- Issue created by @benjifisher
- Status changed to Needs review
about 2 months ago 8:05pm 19 July 2024 - π¬π§United Kingdom catch
Is the idea to only do this in syslog because dblog is ephemeral?
- π¬π§United Kingdom longwave UK
Apache and nginx still also log IP addresses by default. This data is often useful, accessible only by administrators (and in the syslog case is inaccessible from Drupal itself) and can't be recreated after the fact in the case of an incident, to me this is won't fix.
- πΊπΈUnited States benjifisher Boston area
Thanks for linking to the related issues.
Is the idea to only do this in syslog because dblog is ephemeral?
I admit I did not give it a lot of thought. I am setting up
syslog
for my current project, and I asked whether we should be logging IP addresses. I was told not to. If that is common advice, then we should change the default.Also, changing the default for
syslog
is easy. Adding an option to thedblog
module would be more work.I am not opposed to expanding the scope of this issue to include
dblog
.This data is often useful, ..., to me this is won't fix.
You may be right. Either way, it is easy to change the default. We just have to decide which use case is more common, and I think it makes sense to err on the side of less sophisticated site owners.
- Status changed to Needs work
about 1 month ago 1:15pm 1 August 2024 - πΊπΈUnited States smustgrave
So the open questions are
1. Should we not log the IP
2. Expand scope to dblogCan say personally on our projects logging IP has never been an issue but that might not be the standard.
Not sure if this needs architecture review?