Forward Deployed Engineering Tutorial · Deploying in Customer Environments · Lesson 17 of 24
Observability, Support and Handover
Operate deployments you don't fully control: logs without customer data, health checks, runbooks and a clean handover to support.
Log safely
Logs help you debug; they also leak data. Log identifiers and metadata, not payloads; redact personal data and secrets before logs leave the process; agree with the customer what telemetry may leave their environment.
import re
PATTERNS = [(re.compile(r"[\w.+-]+@[\w-]+\.[\w.]+"), "<email>"),
(re.compile(r"\b\d{4}[ -]?\d{4}[ -]?\d{4}[ -]?\d{4}\b"), "<card>"),
(re.compile(r"(?i)(authorization: bearer )\S+"), r"\1<token>")]
def redact(line):
for pattern, replacement in PATTERNS:
line = pattern.sub(replacement, line)
return line
logs = ["sync failed for [email protected]: card 4111 1111 1111 1111 declined",
"request headers: Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.abc"]
for line in logs:
print(redact(line))
Output
sync failed for <email>: card <card> declined request headers: Authorization: Bearer <token>
Make problems visible
- Health endpoints and a status page in the product (last successful sync, records processed, errors).
- Alerts to both your team and the customer's owner for failures they must act on (expired credentials).
- A diagnostics bundle command for environments you can't access.
Handover
Before you move on: runbook (what can fail, how to check, how to fix), ownership (who's on call, who to escalate to), documentation of the integration and its configuration, and a support walkthrough.
Test yourself
What should integration logs contain?
Full request and response bodiesIdentifiers and metadata, with personal data and secrets redactedPasswords for debuggingNothing at all
Show answer
Answer: Identifiers and metadata, with personal data and secrets redacted
Logs travel further than you think; keep them useful but safe.