diff --git a/Cargo.lock b/Cargo.lock
index 568bbda..472384c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -74,6 +74,15 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@@ -98,12 +107,67 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "anstream"
+version = "0.6.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c95c10ba0b00a02636238b814946408b1322d5ac4760326e6fb8ec956d85775"
 
+[[package]]
+name = "arc-swap"
+version = "1.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
+
 [[package]]
 name = "atty"
 version = "0.2.14"
@@ -281,6 +345,12 @@ dependencies = [
  "vec_map",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -354,6 +424,23 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "derivative"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.37",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "destructure_traitobject"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c877555693c14d2f84191cfd3ad8582790fc52b5e2274b40b59cf5f5cea25c7"
+
 [[package]]
 name = "digest"
 version = "0.9.0"
@@ -413,6 +500,29 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "env_filter"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f2c92ceda6ceec50f43169f9ee8424fe2db276791afde7b2cd8bc084cb376ab"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13fa619b91fb2381732789fc5de83b45675e882f66623b7d8cb4f643017018d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "humantime",
+ "log",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.1"
@@ -684,6 +794,12 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
 [[package]]
 name = "hyper"
 version = "0.14.31"
@@ -719,7 +835,7 @@ dependencies = [
  "iana-time-zone-haiku",
  "js-sys",
  "wasm-bindgen",
- "windows-core",
+ "windows-core 0.52.0",
 ]
 
 [[package]]
@@ -757,10 +873,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "59ce5ef949d49ee85593fc4d3f3f95ad61657076395cbbce23e2121fc5542074"
 
 [[package]]
-name = "itoa"
-version = "1.0.11"
+name = "is_terminal_polyfill"
+version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+
+[[package]]
+name = "itoa"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "540654e97a3f4470a492cd30ff187bc95d89557a903a2bbf112e2fae98104ef2"
 
 [[package]]
 name = "jose-b64"
@@ -818,9 +940,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.162"
+version = "0.2.164"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
+checksum = "433bfe06b8c75da9b2e3fbea6e5329ff87748f0b144ef75306e674c3f6f7c13f"
 
 [[package]]
 name = "libm"
@@ -875,16 +997,19 @@ checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "local-mini-kms"
-version = "1.0.2"
+version = "1.0.3"
 dependencies = [
  "aes-gcm-stream",
  "aes-kw",
  "base64",
  "clap",
+ "env_logger",
  "hex",
  "hyper",
  "jose-jwk",
  "lazy_static",
+ "log",
+ "log4rs",
  "procfs",
  "rand",
  "rpassword",
@@ -918,6 +1043,43 @@ name = "log"
 version = "0.4.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "log-mdc"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a94d21414c1f4a51209ad204c1776a3d0765002c76c6abcb602a6f09f1e881c7"
+
+[[package]]
+name = "log4rs"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0816135ae15bd0391cf284eab37e6e3ee0a6ee63d2ceeb659862bd8d0a984ca6"
+dependencies = [
+ "anyhow",
+ "arc-swap",
+ "chrono",
+ "derivative",
+ "fnv",
+ "humantime",
+ "libc",
+ "log",
+ "log-mdc",
+ "once_cell",
+ "parking_lot",
+ "rand",
+ "serde",
+ "serde-value",
+ "serde_json",
+ "serde_yaml",
+ "thiserror",
+ "thread-id",
+ "typemap-ors",
+ "winapi",
+]
 
 [[package]]
 name = "memchr"
@@ -1025,6 +1187,15 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
+[[package]]
+name = "ordered-float"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -1163,9 +1334,9 @@ checksum = "7be55bf0ae1635f4d7c7ddd6efc05c631e98a82104a73d35550bbc52db960027"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.89"
+version = "1.0.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
+checksum = "307e3004becf10f5a6e0d59d20f3cd28231b0e0827a96cd3e0ce6d14bc1e4bb3"
 dependencies = [
  "unicode-ident",
 ]
@@ -1250,6 +1421,35 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
 [[package]]
 name = "rpassword"
 version = "7.3.1"
@@ -1350,9 +1550,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.40"
+version = "0.38.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99e4ea3e1cdc4b559b8e5650f9c8e5998e3e5c1343b4eaf034565f32318d63c0"
+checksum = "d7f649912bc1495e167a6edee79151c84b1bad49748cb4f1f1167f459f6224f6"
 dependencies = [
  "bitflags 2.6.0",
  "errno 0.3.9",
@@ -1405,14 +1605,14 @@ dependencies = [
 
