---
title: "Automatic Logging for Faster, Secure Debugging"
url: https://daily.dev/posts/automatic-logging-for-faster-secure-debugging-b311qrb3y
source_url: https://www.pulumi.com/blog/automatic-logging
type: article
source: "Pulumi"
published: 2026-08-10T14:44:47.257Z
updated: 2026-08-10T14:45:09.490Z
tags: ["logging", "encryption", "iac", "pulumi"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Automatic Logging for Faster, Secure Debugging

**[Pulumi](https://daily.dev/sources/pulumi)** · 3 min read · 0 upvotes · 0 comments

## Summary

Pulumi v3.254.0 introduces automatic encrypted logging for every operation. Logs are stored in `$PULUMI_HOME/logs`, encrypted with AES256-GCM using the stack's secret manager when available, and automatically rotated after 7 days or when the directory exceeds 500 MB. A new `pulumi logs share` command lets users securely re-encrypt and share logs with Pulumi support staff, with secrets redacted by default, eliminating the need to reproduce errors just to capture debug logs.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.pulumi.com/blog/automatic-logging>

## Questions this post answers

### How does Pulumi automatic logging work in v3.254.0 and where are logs stored?

From Pulumi v3.254.0, every operation automatically produces a log file stored in `$PULUMI_HOME/logs`. Logs are encrypted on disk using AES256-GCM via the stack's secret manager when available, or gzip-compressed when no secrets manager is present. Logs rotate after 7 days or when the directory reaches 500 MB, configurable via `PULUMI_LOG_ROTATION_MAX_AGE_DAYS` and `PULUMI_LOG_ROTATION_MAX_TOTAL_MB` environment variables.

_Teams troubleshooting Pulumi infrastructure issues track release changes like these on daily.dev._

### How do I securely share Pulumi debug logs with the Pulumi support team?

Use the `pulumi logs share` command introduced in Pulumi v3.254.0. It automatically generates a key stored server-side, re-encrypts the log with AES256-GCM, and redacts all secrets by default. Only Pulumi employees can access the key via an internal tool to decrypt the log, making it safe to share even over public channels like a GitHub issue.

_Engineers shipping Pulumi-managed infrastructure keep up with tooling changes like this on daily.dev._

## Similar posts on daily.dev

- [Now GA: Up to 20x Faster Pulumi Operations for Everyone](https://daily.dev/posts/now-ga-up-to-20x-faster-pulumi-operations-for-everyone-igreuq5ig) · Pulumi · 1 upvotes · 0 comments
- [Speeding up Pulumi Operations by up to 20x](https://daily.dev/posts/speeding-up-pulumi-operations-by-up-to-20x-cxlassy81) · Pulumi · 3 upvotes · 0 comments
- [Heroku logs: A complete guide for developers](https://daily.dev/posts/heroku-logs-a-complete-guide-for-developers-ctuuwonqf) · Honeybadger · 0 upvotes · 0 comments

---

Tags: [#logging](https://daily.dev/tags/logging), [#encryption](https://daily.dev/tags/encryption), [#iac](https://daily.dev/tags/iac), [#pulumi](https://daily.dev/tags/pulumi)

[View this post on daily.dev](https://daily.dev/posts/automatic-logging-for-faster-secure-debugging-b311qrb3y)