If security-relevant events are insufficiently logged by a web application, security incidents can be difficult to trace at a later date. This may make it impossible to ascertain the cause of a given incident. For example, configuration errors can be overlooked if corresponding error messages are not recorded in the log files. If logging is inadequate, vulnerabilities are also difficult or impossible to detect and rectify.