Logs

Ronne writes one line per event to its standard output, as JSON: when it happened, how serious, what happened, and the request it belongs to. Where that output goes depends on how Ronne runs:

A line looks like this:

{"time":"2026-10-14T14:03:22.417Z","level":"info","msg":"Released","domain":"submissions","event":"version.released","requestId":"01K7…","userId":"01J9…","count":3}

• Always: time (UTC), level and msg, a short sentence that never changes.
• When they apply: event, a stable name to search and alert on; domain, the part of Ronne that wrote it; requestId, the request it belongs to; userId, who made it (an id, never an email or a name); err, an error's name, message and code, with its stack at error; with tracing on, traceId and spanId, the span it was written in (Monitoring).
• The event's own fields: numbers, counts and short reasons, such as status or count.
• Better Auth's own lines (sign-in's library): msg is Better Auth, with source and its text in detail.

LOG_LEVEL (debug, info, warn or error; info by default) sets the least serious lines written: warn is what someone should look at, error a failure, and debug adds detail nobody needs day to day. An unknown value writes one warning and uses info. LOG_FORMAT is json, or text for a person reading a terminal (the default with pnpm dev). Set either in the settings file or the environment (with Docker, in the .env file next to compose.yaml, then docker compose up -d), and restart Ronne.

The events:

Never in a line: passwords, access tokens, cookies, AUTH_SECRET, a database's password, emails, people's IP addresses, or the names of items, scopes and workspaces (a private workspace's names stay private). Ronne doesn't write them, and the logger also takes out what could slip in, error messages included: fields named like a secret, access tokens, passwords in addresses, emails, the paths of stored files, and the value a database quotes in a duplicate-key error. Next.js also prints an unexpected error itself, as plain text next to Ronne's line: that text is Next.js's own, outside Ronne's logger. So is the error Better Auth (sign-in's library) prints when the database itself fails mid-request.

Reporting a problem: every page and API response carries an X-Request-Id header, and the API's message for an unexpected error names it. Quote it, and whoever runs the instance finds that request's lines by their requestId. Behind a proxy that sets its own X-Request-Id, Ronne keeps it when TRUST_PROXY=true, so one ID follows the request through.