Question

as titled.
in production code, what’s the log level when failing to validate request parameters or format ?

I confuse this puzzle base on two points:

(1) if I log it to error. I concern if one hacker to send too many error requests will cause our APP log two many error log.

(2) but if I log it to debug or lower levels. I concern I can’t track issue effectively due to in production app, log will be setted to warn.

So what’s my choose?

Answer 1

If its a validation failure due to no system error, but invalid input data, I would log as info or warning. If you have a problem such as a system exception, for example a db connection failure or a null pointer, then log error. Otherwise, an input validation isn’t necessarily constituted as an Error
and is a business-as-usual type of occurrence, hence Info level.

In the case of a hacker running a script over and over sending "too many requests", this may be categorized as a Denial-of-service attack. In this case you need to ensure your firewall software is set to filter those, and I wouldn’t worry about it in the app log.

Finally, if a hacker isn’t bombarding your system quite at the denial-of-service threshold, then you may need to write some logic to catch this kind of "bad validation" and log an error with a clear error message which you’ll know to look for, i.e. a special kind of error. One such example would be a sql injection attack, which form validation may catch (and some layer in your app must definitely catch).

Depending on the kind of logging framework that you use, you may be able to define your own error level or error category for this scenario.