By the end of this session, you will be able to:

• Set up structured logging with Serilog, writing to a console sink and a rolling file sink
• Write log statements as message templates rather than interpolated strings
• Choose the correct log level for an event, and configure minimum levels per namespace
• Add a correlation ID middleware and trace one request across every log entry it produced
• Expose /health, /health/live, and /health/ready endpoints with database and dependency checks

• You cannot attach a debugger, set a breakpoint, or reproduce the exact request
• The bug happened three hours ago, for one user, and has not happened since
• Twenty requests were in flight at the same time — their output is interleaved
• The only artefact that survives the request is what you wrote to the log
• A support ticket says "it failed" — your job is to turn that into a stack trace and a user id

cd TaskApi
dotnet add package Serilog.AspNetCore
dotnet add package Serilog.Sinks.Console
dotnet add package Serilog.Sinks.File

# Optional but useful for the lab
dotnet add package Serilog.Enrichers.Environment
dotnet add package Serilog.Enrichers.Thread

dotnet build

Log.Logger = new LoggerConfiguration()
    .MinimumLevel.Debug()
    .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
    .Enrich.FromLogContext()
    .WriteTo.Console(outputTemplate:
        "[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj} {Properties}{NewLine}{Exception}")
    .WriteTo.File("logs/app-.log", rollingInterval: RollingInterval.Day)
    .CreateLogger();

var builder = WebApplication.CreateBuilder(args);

builder.Host.UseSerilog();

.WriteTo.File(
    path: "logs/app-.log",
    rollingInterval: RollingInterval.Day,
    retainedFileCountLimit: 14,
    fileSizeLimitBytes: 20 * 1024 * 1024,
    rollOnFileSizeLimit: true,
    outputTemplate:
        "{Timestamp:o} [{Level:u3}] {SourceContext} {Message:lj}{NewLine}{Exception}")

// Produces: logs/app-20260801.log, logs/app-20260802.log, ...
// Keeps the newest 14 files, each capped at 20 MB

app.UseSerilogRequestLogging(options =>
{
    options.MessageTemplate =
        "HTTP {RequestMethod} {RequestPath} responded {StatusCode} in {Elapsed:0.0000} ms";

    options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>
    {
        diagnosticContext.Set("RequestHost", httpContext.Request.Host.Value);
        diagnosticContext.Set("UserId",
            httpContext.User.FindFirst(ClaimTypes.NameIdentifier)?.Value);
    };
});

Highlighted stages are added in this session.

{
  "Serilog": {
    "MinimumLevel": {
      "Default": "Information",
      "Override": {
        "Microsoft.AspNetCore": "Warning",
        "Microsoft.EntityFrameworkCore.Database.Command": "Warning"
      }
    },
    "WriteTo": [
      { "Name": "Console" },
      {
        "Name": "File",
        "Args": {
          "path": "logs/app-.log",
          "rollingInterval": "Day",
          "retainedFileCountLimit": 14
        }
      }
    ],
    "Enrich": [ "FromLogContext", "WithMachineName" ]
  }
}

// Stage 1 — bootstrap logger, active before configuration is read
Log.Logger = new LoggerConfiguration()
    .WriteTo.Console()
    .CreateBootstrapLogger();

try
{
    var builder = WebApplication.CreateBuilder(args);

    // Stage 2 — the real logger, built from appsettings.json
    builder.Host.UseSerilog((context, services, configuration) => configuration
        .ReadFrom.Configuration(context.Configuration)
        .ReadFrom.Services(services)
        .Enrich.FromLogContext());

    var app = builder.Build();
    app.Run();
}
catch (Exception ex)
{
    Log.Fatal(ex, "Application terminated unexpectedly during startup");
}
finally
{
    Log.CloseAndFlush();
}

// Bad — string interpolation loses structure
_logger.LogInformation($"Task {taskId} created by user {userId}");

// Good — structured, searchable by TaskId and UserId
_logger.LogInformation("Task {TaskId} created by user {UserId}", taskId, userId);

