This document was generated from CDN thread
Created by: Janine Graves on 21-05-2008 03:40:22 AM
customer is worried about account numbers showing up in the error log when something goes wrong (like a say it smart error, or some other unexpected java runtime error).
I know how to disable logging of sensitive data in the activity log, but is there any way to disable logging of sensitive data from showing up in the error log?
If not, what would you recommend for companies where this is a security issue?
Thanks, Janine
Subject: RE: disable error logging?
Replied by: null on 22-05-2008 03:59:53 PM
Hi Janine,
Could you post more detailed information about the sensitive data logging from showing up in the error log?
Regards,
Hong
Subject: RE: disable error logging?
Replied by: Vance Vagell on 30-05-2008 05:20:57 PM
Hi Janine,
The biggest issue with sensitive data tends to be recognition information from the ASR engine (e.g., "the caller said 9238"). The new activity log censoring addresses this concern.
However, it's less clear which sensitive data would appear in an error log. Do you have an example from an error log that we might be able to provide suggestions for?
Regards,
Vance
Subject: RE: disable error logging?
Replied by: Janine Graves on 03-06-2008 01:29:25 AM
Student had a problem with say it smart. what we saw in the error log was 'data passed as input was "12341234" ' This was after we disabled data/interaction logging from the Activity Log - so the customer was concerned about this appearing if it was a customers SSN or something like that.
It's not a huge issue as I'd hope SIS errors would be caught during testing. But just wondering.
Janine
Subject: RE: disable error logging?
Replied by: Vance Vagell on 03-06-2008 01:58:57 PM
Hi Janine,
Thanks for the example.
The best bet in this case would be for your student to disable the default Error logger (this can be done in the project's properties in Call Studio), and create a custom Error logger that scrubs the output as desired. A simple approach might be to just censor all digit characters before writing them to the log, with something like "X".
Custom loggers have been available since Call Services 3.6, and VXML Server 4.0.
Regards,
Vance
