# Clean up user\_auth\_token\_logs?

**URL:** https://meta.discourse.org/t/clean-up-user-auth-token-logs/326397
**Category:** Bug
**Created:** [September 13, 2024, 5:30pm UTC](https://meta.discourse.org/t/clean-up-user-auth-token-logs/326397 "2024-09-13T17:30:22Z")
**Posts on this page:** 1
**Showing post:** 13

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [August 8, 2025, 4:31pm UTC](https://meta.discourse.org/t/clean-up-user-auth-token-logs/326397/13 "2025-08-08T16:31:16Z")

</div>

I don’t understand the above discussion either.

The bug is very simple: if the mode is not verbose, then no cleanup of `UserAuthTokenLog` is performed at all, ever. The `if` must go.

 ![image](https://global.discourse-cdn.com/meta/original/4X/2/a/1/2a18f24acf25dece617e7579097ca181523b9931.png)

The original implementation only logged when `SiteSetting.verbose_auth_token_logging` is true. Which still had the problem that after disabling it, the most recent remaining logs would stay, but that’s a small thing.

But [this change](https://github.com/discourse/discourse/commit/8fb823c30f7fd3086f4370c2dc6e4e3737ae6acf) made the logging unconditional (“_The `generate`, `rotate` and `suspicious` auth token logs are now always logged regardless of the `verbose_auth_token_logging` setting_”).

TLDR; That change forgot to make the removal unconditional as well.

---

_[View the full topic](https://meta.discourse.org/t/clean-up-user-auth-token-logs/326397)._