{
  "@t": "2026-08-01T14:22:07.1134821Z",
  "@mt": "Task {TaskId} created by user {UserId}",
  "@l": "Information",
  "TaskId": 41,
  "UserId": 88,
  "CorrelationId": "9f2c31de-5b0a-4a1e-9d33-8c7f0f6ad2b1",
  "SourceContext": "TaskApi.Services.TaskService",
  "MachineName": "web-prod-02",
  "EnvironmentName": "Production"
}

try
{
    await _repository.DeleteAsync(id, cancellationToken);
    _logger.LogInformation("Task {TaskId} deleted by user {UserId}", id, userId);
}
catch (DbUpdateConcurrencyException ex)
{
    // The exception goes in the FIRST parameter, not into the message
    _logger.LogWarning(ex,
        "Concurrency conflict deleting task {TaskId}; retrying", id);
    throw;
}
catch (Exception ex)
{
    _logger.LogError(ex,
        "Unexpected failure deleting task {TaskId} for user {UserId}", id, userId);
    throw;
}

In Seq, every property you logged is a filterable field:

new LoggerConfiguration()
    .MinimumLevel.Information()

    .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
    .MinimumLevel.Override("Microsoft.AspNetCore.Mvc", LogEventLevel.Error)
    .MinimumLevel.Override("System.Net.Http.HttpClient", LogEventLevel.Warning)

    // Your own code stays verbose while you work on it
    .MinimumLevel.Override("TaskApi.Services", LogEventLevel.Debug)

    .Enrich.FromLogContext()
    .WriteTo.Console()
    .CreateLogger();

app.Use(async (context, next) =>
{
    var correlationId = context.Request.Headers["X-Correlation-Id"].FirstOrDefault()
        ?? Guid.NewGuid().ToString();

    context.Response.Headers.Append("X-Correlation-Id", correlationId);

    using (LogContext.PushProperty("CorrelationId", correlationId))
    {
        await next();
    }
});

• Reuse the incoming header first. If a gateway or another service already assigned an id, keeping it links the two systems' logs together
• Fall back to a new GUID. Every request gets an id, even a direct call from Postman
• Echo it on the response. A user can paste the header value into a support ticket and you find their request instantly
• PushProperty inside a using. The property is scoped to the async flow and popped when the request ends — it cannot leak into another request
• Register it early. Any middleware placed before it logs without the id

public class CorrelationIdMiddleware
{
    private const string HeaderName = "X-Correlation-Id";
    private readonly RequestDelegate _next;

    public CorrelationIdMiddleware(RequestDelegate next) => _next = next;

    public async Task InvokeAsync(HttpContext context)
    {
        var correlationId = context.Request.Headers[HeaderName].FirstOrDefault();

        if (string.IsNullOrWhiteSpace(correlationId))
            correlationId = Guid.NewGuid().ToString();

        context.Items[HeaderName] = correlationId;

        context.Response.OnStarting(() =>
        {
            context.Response.Headers[HeaderName] = correlationId;
            return Task.CompletedTask;
        });

        using (LogContext.PushProperty("CorrelationId", correlationId))
        {
            await _next(context);
        }
    }
}

[14:22:07 INF] HTTP POST /api/tasks started            {CorrelationId="9f2c31de"}
[14:22:07 DBG] Validating CreateTaskDto                 {CorrelationId="9f2c31de"}
[14:22:07 INF] Creating task "Write report" for user 88 {CorrelationId="9f2c31de"}
[14:22:07 DBG] SaveChanges affected 1 row               {CorrelationId="9f2c31de"}
[14:22:07 INF] Task 41 created by user 88               {CorrelationId="9f2c31de"}
[14:22:07 INF] HTTP POST /api/tasks responded 201 in 42.7188 ms {CorrelationId="9f2c31de"}

public class CorrelationIdHandler : DelegatingHandler
{
    private const string HeaderName = "X-Correlation-Id";
    private readonly IHttpContextAccessor _accessor;

    public CorrelationIdHandler(IHttpContextAccessor accessor) => _accessor = accessor;

    protected override Task<HttpResponseMessage> SendAsync(
        HttpRequestMessage request, CancellationToken cancellationToken)
    {
        if (_accessor.HttpContext?.Items[HeaderName] is string id
            && !request.Headers.Contains(HeaderName))
        {
            request.Headers.Add(HeaderName, id);
        }

        return base.SendAsync(request, cancellationToken);
    }
}

// Program.cs
builder.Services.AddHttpClient("reporting")
    .AddHttpMessageHandler<CorrelationIdHandler>();

builder.Services.AddHealthChecks()
    .AddDbContextCheck<AppDbContext>()
    .AddUrlGroup(new Uri("https://api.external-service.com/health"), "external-service");

var app = builder.Build();

app.MapHealthChecks("/health");
app.MapHealthChecks("/health/ready", new HealthCheckOptions
{
    Predicate = check => check.Tags.Contains("ready")
});

builder.Services.AddHealthChecks()
    .AddDbContextCheck<AppDbContext>(
        name: "database",
        failureStatus: HealthStatus.Unhealthy,
        tags: new[] { "ready", "db" })
    .AddUrlGroup(
        new Uri("https://api.external-service.com/health"),
        name: "external-service",
        tags: new[] { "ready", "external" });

