Chapter 10: Logging, Monitoring & Incident Response

10.1.1 Transfer Lifecycle Events

• Create transfer (generate transferId)
• Upload chunk complete (logged at ciphertext level, not plaintext)
• Manifest write/update
• Expiration cleanup, user deletion/revocation (including cleanup task trigger & completion)
• Download start/complete (measured at ciphertext download level)

10.1.2 Authentication & Authorization Events

• Session token issuance, validation failure (scope mismatch, expired, revoked, etc.)
• Long-term login token validation failure (admin action denied)
• Suspicious access patterns: Anomalous spikes in 401/403/404

Note: Record "result & reason code" only. MUST NOT record token plaintext, Authorization header plaintext, or signature parameter plaintext.

10.1.3 System Health & Performance Metrics

• Request latency (p50/p95/p99), error rates, throughput
• Object storage read/write failure rates, origin fetch failure rates, retry counts
• Edge node anomalies, queue backlogs, background cleanup task success rates
• Bandwidth and traffic trends (aggregated dimensions)

10.1.4 Security Protection Events

• Rate limiting triggers, WAF/firewall rule hits
• Threshold triggers for suspected enumeration/brute-force behavior
• Anomalous concurrency and traffic patterns (high concurrency from same source, abnormal resource heat)

10.1.5 Aggregation & Sampling

• SHOULD: Aggregate counts and latency quantiles by minute/hour to reduce granular logs.
• SHOULD: Sample high-frequency successful requests, retaining necessary details only for errors and anomalous paths.
• SHOULD: Retain stable classification fields (e.g., eventType, reasonCode) for anomalous events to facilitate auditing and machine analysis.

10.2.1 Server-Side MUST NOT Record

• CEK (Content Encryption Key) and any derivable material
• URL fragment (#...), location.hash, and full URLs containing fragments
• Plaintext Content: File plaintext, preview content, decrypted chunks, or any plaintext summaries
• Sensitive Credential Plaintext: Session tokens, long-term tokens, Authorization header plaintext, signature field plaintext in signed URLs

If logging URLs is required for debugging: MUST sanitize (remove fragment; redact or remove sensitive queries) and enforce this at the code level (not relying on manual convention).

10.2.2 Client-Side MUST NOT Record

• Do not print location.href (may contain fragment) in production environments
• Do not include URLs with fragments, CEK, or noncePrefix in error reports
• Debug logs and dev tool outputs should be disabled or minimized by default

SHOULD: Encapsulate a unified log/report function on the frontend that performs URL sanitization and sensitive field filtering internally before outputting/reporting.

10.3.1 Availability & Performance Alerts

• Error Rate Alerts: Spikes in 5xx, abnormal rise in 4xx (distinguish auth failure from abuse)
• Latency Alerts: p95/p99 threshold breaches, regional origin fetch anomalies
• Storage Alerts: Rise in object storage write failures, read timeouts
• Cleanup Task Alerts: Expiration cleanup backlog, excessive delete task retries

10.3.2 Security Alerts

• Abnormal rise in rate limit hit rate
• High frequency 401/403/404 from same source, suspected enumeration/brute force
• Abnormal single-resource download bandwidth/concurrency, suspected traffic flooding or hotlinking
• Critical policy changes (e.g., WAF rules, CSP/header changes) should trigger change audits and alerts (if applicable)

10.3.3 Alert Governance

• SHOULD: Categorize alerts (P0/P1/P2) with rotation/escalation paths.
• SHOULD: Apply debounce/window aggregation to noisy metrics to avoid alert fatigue.
• SHOULD: Attach minimal diagnostic info (reason code, trend chart, affected region/route) to each alert, excluding sensitive data.

10.4.1 Common Anomaly Patterns

• Enumeration: Massive probing of transferId / resource paths in short time, spikes in 404/401/403.
• Brute Force: High frequency attempts on short codes/passwords/tokens, abnormal failure rate curve.
• Traffic Flooding: Abnormal bandwidth for single resource, massive concurrent connections from same source, repeated downloads.
• Protocol Anomalies: Irrational chunk order, duplicate uploads, frequent interrupt/retries, abnormal UA patterns.

10.4.2 Mitigation Strategies (Principles)

• SHOULD: Rate limiting, tiered banning, challenge mechanisms (if applicable), dynamic policies based on ASN/Region/Fingerprint.
• SHOULD: Adopt gentler strategies (e.g., delay, segmented throttling) for paths sensitive to false positives (normal users may download frequently).
• MUST: Retain auditable triggers (reason code, threshold category) for actions taken and provide support channels (if applicable).