 [[package]]
 name = "secmem-proc"
-version = "0.3.4"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9534d0f999b85ecf55f1be907d84cbba620ff6b14692ad940dea5f4a55e2185"
+checksum = "725455f9398814dad270f4d4fb2cb16261af7fc3e739dd0c6cec80446f42d353"
 dependencies = [
  "anyhow",
  "cfg-if",
  "libc",
- "rustix 0.38.40",
+ "rustix 0.38.41",
  "thiserror",
  "windows",
 ]
@@ -1426,6 +1626,16 @@ dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "serde-value"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
+dependencies = [
+ "ordered-float",
+ "serde",
+]
+
 [[package]]
 name = "serde_derive"
 version = "1.0.215"
@@ -1434,14 +1644,14 @@ checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
 dependencies = [
  "proc-macro2",
  "quote 1.0.37",
- "syn",
+ "syn 2.0.89",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.132"
+version = "1.0.133"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
+checksum = "c7fceb2473b9166b2294ef05efcb65a3db80803f0b03ef86a5fc88a2b85ee377"
 dependencies = [
  "itoa",
  "memchr",
@@ -1449,6 +1659,19 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
 [[package]]
 name = "sha-1"
 version = "0.9.8"
@@ -1585,9 +1808,20 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.87"
+version = "1.0.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.37",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d46482f1c1c87acd84dea20c1bf5ebff4c757009ed6bf19cfd36fb10e92c4e"
 dependencies = [
  "proc-macro2",
  "quote 1.0.37",
@@ -1641,7 +1875,17 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote 1.0.37",
- "syn",
+ "syn 2.0.89",
+]
+
+[[package]]
+name = "thread-id"
+version = "4.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe8f25bbdd100db7e1d34acf7fd2dc59c4bf8f7483f505eaa7d4f12f76cc0ea"
+dependencies = [
+ "libc",
+ "winapi",
 ]
 
 [[package]]
@@ -1670,7 +1914,7 @@ checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote 1.0.37",
- "syn",
+ "syn 2.0.89",
 ]
 
 [[package]]
@@ -1717,6 +1961,15 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "typemap-ors"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a68c24b707f02dd18f1e4ccceb9d49f2058c2fb86384ef9972592904d7a28867"
+dependencies = [
+ "unsafe-any-ors",
+]
+
 [[package]]
 name = "typenum"
 version = "1.17.0"
@@ -1725,9 +1978,9 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.13"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
 
 [[package]]
 name = "unicode-width"
@@ -1745,6 +1998,27 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "unsafe-any-ors"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0a303d30665362d9680d7d91d78b23f5f899504d4f08b3c4cf08d055d87c0ad"
+dependencies = [
+ "destructure_traitobject",
+]
+
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -1800,7 +2074,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote 1.0.37",
- "syn",
+ "syn 2.0.89",
  "wasm-bindgen-shared",
 ]
 
@@ -1822,7 +2096,7 @@ checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
 dependencies = [
  "proc-macro2",
  "quote 1.0.37",
- "syn",
+ "syn 2.0.89",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -1857,11 +2131,11 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows"
-version = "0.52.0"
+version = "0.58.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
+checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
 dependencies = [
- "windows-core",
+ "windows-core 0.58.0",
  "windows-targets 0.52.6",
 ]
 
@@ -1874,6 +2148,60 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-core"
+version = "0.58.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-result",
+ "windows-strings",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.58.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.37",
+ "syn 2.0.89",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.58.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.37",
+ "syn 2.0.89",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
+dependencies = [
+ "windows-result",
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.42.0"
@@ -1916,6 +2244,15 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.42.2"
@@ -2128,7 +2465,7 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote 1.0.37",
- "syn",
+ "syn 2.0.89",
 ]
 
 [[package]]
@@ -2149,5 +2486,5 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote 1.0.37",
- "syn",
+ "syn 2.0.89",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index ecd1609..16d0904 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "local-mini-kms"
-version = "1.0.2"
+version = "1.0.3"
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -35,6 +35,9 @@ aes-kw = { version = "0.2", features = ["alloc"] }
 sha1 = "0.10"
 aes-gcm-stream = "0.2"
 jose-jwk = "0.1"
+log = "0.4"
+env_logger = "0.11"
+log4rs = "1.3"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 procfs = { version = "0.13", optional = true }
diff --git a/src/main.rs b/src/main.rs
index 0750759..d919d18 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -17,6 +17,7 @@ mod yubikey_hmac;
 #[cfg(feature = "yubikey")]
 mod yubikey_init_master_key;
 mod serve_datakey;
+mod serve_log;
 
 pub struct DefaultCommandImpl;
 
