Log File Management in Plugin Migrations.

The Plugin captures events triggered during the execution of a migration job in a .log file.

Each migration job generates its own log file to ensure detailed tracking of events.

The name of each log file follows the pattern yyyy-MM-dd__HH_mm_ss.log, which helps in identifying the exact time of the events logged.

All log files are systematically stored in the logs subdirectory, located in the same directory as the export.json file.

Example of working folder structure:

|- export.json
|- logs/
   |- 2024-04-24__02_17_22.log
   |- 2024-04-25__15_43_07.log
   |- ...

Anonymized Log Sharing with --anonymise

When you run SFDMU with --anonymise, sensitive values in .log files are replaced with hash tokens instead of being written as plain text.

Use this mode when you need to share logs in a public issue or with external teams.

Example:

sf sfdmu run --sourceusername source@name.com --targetusername target@name.com --diagnostic --anonymise

Hash Token Format

  • Token format is label<HEX16>.
  • Example token values:
    • accessToken<ABCDEF12AB34CD56>
    • sourceOrg<11F2AA55CC77EE99>
    • targetUser<9988AA77CC66DD55>
    • canModify<7A55C3D0EE33A119>
    • cwd<4455AA11BB22CC33>
  • The hashing seed is generated once at plugin start for each run.
  • Inside one run:
    • the same source value always produces the same token.
  • Between different runs:
    • token values are different for the same source value.

What Is Masked and What Is Not

Masked in .log files when --anonymise is enabled

  • Sensitive auth/secret values:
    • values of fields such as accessToken, refreshToken, clientSecret, password, authorization, sessionId, token.
    • Bearer ... token values.
  • CLI/runtime sensitive values:
    • --sourceusername
    • --targetusername
    • --canmodify
    • absolute --path and resolved absolute working path values.
  • URL/domain and email values:
    • HTTP/HTTPS URLs.
    • Salesforce and common domain names.
    • email addresses.
  • Absolute filesystem paths:
    • Windows absolute paths (for example, C:\...).
    • UNC absolute paths (for example, \\server\share\...).
    • absolute leading folder paths inside stack trace lines.
    • for plugin code files in stack traces, the leading absolute part is masked and the relative path starting from the plugin root folder is preserved.
  • SOQL literal values:
    • quoted literals in IN (...) clauses are hashed.
    • quoted literals in comparisons on custom fields (__c, __r) are hashed.
    • quoted literals in standard-field comparisons (for example, Type = 'Queue') are not hashed.
  • Prompt answers:
    • PROMPT ANSWER: ... values are hashed.
  • Add-on runtime literal payload values in matching log output patterns:
    • value content is hashed while structural part of the line is kept.
  • Diagnostic dump of CSVIssuesReport.csv in execution log:
    • row values in the dump are anonymized by the same --anonymise rules.

Not masked

  • Stdout output and JSON command output.
  • Any run where --anonymise is not set.
  • Salesforce object names and field API names in logged queries/messages.
  • Salesforce record Id values (15/18-char record IDs).
  • Relative filesystem paths.
  • Stack trace details except masked absolute leading folder paths.
  • Value-mapping rule definition lines.

Important Clarification

  • SFDMU anonymization is focused on sensitive text values in logs.
  • It does not act as a general redaction engine for every possible text shape.
  • Always review the final .log file before public sharing.

Skipped Records Reason Breakdown

When the engine reports skipped target records during update/upsert processing, the warning now includes split counters by reason:

  • skipped because source and target data are the same
  • skipped because no matching target record was found
  • skipped for other reasons

This helps distinguish pure no-change rows from no-match rows during investigation.

When --diagnostic is enabled, the same split is also written as a dedicated diagnostic entry in the .log file:

[diagnostic] update skipped summary: object=Account total=5 sameData=2 noMatchingTarget=1 other=2

Use this line for quick filtering while reviewing large logs.

Related Articles

Last updated on 21st Feb 2026