(cfg)

Performance

• [ ] Sampling strategy -- Consider enabling log sampling for high-throughput scenarios
• [ ] Buffered writes -- Use BufferedWriter to reduce I/O count
• [ ] Synchronous-write awareness -- The default write path is synchronous; use BufferedWriter for high-throughput scenarios to reduce syscalls
• [ ] Memory monitoring -- Monitor logging-related memory usage

Lifecycle

• [ ] Graceful shutdown -- Use Shutdown(ctx) instead of Close() (note: Shutdown does not internally wait for filter goroutines, while Close calls WaitForFilterGoroutines; before switching, explicitly call logger.WaitForFilterGoroutines(...) to avoid races where filter goroutines still access a closed writer)
• [ ] Timeout settings -- Set a reasonable shutdown timeout (5-10 seconds recommended)
• [ ] Global logger -- Replace via SetDefault() rather than re-creating repeatedly

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
logger.Shutdown(ctx)

Compliance Checks

• [ ] HIPAA -- Use HealthcareConfig() for the medical industry
• [ ] PCI-DSS -- Use FinancialConfig() for the financial industry
• [ ] GDPR -- Ensure no Personally Identifiable Information (PII) is logged
• [ ] Data retention -- Configure log retention periods compliant with regulations

Monitoring & Alerting

• [ ] Write errors -- Configure SetWriteErrorHandler to monitor write failures
• [ ] Filter goroutines -- Monitor ActiveFilterGoroutines() count
• [ ] Audit statistics -- Periodically check audit-event statistics
• [ ] Error-code alerting -- Alert on security error codes such as PATH_TRAVERSAL, REDOS_PATTERN

logger.SetWriteErrorHandler(func(w io.Writer, err error) {
    metrics.WriteErrors.Inc()
    alert("log write failed: " + err.Error())
})

Next Steps

• Security Overview -- Security feature overview
• Security Filtering API -- Configuration reference
• Performance Tuning -- Performance tuning