Skip to main content
Version: 1.4.0

Redacting Sensitive Data from Logs

When you need to share SAFE debug logs with support or a colleague, the safe redact-logs command lets you remove sensitive information before sending the file. The original log is never modified — a new .redacted copy is written alongside it.

Quick Start​

safe redact-logs --log-file ./debug.log --paths --fingerprint

This reads ./debug.log, strips all file-system paths and project fingerprints, and writes the result to ./debug.log.redacted.

Usage​

safe redact-logs --log-file PATH
                 [--paths] [--system-output] [--fingerprint]
                 [--app-name] [--analysis]

If --log-file is omitted, SAFE checks the logger configuration for a known log location and asks whether to use it.

Arguments​

Optional:

  • --log-file PATH
    Path to the SAFE debug log to process. If not provided, SAFE looks for a configured log file and prompts you to confirm.

  • --paths
    Redact file-system paths (project root, build artefact paths, source file locations, etc.).

  • --system-output
    Redact the output of external commands run during analysis (e.g. rebar3 compile output).

  • --fingerprint
    Redact project fingerprints used by the licensing system.

  • --app-name
    Redact OTP application names detected in your project.

  • --analysis
    Redact raw output from SAFE's analysis engine (may contain source-level details).

You can combine any number of flags. Only the selected categories are redacted — everything else is left intact so the log remains as useful as possible for diagnosis.

Examples​

Redact paths only:

safe redact-logs --log-file ./debug.log --paths

Redact paths and fingerprints (recommended when sharing with support):

safe redact-logs --log-file ./debug.log --paths --fingerprint

Redact everything:

safe redact-logs --log-file ./debug.log --paths --system-output --fingerprint --app-name --analysis

Let SAFE detect the log file automatically:

safe redact-logs --paths --fingerprint
# SAFE log file not provided, but found one in: /var/log/safe/debug.log.
# Would you like to use it? [Yn]:

Output​

A .redacted file is written next to the original:

./debug.log          ← unchanged
./debug.log.redacted ← redacted copy

Each redacted value is replaced with a labelled placeholder, so you can still tell what kind of data was removed:

Original log lineAfter redaction
Adding file: "/home/user/project/ebin/app.beam"Adding file: <REDACTED_PATH>
Fingerprint: KOt0tW5Y+Ho=Fingerprint: <REDACTED_FINGERPRINT>
Result: "===> Compiling cowboy\n"Result: <REDACTED_SYSTEM_OUTPUT>

If a log line was truncated mid-tag (e.g. due to a logging limit), the placeholder is prefixed with INTERRUPTED_ to flag the anomaly without leaking data:

Adding file: <INTERRUPTED_REDACTED_PATH>

Exit Codes​

CodeMeaning
0Redaction completed successfully
1An error occurred (invalid argument, file not found, write failure)

Getting Help​

safe redact-logs help

Contents