// Liveness: no checks at all, just "the process answered"
app.MapHealthChecks("/health/live", new HealthCheckOptions
{
    Predicate = _ => false
});

app.MapHealthChecks("/health/ready", new HealthCheckOptions
{
    Predicate = check => check.Tags.Contains("ready")
});

app.MapHealthChecks("/health");   // everything

public class ReportingServiceHealthCheck : IHealthCheck
{
    private readonly HttpClient _client;

    public ReportingServiceHealthCheck(HttpClient client) => _client = client;

    public async Task<HealthCheckResult> CheckHealthAsync(
        HealthCheckContext context,
        CancellationToken cancellationToken = default)
    {
        try
        {
            var response = await _client.GetAsync("/ping", cancellationToken);

            return response.IsSuccessStatusCode
                ? HealthCheckResult.Healthy("Reporting service reachable")
                : HealthCheckResult.Degraded(
                    $"Reporting service returned {(int)response.StatusCode}");
        }
        catch (Exception ex)
        {
            return HealthCheckResult.Unhealthy("Reporting service unreachable", ex);
        }
    }
}

app.MapHealthChecks("/health", new HealthCheckOptions
{
    ResponseWriter = async (context, report) =>
    {
        context.Response.ContentType = "application/json";

        var payload = new
        {
            status = report.Status.ToString(),
            totalDurationMs = report.TotalDuration.TotalMilliseconds,
            checks = report.Entries.Select(entry => new
            {
                name = entry.Key,
                status = entry.Value.Status.ToString(),
                description = entry.Value.Description,
                durationMs = entry.Value.Duration.TotalMilliseconds
            })
        };

        await context.Response.WriteAsJsonAsync(payload);
    }
});

{
  "status": "Degraded",
  "totalDurationMs": 48.11,
  "checks": [
    {
      "name": "database",
      "status": "Healthy",
      "description": null,
      "durationMs": 3.42
    },
    {
      "name": "reporting",
      "status": "Degraded",
      "description": "Reporting service returned 502",
      "durationMs": 44.69
    }
  ]
}

# Dockerfile — container-level check
HEALTHCHECK --interval=30s --timeout=3s --start-period=20s --retries=3 \
  CMD curl --fail http://localhost:8080/health/live || exit 1

# Verify locally
curl -i http://localhost:5001/health
curl -s http://localhost:5001/health/ready | jq

# Stop the database and watch the status change
docker stop taskapi-postgres
curl -i http://localhost:5001/health/ready
# HTTP/1.1 503 Service Unavailable

• Checking everything on liveness. One flaky dependency restarts every instance in the cluster
• Expensive checks. SELECT COUNT(*) FROM Tasks every five seconds is a self-inflicted load test — use CanConnectAsync
• Leaking detail. An anonymous endpoint returning exception text hands an attacker your schema and infrastructure
• Logging every probe at Information. A probe every 5 seconds is 17,000 entries a day of pure noise
• No timeout. A hanging check makes the endpoint hang, and the probe cannot distinguish that from a crash

Work through these steps on your Task Management API project:

Session 24 — Deployment & Environment Configuration

• Layering appsettings.json, environment-specific files, and environment variables
• Keeping secrets out of source control with user secrets and environment configuration
• Publishing the API and running it behind a real host
• Different Serilog levels and sinks per environment — exactly the configuration you wrote today

Make your Task Management API observable: full Serilog setup, correlation IDs end to end, and health endpoints — plus a short OBSERVABILITY.md explaining your level choices.

• Serilog configured from appsettings.json with Console and rolling File sinks, retainedFileCountLimit set, and a Microsoft override at Warning
• Structured entries in TaskService for create, update and delete, using message templates with {TaskId} and {UserId} — no interpolated strings anywhere
• Correlation ID middleware that reuses an incoming X-Correlation-Id, echoes it on the response, and feeds the traceId of your ProblemDetails errors
• Three mapped endpoints — /health, /health/live (no checks), /health/ready (database check, tagged) — with a JSON response writer
• A log excerpt in OBSERVABILITY.md showing one request's entries sharing a single CorrelationId, plus the 503 body from /health/ready with the database stopped