> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Debug mode left on

> Verbose logging enabled for troubleshooting and left on

A debug-mode policy category applies when a production service emits DEBUG-level logs for longer than an expected investigation window.

This is a service configuration issue: log levels come from environment variables or configuration files, and those changes may not follow the same review path as application code.

## Signals

| Signal                  | Description                                                                                            |
| ----------------------- | ------------------------------------------------------------------------------------------------------ |
| Persistent DEBUG volume | A service emits DEBUG logs beyond the configured threshold.                                            |
| Sudden level change     | DEBUG volume jumps from the service's previous baseline.                                               |
| Service-scoped pattern  | The pattern is evaluated at service level rather than per individual log event.                        |
| Production environment  | The logs come from production or another environment where persistent DEBUG logging signals a problem. |

## Example

<Tabs>
  <Tab title="Before">
    ```json theme={null}
    {"severity_text": "DEBUG", "body": "Entering getUserById", "service.name": "user-service"}
    {"severity_text": "DEBUG", "body": "Cache miss for user 12345", "service.name": "user-service"}
    {"severity_text": "DEBUG", "body": "Querying database", "service.name": "user-service"}
    {"severity_text": "DEBUG", "body": "Query took 3ms", "service.name": "user-service"}
    {"severity_text": "DEBUG", "body": "Exiting getUserById", "service.name": "user-service"}
    ```
  </Tab>

  <Tab title="After">
    Log level set back to INFO. Only meaningful events logged.
  </Tab>
</Tabs>

## Recommended enforcement

<CardGroup cols={3}>
  <Card title="Create tickets" icon="ticket" href="/policies/enforcement/create-tickets">
    Notify the service owner that DEBUG logging is still active.
  </Card>

  <Card title="Open PRs" icon="code-pull-request" href="/policies/enforcement/open-prs">
    Change the log level when service configuration is managed as code.
  </Card>

  <Card title="Enforce at edge" icon="server" href="/policies/enforcement/edge">
    Apply temporary volume control when you can't change the configuration right away.
  </Card>
</CardGroup>

The preferred remediation is a configuration change at the source. Edge enforcement is a temporary control for persistent high-volume DEBUG output.

## Detection notes

Tero detects this category from service-level log patterns: a sudden increase in DEBUG logs that persists beyond a configured threshold.

DEBUG logs during an active incident are expected. DEBUG logs that continue for days mean someone forgot to revert the configuration.