v.22.11Improvement

Mask sensitive data in query logs and error messages

Mask passwords and secret keys both in system.query_log and /var/log/clickhouse-server/*.log and also in error messages. #42484 (Vitaly Baranov).
Masks passwords and secret keys in system.query_log, server log files, and error messages to prevent sensitive data exposure.

Why it matters

This feature enhances security by automatically hiding sensitive information such as passwords and secret keys from query logs, server logs, and error outputs. It helps prevent accidental leaks of confidential credentials during query execution and logging.

How to use it

The masking is applied automatically by the system to relevant fields in the system.query_log, all /var/log/clickhouse-server/*.log files, and error messages without requiring user intervention or configuration.