Overview
Smile CDR has several logging mechanisms that each serve distinct purposes. These mechanisms are described in the table below.
| Log | Purpose | Retention | Information Disclosure |
|---|---|---|---|
| Audit Log | The audit log is intended to record actions taken by users. |
By default, audit logs are retained indefinitely.
|
Audit logs may contain resource IDs and accessing user details (username, IP address, etc.) but will not contain FHIR resource bodies or search parameters. |
| Transaction Log | The transaction log is intended to record requests/responses/messages that are received and processed by the system, as well as messages that are generated and transmitted by the system. | By default, transaction logs are deleted automatically by the system after 90 days. This can be modified. See the Transaction Log page for more details. | Transaction logs may be configured to include request and response bodies which may contain Protected Health Information (PHI). Access can be controlled by user permissions. |
| System Logging |
System Logging is a traditional file based log of events and internal processing
details of Smile CDR. These logs are useful for troubleshooting. System logs can be enabled and disabled at runtime by modifying
the Logback configuration file.
In addition, several Troubleshooting Logs can also be enabled and disabled at runtime in order to diagnose specific issues. |
System Logging is configured by default to use several files for specific purposes, and each of these files has a configurable retention period. See the System Logging page for more details. | At the default logging level and above (INFO, WARN, ERROR), system logs will log resource IDs but will not log FHIR resource bodies or search parameters. When configured at debug levels (DEBUG or TRACE), resource bodies may be logged so this level should not be used if you do not want PHI in system logs. |