.NET logging best practices

public class OrderService
{
    private readonly ILogger<OrderService> _logger;

    public OrderService(ILogger<OrderService> logger)
    {
        _logger = logger;
    }

    public async Task ProcessAsync(OrderRequest request)
    {
        _logger.LogInformation("Processing order {OrderId} for customer {CustomerId}", 
            request.OrderId, request.CustomerId);
        // business logic
    }
}

// Program.cs
var builder = WebApplication.CreateBuilder(args);

builder.Host.UseSerilog((context, config) =>
{
    config
        .ReadFrom.Configuration(context.Configuration)
        .Enrich.FromLogContext()
        .Enrich.WithMachineName()
        .Enrich.WithEnvironmentName()
        .WriteTo.Console(outputTemplate: "[{Timestamp:HH:mm:ss} {Level:u3}] {SourceContext}: {Message:lj}{NewLine}{Exception}")
        .WriteTo.Seq("http://localhost:5341")
        .WriteTo.File(
            path: "logs/app-.log",
            rollingInterval: RollingInterval.Day,
            outputTemplate: "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level:u3}] {SourceContext} | {Message:lj}{NewLine}{Exception}");
});

var app = builder.Build();

{
  "Serilog": {
    "Using": [ "Serilog.Sinks.Console", "Serilog.Sinks.Seq", "Serilog.Sinks.File" ],
    "MinimumLevel": {
      "Default": "Information",
      "Override": {
        "Microsoft": "Warning",
        "Microsoft.H

osting.Lifetime": "Information", "System.Net.Http": "Warning", "MyApp.Domain": "Debug" } } } }

