Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am creating a website where users can have anonymous discussions about personal topics. In order to protect our users, I would like to avoid keeping Apache logs. This way, even if the website is hacked, everyone will still remain anonymous.

Is it legal to not keep any logs?

share|improve this question

closed as too localized by squillman, Chopper3 Feb 28 '11 at 16:20

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
I would ask a lawyer for that kind of info. One based wherever you host the server, I imagine. But then, I'm not a lawyer.... –  Holocryptic Feb 28 '11 at 15:52
    
By the way, if the server is "hacked", there's nothing stopping an attacker from creating logs of connections. They just wouldn't get information up to that point, and if your users have logins they could still get access to your database for other data to mine... –  Bart Silverstrim Feb 28 '11 at 16:00
3  
What country is this for? –  Brian Carlton Feb 28 '11 at 16:07
add comment

3 Answers

up vote 1 down vote accepted

to my knowledge for the UK the answer is that it is fully legal not to retain logs (assuming your not in financial sector etc)

on the flip side however, it may be considered breach of the Data Protection Act to keep them beyond a reasonable time

be aware that without logging if there are application problems you wont be able to track down errors as easily

share|improve this answer
    
We're using Django and all application errors are emailed to the dev team. –  Natan Yellin Feb 28 '11 at 15:55
add comment

As a general statement what you log is pretty much up to you, however you should definitely consult an attorney if you have any questions. You may also want to have a written policy regarding logging & stick to it, otherwise if some government goons come to you seeking logs it may be difficult to convince them you don't have them / never kept them.


The legality of retaining logs varies based on
(a) What you are logging,
(b) Where you are, and
(c) What you do.

For example, in the Great State of New York it is perfectly legal for me not to keep server logs of any kind (Where we are). However my company is required by US Federal Law to retain certain logs (access to healthcare information -- What we do).

Similarly some places may ostensibly make it ILLEGAL to keep server logs -- In the Great State of Pennsylvania there are some pretty strict laws about recording conversations (wiretap), so if your intent is to record every interactive session you could conceivably run afoul of that law.

share|improve this answer
add comment

It is legal, unless you are governed by something like USDA etc... which may require a retention period for things like logs, and email. There are plenty of traffic logs behind your own server to satisfy whatever party may want them.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.