@@ -62,6 +63,8 @@ fn inner_main() -> CommandError {
     {
         #[cfg(feature = "yubikey")]
         features.push("yubikey".to_string());
+        #[cfg(feature = "harden_process")]
+        features.push("harden_process".to_string());
     }
     let long_about = format!("Local mini KMS, features: [{}]", features.join(", "));
     let mut app = App::new(env!("CARGO_PKG_NAME"))
diff --git a/src/serve.rs b/src/serve.rs
index 967ea99..6e23587 100644
--- a/src/serve.rs
+++ b/src/serve.rs
@@ -1,5 +1,3 @@
-use std::net::SocketAddr;
-
 use clap::{App, Arg, ArgMatches, SubCommand};
 use hyper::client::HttpConnector;
 use hyper::server::conn::AddrStream;
@@ -8,10 +6,11 @@ use hyper::{Body, Client, Method, Request, Response, Server, StatusCode};
 use rust_util::util_clap::{Command, CommandError};
 use rust_util::{failure_and_exit, information, success, warning, XResult};
 use serde_json::{json, Value};
+use std::net::SocketAddr;
+use std::sync::atomic::{AtomicU64, Ordering};
 use tokio::runtime::Runtime;
 
 use crate::serve_common::{self, GenericError, MemoryKey, Result};
-use crate::serve_encrypt_decrypt;
 use crate::serve_init;
 use crate::serve_init::InitRequest;
 use crate::serve_read_write;
@@ -20,6 +19,11 @@ use crate::serve_status;
 use crate::yubikey_hmac;
 use crate::{db, jose, proc};
 use crate::{do_response, serve_datakey};
+use crate::{serve_encrypt_decrypt, serve_log};
+
+lazy_static::lazy_static! {
+    pub static ref GLOBAL_REQUEST_COUNT: AtomicU64 = AtomicU64::new(0);
+}
 
 pub struct CommandImpl;
 
@@ -32,9 +36,18 @@ impl Command for CommandImpl {
             .arg(Arg::with_name("local-db").long("local-db").short("d").takes_value(true).default_value("local-mini-kms.db").help("Local db file"))
             .arg(Arg::with_name("yubikey-challenge").long("yubikey-challenge").short("c").takes_value(true).help("Yubikey challenge"))
             .arg(Arg::with_name("init-encrypted-master-key").long("init-encrypted-master-key").short("k").takes_value(true).help("Init encrypted mater key"))
+            .arg(Arg::with_name("log-level").long("log-level").takes_value(true).help("Log level: trace, debug, info, warn or error"))
+            .arg(Arg::with_name("log-file").long("log-file").takes_value(true).help("Log file #DEFAULT or config file"))
     }
 
