# Ecommerce Logs and Auditability > Ecommerce application logs are structured records of events, errors and decisions created by the store's software. They capture what happened, when, which service was involved and enough context to investigate a problem or reconstruct a sequence of events — without storing passwords, secrets or full payment credentials. - Type: Merchant guide - Level: Intermediate - Reading time: About 7 minutes - Audience: Written for store owners, builders, and designers refining high-performance ecommerce stores. - Last updated: 2026-11-04 - Canonical page: https://academy.getzenbasket.com/merchant-questions/ecommerce-logs-and-auditability/ - Part of: [Merchant Questions](https://academy.getzenbasket.com/merchant-questions/) on ZenBasket Academy --- ## What you need to know ### What are ecommerce application logs? Ecommerce application logs are structured records of events, errors and decisions made by the store's software. They capture time, service, operation, result and enough safe context to investigate a problem without exposing passwords, secrets or full payment credentials. ### What is an audit log? An audit log records who did what, to which object, when and with what outcome or approved reason. It is used to verify important account and business actions such as refunds, permission changes and price updates. Audit logs should be protected from ordinary editing and record corrections as new events rather than overwriting old ones. ### Error logs vs audit logs: what's the difference? Error logs capture technical failures and exceptions to help diagnose and fix software problems. Audit logs capture intentional business or account actions for accountability and compliance. Both serve different audiences and have different retention needs. ### What should ecommerce error logs contain? Error logs should include time, environment, service, safe request or trace ID, operation, error class and relevant non-sensitive context. Never log passwords, secrets or full payment credentials. ### What should ecommerce audit logs contain? Audit logs should record actor, role or service, time, action, target, result and approved reason or change summary. Protect them from ordinary editing and record corrections as new events. ### How long should logs be retained? Retain logs for the shortest period that meets operational, security, contractual and legal needs. Set different policies for debug, error and audit data and confirm deletion and archival actually occur. ### Should application logs be stored in the main ecommerce database? Usually not. High-volume application logs can burden the transactional database and may become unavailable during the incident being diagnosed. Send them to a dedicated, access-controlled logging system. ### How do logs help diagnose failed orders and payments? Shared order, payment, request and trace IDs connect the customer action across services and show the final state of each attempt. Investigators can distinguish a lost response from a rejected or duplicated operation. ### A quick store check Take one failed order ID and confirm an authorized operator can reconstruct the timeline without exposing secrets or unnecessary personal data. --- ## Frequently asked questions ### Should logs contain full customer records? No. Record the minimum safe context and use protected identifiers to retrieve authorized detail when needed. ### Can audit logs be edited to correct a mistake? Preserve the original event and append a correction or reversal so the history remains trustworthy. --- ## Related learning path - **Ecommerce Monitoring and Observability** - **Ecommerce Backups and Recovery** - [ZenBasket Build Guide](https://help.getzenbasket.com/zenbasket-builder/)