---
checkId: check.observability.logging
plugin: stellaops.doctor.observability
severity: warn
tags: [observability, logging, structured-logs]
---
# Logging Configuration

## What It Checks
Reads default and framework log levels and looks for structured logging via `Logging:Structured`, JSON console formatting, or a `Serilog` configuration section.

The check warns when default logging is `Debug` or `Trace`, when Microsoft categories are too verbose, or when structured logging is missing.

## Why It Matters
Unstructured logs slow incident response and make exports difficult to analyze. Overly verbose framework logging also drives storage growth and noise.

## Common Causes
- Only the default ASP.NET console logger is configured
- `Logging:Structured` or `Serilog` settings were omitted from compose values
- Troubleshooting log levels were left enabled in production

## How to Fix

### Docker Compose
```yaml
services:
  doctor-web:
    environment:
      Logging__LogLevel__Default: Information
      Logging__LogLevel__Microsoft: Warning
      Logging__Structured: "true"
```

If Serilog is used, make sure the console sink emits JSON or another structured format that downstream tooling can parse.

### Bare Metal / systemd
Keep framework namespaces at `Warning` or stricter unless you are collecting short-lived debugging evidence.

### Kubernetes / Helm
Ensure log collectors expect the same output format the application emits.

## Verification
```bash
stella doctor --check check.observability.logging
```

## Related Checks
- `check.observability.alerting` - alerting often relies on structured log pipelines
- `check.security.audit.logging` - audit logs should follow the same transport and retention standards