     fn run(&self, _arg_matches: &ArgMatches, sub_arg_matches: &ArgMatches) -> CommandError {
+        let log_level = sub_arg_matches.value_of("log-level");
+        let log_file = sub_arg_matches.value_of("log-file");
+
+        if let Err(e) = serve_log::init_logger(log_level, log_file) {
+            println!("[ERROR] Init logger failed: {}", e);
+        }
+
         let local_mini_kms_db = sub_arg_matches.value_of("local-db").expect("Get local mini kms db error");
         match init_instance(local_mini_kms_db) {
             Ok(true) => success!("Init server success"),
@@ -61,6 +74,7 @@ impl Command for CommandImpl {
             });
             let server = Server::bind(&addr).serve(new_service);
             information!("Listening on http://{}", addr);
+            log::info!("Listening on http://{}", addr);
             match server.await {
                 Err(e) => failure_and_exit!("Server error: {}", e),
                 Ok(_) => success!("Server ended"),
@@ -77,11 +91,13 @@ async fn response_requests(
     req: Request<Body>,
     _client: Client<HttpConnector>,
 ) -> Result<Response<Body>> {
+    let request_idx = GLOBAL_REQUEST_COUNT.fetch_add(1, Ordering::Relaxed);
     let process = proc::get_process(remote_addr.port());
     match process {
-        None => information!( "Receive request: {}, from: {}", req.uri(), remote_addr ),
-        Some(process) => information!(
-            "Receive request: {}, from: {}, process: {} {} {:?}",
+        None => log::info!( "Receive request: {}, from: {}", req.uri(), remote_addr ),
+        Some(process) => log::info!(
+            "[{:06}] Receive request: {}, from: {}, process: {} {} {:?}",
+            request_idx,
             req.uri(),
             remote_addr,
             process.pid,
diff --git a/src/serve_common.rs b/src/serve_common.rs
index 52e3417..503fe81 100644
--- a/src/serve_common.rs
+++ b/src/serve_common.rs
@@ -133,7 +133,7 @@ pub fn byte_to_multi_view_map(bytes: &[u8], with_value: bool) -> Map<String, Val
 pub fn open_local_db() -> XResult<Connection> {
     let startup_rw_lock = STATUP_RW_LOCK.lock().expect("Lock read startup rw lock error");
     match &*startup_rw_lock {
-        None => simple_error!("Db is not initted!"),
+        None => simple_error!("Db is not initiated!"),
         Some(k) => {
             Ok(opt_result!(db::open_db(& k.database_file), "Open db failed: {}"))
         }
diff --git a/src/serve_datakey.rs b/src/serve_datakey.rs
index 98f5b2d..6320fa8 100644
--- a/src/serve_datakey.rs
+++ b/src/serve_datakey.rs
@@ -5,7 +5,7 @@ use base64::Engine;
 use hyper::body::Buf;
 use hyper::{Body, Request, Response, StatusCode};
 use rand::random;
-use rust_util::{debugging, iff, XResult};
+use rust_util::{iff, XResult};
 use seckey::SecBytes;
 use serde_derive::{Deserialize, Serialize};
 use serde_json::json;
@@ -32,7 +32,7 @@ async fn inner_generate(req: Request<Body>) -> XResult<(StatusCode, Value)> {
     let whole_body = hyper::body::aggregate(req).await?;
     let request: DataKeyRequest = serde_json::from_reader(whole_body.reader())?;
 
-    debugging!("Generate data key: {} {}", &request.r#type, &request.spec);
+    log::debug!("Generate data key: {} {}", &request.r#type, &request.spec);
     let key = match get_master_key() {
         None => return serve_common::error("status_not_ready"),
         Some(key) => key,
diff --git a/src/serve_encrypt_decrypt.rs b/src/serve_encrypt_decrypt.rs
index 5712780..e09e2fb 100644
--- a/src/serve_encrypt_decrypt.rs
+++ b/src/serve_encrypt_decrypt.rs
@@ -1,6 +1,6 @@
 use hyper::body::Buf;
 use hyper::{Body, Request, Response, StatusCode};
-use rust_util::{debugging, XResult};
+use rust_util::XResult;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Map, Value};
 
@@ -21,7 +21,7 @@ async fn inner_decrypt(req: Request<Body>) -> XResult<(StatusCode, Value)> {
     let whole_body = hyper::body::aggregate(req).await?;
     let data: DecryptRequest = serde_json::from_reader(whole_body.reader())?;
 
-    debugging!("To be decrypted value: {}", &data.encrypted_value);
+    log::debug!("To be decrypted value: {}", &data.encrypted_value);
     let key = match get_master_key() {
         None => return serve_common::error("status_not_ready"),
         Some(key) => key,
diff --git a/src/serve_init.rs b/src/serve_init.rs
index 6dd3c70..f13794f 100644
--- a/src/serve_init.rs
+++ b/src/serve_init.rs
@@ -2,7 +2,7 @@ use base64::engine::general_purpose::STANDARD;
 use base64::Engine;
 use hyper::body::Buf;
 use hyper::{Body, Request, Response, StatusCode};
-use rust_util::{debugging, information, opt_result, success, warning, XResult};
+use rust_util::{opt_result, XResult};
 use seckey::SecBytes;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
@@ -48,7 +48,7 @@ pub async fn inner_init_request(init_request: InitRequest) -> XResult<(StatusCod
     } else if let Some(clear_master_key_hex) = init_request.clear_master_key_hex {
         hex::decode(clear_master_key_hex)?
     } else if let Some(encrypted_master_key) = init_request.encrypted_master_key {
-        debugging!("Received encrypted master key: {}", encrypted_master_key);
+        log::debug!("Received encrypted master key: {}", encrypted_master_key);
         if let Some(k) = &*startup_rw_lock {
             let (clear_master_key, _) = jose::deserialize_jwe_rsa(&encrypted_master_key, &k.instance_rsa_key_pair)?;
             clear_master_key
@@ -76,19 +76,19 @@ pub async fn inner_init_request(init_request: InitRequest) -> XResult<(StatusCod
                 db::insert_key(&conn, &key)?;
             }
             Some(key) => {
-                debugging!("Found jwe: {}", &key.encrypted_key);
+                log::debug!("Found jwe: {}", &key.encrypted_key);
                 let _ = opt_result!(jose::deserialize_jwe_aes(&key.encrypted_key, &clear_master_key), "Deserialize master key verification key failed: {}");
             }
         }
-        information!("Set master key success");
+        log::info!("Set master key success");
 
