5

I have heard that log files contains private data. How can I remove it and what files should I remove from them? Those are very long files so maybe if I know what to remove I can use a script or something else.

Any suggestions? Thanks.

2 Answers 2

4

Personally, I think people generally over-rate the concern for preserving "private" data when it comes to reporting crash data and such. But, there is a good reason for reviewing the data that you send to application developers.

It really would depend on who you are submitting these logs to and for what purpose.

Generally, as a first pass, personally, I would open the log file in a text editor(i.e. gedit) and do a search and replace for my hostname and change it to something non-descript.

Let's say that frank.askubuntu.com is in your logfiles (or perhaps your employer's domain name).

Go ahead and change the names to notfrank.dummycorp.com. for example.

The same goes for IP addresses. Change it to 1.1.1.1

Unless they are needed for specific troubleshooting purposes, there is no reason why you cannot obfuscate semi-identifiable, machine-specific data.

It really depends on who you are giving your logs to for review. If you are behind a home router, it doesn't really make a difference. Generally, if I have a support contract with a vendor, they are usually under NDA, so there is some legality covered there(YMMV, IANAL, etc ;)).

For example, here are a couple of my logs and no one here could cause any problems and I haven't scrubbed any data:

 3 Mar 28 08:05:03 abulafia snmpd[1812]: Connection from UDP: [192.168.1.7]:37483-       >[192.168.1.5]
 4 Mar 28 08:05:03 abulafia snmpd[1812]: Connection from UDP: [192.168.1.7]:42831-       >[192.168.1.5]
 5 Mar 28 08:05:03 abulafia snmpd[1812]: Connection from UDP: [192.168.1.7]:46591-       >[192.168.1.5]

Personally, I have no qualms sending data like this to Canonical or Launchpad developers. That stance may/would differ if I was in non-residential environment.

If an application is built reasonably, there should be no reason to send personally identifiable data(PII) to them.

If you trusted the software developers enough to install their application, it seems reasonable that you should be comfortable with sending them the crash data to debug your/their problem.

2

You copy them to your homedir, then open the copies with a text editor and delete/replace things that look sensitive.

Check for passwords and usernames for instance, or mountpoints of external disks. There's no 'rule' as to what's sensitive, that's very subjective and up to you. For instance, I looked at the current contents of those files on my system and would post them without deleting anything.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .