Any reason that OpenIddict logging isn't set to "Warning" by default Umbraco installs? when running locally (and on a server i don't know). you just get a load of junk in the logs about tokens etc, that 99% of the time you don't need to know anything about.

I think

app.UseSerilogRequestLogging

should be the default for reduced log verbosity full stop! https://github.com/serilog/serilog-aspnetcore#request-logging https://andrewlock.net/using-serilog-aspnetcore-in-asp-net-core-3-reducing-log-verbosity/

public class SerilogRequestLoggingComposer : IComposer
{
    // can move to prePipeline if we want to log static files.
    // in 13.1.1 can move to preRouting for just after static files 
    // postPipeline then although OnExecuting fires, we don't see the logs
    public void Compose(IUmbracoBuilder builder)
    {
        builder.Services.AddControllers(opts => opts.Filters.Add<SerilogLoggingActionFilter>());
        builder.Services.Configure<UmbracoPipelineOptions>(options =>
            options.AddFilter(
                new UmbracoPipelineFilter("SerilogRequestLogging",
                    preRouting: app => app.UseSerilogRequestLogging(opt =>
                    {
                        opt.EnrichDiagnosticContext = LRequestLoggingOptions.EnrichFromRequest;

                        opt.GetLevel = (httpContext, elapsed, ex) =>
                        {
                            // If there's an error, we probably still want to see it
                            if (ex != null || httpContext.Response.StatusCode >= 400)
                                return Serilog.Events.LogEventLevel.Error;

                            // Silence Umbraco backoffice and management API calls
                            var path = httpContext.Request.Path.Value;
                            if (path != null && path.StartsWith("/umbraco", StringComparison.OrdinalIgnoreCase))
                            {
                                return Serilog.Events.LogEventLevel.Verbose;
                            }

                            return Serilog.Events.LogEventLevel.Information;
                        };
                    }),
                        endpoints: null)
                )
            );
    }
}

yeah - but without adding all the extra code (which if fine, but guess is they want to keep it simple/clean) is there a reason why "OpenIddict" : "Warning" isn't just set in the appsettings.json file ?

Had a quick play.. and you don't get a user logged in log entry if you set "OpenIddict" : "Warning", but you do get a user logged out.. but then again with it logging OpenIddict you only get

The authorization request was successfully validated.

but no user information to know who. 🙁 (but at least a log for that event)

That will be by design (no username) you don't put users in the logs, it would get them flagged by all the security researchers 😕

shows that I logged out with my username showing 🙂