### 4. Enrich with Contextual Properties
Logs are useless without correlation. Attach request IDs, user contexts, and business identifiers using `LogContext.PushProperty` or middleware.

```csharp
// Middleware for correlation ID
public class CorrelationIdMiddleware
{
    private readonly RequestDelegate _next;
    public CorrelationIdMiddleware(RequestDelegate next) => _next = next;

    public async Task Invoke(HttpContext context, ILogger<CorrelationIdMiddleware> logger)
    {
        var correlationId = context.Request.Headers["X-Correlation-ID"].ToString() 
            ?? Guid.NewGuid().ToString("N");
        
        context.Response.Headers["X-Correlation-ID"] = correlationId;
        
        using (LogContext.PushProperty("CorrelationId", correlationId))
        {
            await _next(context);
        }
    }
}

5. Route to Async/Buffered Sinks

Synchronous logging blocks request threads. Use buffered sinks with flush intervals to decouple application throughput from I/O latency.

.WriteTo.Async(a => a.File(
    path: "logs/app-.log",
    rollingInterval: RollingInterval.Day,
    buffered: true,
    flushToDiskInterval: TimeSpan.FromSeconds(15)
));

Architecture Decisions & Rationale

• Abstraction vs Implementation: ILogger<T> remains the application boundary. Serilog is configured at the composition root. This preserves testability and allows sink swaps without modifying business logic.
• Message Templates Over Interpolation: {OrderId} creates a discrete property. $"Order {OrderId}" creates a single string. Templates enable indexing, grouping, and alerting on specific fields.
• Async Buffering: Decouples logging I/O from request processing. Flush intervals balance durability against latency. For compliance-heavy workloads, synchronous fallback sinks with retry policies should be added.
• Context Enrichment: Correlation IDs, tenant IDs, and user claims must flow through AsyncLocal or LogContext to maintain traceability across service boundaries.

Pitfall Guide

1. String Interpolation in Log Messages

Mistake: _logger.LogInformation($"Order {orderId} processed"); Impact: Destroys structured logging. The provider receives "Order 12345 processed" as a single string. Indexers cannot extract orderId for filtering or aggregation. Alerting on specific order patterns becomes impossible. Best Practice: Always use message templates: _logger.LogInformation("Order {OrderId} processed", orderId);

2. Logging PII or Secrets

Mistake: Logging raw tokens, passwords, email addresses, or credit card fragments. Impact: Compliance violations (GDPR, PCI-DSS), security exposure in log aggregators, and potential data breach liabilities. Best Practice: Implement a custom ITextFormatter or use Serilog's Destructure.With<RedactionPolicy>() to mask sensitive fields. Never log raw authentication tokens or cryptographic material.

3. Synchronous Blocking Sinks Under Load

Mistake: Writing directly to disk or network sinks without buffering. Impact: Thread pool starvation, increased p99 latency, and potential request timeouts during log volume spikes. Best Practice: Wrap all file/network sinks in .WriteTo.Async(). Configure flushToDiskInterval and bufferSizeLimit. Monitor sink latency separately from application metrics.

4. Missing Correlation Context

Mistake: Logs lack request IDs, tenant context, or user identifiers. Impact: Impossible to reconstruct execution flow across microservices or async operations. Debugging requires manual log grep across multiple files. Best Practice: Inject correlation ID middleware. Use LogContext.PushProperty for business context. Ensure HTTP clients propagate headers (traceparent, correlation-id).

5. Over-Logging in Production

Mistake: Running LogLevel.Debug or Trace in production environments. Impact: Exponential log volume growth, storage cost inflation, and signal-to-noise ratio degradation. Critical events get buried. Best Practice: Default production to Information or Warning. Use dynamic configuration providers (Azure App Configuration, Consul) to enable debug logging per-request or per-tenant during incidents.

6. Ignoring Log Level Hierarchy & Override Rules

Mistake: Setting a single global log level without framework overrides. Impact: Noisy framework logs (Entity Framework, HttpClient, ASP.NET Core routing) drown out application signals. Best Practice: Use MinimumLevel.Override to silence noisy third-party categories. Keep application namespaces at higher verbosity for debugging.

7. Treating Logs as the Sole Observability Pillar

Mistake: Relying exclusively on logs for performance monitoring and alerting. Impact: Logs are high-cardinality, expensive to query in real-time, and lack histogram/percentile capabilities. Best Practice: Pair structured logging with OpenTelemetry metrics and distributed traces. Use logs for root-cause analysis, metrics for SLO tracking, and traces for latency breakdowns.

Production Bundle

Action Checklist

• Replace all string-interpolated log calls with structured message templates using {PropertyName} syntax
• Configure MinimumLevel and Override rules in appsettings.json to silence noisy framework categories
• Wrap all file and network sinks in .WriteTo.Async() with explicit flush intervals and buffer limits
• Implement correlation ID propagation via middleware and HTTP client handlers
• Add a PII redaction policy or custom destructuring rule before deploying to production
• Validate log volume and ingestion costs using a staging environment with production-like traffic
• Integrate OpenTelemetry metrics/traces alongside structured logs for complete observability coverage

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
High-throughput microservices	Async buffered Serilog + Seq/Datadog sink	Prevents thread pool starvation, enables fast property-based querying	Reduces storage by 40-60%, maintains p99 latency
Monolith with compliance requirements	Structured logging + synchronous fallback sink + PII redaction	Ensures audit trail durability while masking sensitive data	Increases storage cost 15-20% due to retention policies
Multi-tenant SaaS application	Tenant ID enrichment + per-tenant log routing + dynamic level override	Enables tenant isolation, debugging, and cost allocation	Moderate increase in ingestion complexity, lowers support MTTR by 50%
Legacy .NET Framework migration	Microsoft.Extensions.Logging abstraction + Serilog.Enrichers.Process	Maintains DI compatibility, enables gradual modernization without rewrite	Low migration cost, immediate observability improvement

Configuration Template

appsettings.json

{
  "Serilog": {
    "Using": [ "Serilog.Sinks.Console", "Serilog.Sinks.Seq", "Serilog.Sinks.File" ],
    "MinimumLevel": {
      "Default": "Information",
      "Override": {
        "Microsoft": "Warning",
        "Microsoft.Hosting.Lifetime": "Information",
        "System.Net.Http": "Warning",
        "MyApp": "Debug"
      }
    },
    "Enrich": [ "FromLogContext", "WithMachineName", "WithEnvironmentName" ],
    "WriteTo": [
      { "Name": "Console", "Args": { "outputTemplate": "[{Timestamp:HH:mm:ss} {Level:u3}] {SourceContext}: {Message:lj}{NewLine}{Exception}" } },
      { 
        "Name": "Seq", 
        "Args": { "serverUrl": "http://seq:5341", "apiKey": "" } 
      },
      {
        "Name": "Async",
        "Args": {
          "configure": [
            {
              "Name": "File",
              "Args": {
                "path": "logs/app-.log",
                "rollingInterval": "Day",
                "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level:u3}] {SourceContext} | {Message:lj}{NewLine}{Exception}",
                "buffered": true,
                "flushToDiskInterval": "00:00:15"
              }
            }
          ]
        }
      }
    ]
  }
}

Program.cs (Minimal Setup)

using Serilog;

var builder = WebApplication.CreateBuilder(args);

builder.Host.UseSerilog((context, config) =>
    config.ReadFrom.Configuration(context.Configuration));

var app = builder.Build();

app.UseSerilogRequestLogging();
app.UseMiddleware<CorrelationIdMiddleware>();

app.MapGet("/test", (ILogger<Program> logger) =>
{
    logger.LogInformation("Test endpoint invoked at {Timestamp}", DateTimeOffset.UtcNow);
    return Results.Ok();
});

app.Run();

Quick Start Guide

1. Install packages: dotnet add package Serilog.AspNetCore Serilog.Sinks.Seq Serilog.Sinks.Console Serilog.Sinks.File
2. Add configuration: Place the appsettings.json template in your project root. Adjust sink URLs and API keys for your environment.
3. Wire up in Program.cs: Replace builder.Host.UseSerilog(...) with the template code. Ensure UseSerilogRequestLogging() and correlation middleware are registered before app.Run().
4. Validate: Run the application, trigger a few requests, and verify structured properties appear in Seq or console output. Confirm no string-interpolated logs remain in your codebase using a regex search or Roslyn analyzer.