We recommend the main correlator, IAF and dashboard server log level to always be set to INFO. If it is set to WARN or higher, then security-relevant events will not be recorded and diagnosing failures can be difficult. But if it is set to DEBUG or lower, then there will be a significant performance impact and security-sensitive information will likely be written to the logs.

For similar reasons (as well as to avoid performance problems), it is important not to go into production with diagnostic logging of input/output messages enabled. For example, do not enable the Diagnostic codec connectivity plug-in or set logJmsMessages to true, except for non-production testing when there is no real personal data present in the messages.