         #[cfg(feature = "yubikey")]
         if let Some(yubikey_challenge) = &init_request.yubikey_challenge {
             match yubikey_hmac::yubikey_challenge_as_32_bytes(yubikey_challenge.as_bytes()) {
-                Err(e) => warning!("Yubikey challenge failed: {}", e),
+                Err(e) => log::warn!("Yubikey challenge failed: {}", e),
                 Ok(challenge_key) => match jose::serialize_jwe_aes(&clear_master_key, &challenge_key) {
-                    Err(e) => warning!("Yubikey seal master key failed: {}", e),
-                    Ok(jwe) => success!("Yubikey sealed master key: {}", jwe)
+                    Err(e) => log::warn!("Yubikey seal master key failed: {}", e),
+                    Ok(jwe) => log::info!("Yubikey sealed master key: {}", jwe)
                 },
             }
         }
diff --git a/src/serve_log.rs b/src/serve_log.rs
new file mode 100644
index 0000000..8435c01
--- /dev/null
+++ b/src/serve_log.rs
@@ -0,0 +1,66 @@
+use log::LevelFilter;
+use rust_util::{simple_error, XResult};
+use std::{env, fs};
+
+const DEFAULT_LOG4RS_CONFIG: &str = r##"refresh_rate: 10 seconds
+appenders:
+  file:
+    kind: rolling_file
+    path: "log/local_mini_kms_log.log"
+    append: true
+    encoder:
+      pattern: "{d} - {m}{n}"
+    policy:
+      kind: compound
+      trigger:
+        kind: size
+        limit: 100 mb
+      roller:
+        kind: fixed_window
+        pattern: log/local_mini_kms_log.{}.log
+        count: 10
+root:
+  level: info
+  appenders:
+    - file"##;
+
+pub fn init_logger(log_level: Option<&str>, log4rs_file: Option<&str>) -> XResult<()> {
+    match log4rs_file {
+        None => {
+            let level = match env::var("LOGGER").ok().as_deref().map(get_log_level_filter) {
+                Some(Ok(level)) => level,
+                _ => log_level.map(get_log_level_filter).unwrap_or(Ok(LevelFilter::Debug))?,
+            };
+            let _ = env_logger::builder().filter_level(level).try_init();
+        }
+        Some(log4rs_file) => {
+            let log4rs_config_file = if log4rs_file == "#DEFAULT" {
+                let default_log4rs_file = "default_log4rs.yaml";
+                let _ = fs::metadata(default_log4rs_file).map_err(|_| {
+                    fs::write(default_log4rs_file, DEFAULT_LOG4RS_CONFIG).map_err(|e| {
+                        println!("Write file: {} failed: {}", default_log4rs_file, e);
+                    })
+                });
+                default_log4rs_file
+            } else {
+                log4rs_file
+            };
+            log4rs::init_file(log4rs_config_file, Default::default())?;
+        }
+    }
+    Ok(())
+}
+
+
+fn get_log_level_filter(log_level: &str) -> XResult<LevelFilter> {
+    Ok(match log_level {
+        "trace" => LevelFilter::Trace,
+        "debug" => LevelFilter::Debug,
+        "info" => LevelFilter::Info,
+        "warn" => LevelFilter::Warn,
+        "error" => LevelFilter::Error,
+        _ => {
+            return simple_error!("invalid log_level");
+        }
+    })
+}
\ No newline at end of file