A roof leak almost never appears where the water got in.

Take an ordinary case. A stain has appeared on a bedroom ceiling about two feet in from the exterior wall. Above it is a vented attic. The roof over that room is a gable plane running 14 ft horizontally from the wall to the ridge at a slope of 6:12. Rafters are 16 in on center and the deck is ordinary 4 ft × 8 ft sheathing. The stain itself is about 14 in across.

Step 1 — how far up-slope the entry point could be

Horizontal run is not roof surface. The multiplier between them is the pitch factor: for a rise of p inches per 12 inches of run it is √(1 + (p/12)²). For 6:12:

• √(1 + (6/12)²) = √1.25 = 1.118
• 14 ft × 1.118 = 15.7 ft of roof surface

Water travels down-slope inside the assembly, so the entry point is somewhere above the place the water left the deck — anywhere in that 15.7 ft, from the eave to the ridge.

Step 2 — how far sideways

If the water stayed in one rafter bay, the band is 16 in — 1.33 ft — wide. It usually does not. Sheathing panels are laid across the rafters, so their joints run across the direction of flow, and a 4 ft panel width spans three bays at 16 in on center. Take 4 ft as the ordinary case and 1.33 ft as the best case.

Step 3 — the search area, and the ratio

• Best case: 15.7 ft × 1.33 ft = 20.9 sq ft
• Ordinary case: 15.7 ft × 4.0 ft = 62.8 sq ft
• The stain itself: a 14 in circle is π × (0.583 ft)² = 1.07 sq ft
• Ratio, ordinary case: 62.8 ÷ 1.07 ≈ 59

The mark on the ceiling covers roughly one-sixtieth of the roof you would have to search — and that is with every assumption running in your favor. It assumes the framing runs the way you think it does, that the water did not cross a top plate into a different room, and that the roof above is one plane rather than a hip or a dormer with valleys feeding into it.

Step 4 — what actually shrinks the band

Not staring at the stain. Three things do the work:

1. Timing. “Only in driven rain from the north-east” collapses a 15.7 ft band to the wall-side details on one elevation. “Only in a thaw” collapses it to the bottom few feet. “Every rain, however light” collapses it to whichever penetration is in the band.
2. The roof’s own inventory. Count the interruptions inside the band from the ground or from photographs — pipes, a skylight, a wall line, a valley, a chimney. If there is exactly one, the band has already collapsed to a point.
3. History. Anything done to that plane in the last two years — a repair, a solar array, a satellite dish, a new vent, a re-clad wall — outranks everything else on the list.

Do those three and you can hand a contractor a band of roof a few feet across instead of a request to find a leak. That is a materially different visit.

The log has one job: to convert “it leaks sometimes” into a pattern with a shape. Six or eight entries is usually enough. Every field below can be filled in from inside the house, and the weather column can be verified afterwards against the record — the National Weather Service explains how to reach the daily LCD or F-6 summary for your area through the local Weather Forecast Office’s climate pages.

Two honest caveats about the log. The first is that it takes time, and time is exactly what a wet cavity does not have: EPA guidance is that materials dried within 24–48 hours of a leak will in most cases not grow mold. Logging a slow, small, contained leak while the affected area is dry and ventilated is reasonable. Logging a leak that is wetting insulation every week is not — that one gets a contractor now, and the log continues alongside.

The second is that some leaks are not periodic enough to log. A roof that leaks once every eight months in one particular storm direction can take two years to characterize. In that case the log is still worth keeping, but it is a supplement to an inspection rather than a substitute for one.

Before any of the up-slope reasoning is worth applying, the water has to have come from the sky. It often has not.

Condensation

Condensation is not a leak and does not behave like one. The mechanism is stated plainly by the Building America Solution Center: condensation occurs on building materials “when their surface temperatures drop below the dewpoint of the air they are exposed to,” and the surfaces this happens to first are “the interior faces of roof joists and roof sheathing.” Where warm, humid indoor air escapes upward into a cold roof assembly, the same guide says plainly that “condensation is likely.”

That gives condensation a signature nothing else has:

• It happens in the wrong weather. Cold, clear, still nights. No rain anywhere in the record.
• It is distributed, not pointed. The whole underside of the sheathing gets damp, so the wetting is broad and diffuse rather than a single track ending in one spot.
• It tracks what you do indoors. Showers, cooking, laundry, drying clothes inside, a humidifier, or simply more people at home all raise indoor humidity — and BASC notes that reducing indoor humidity “lowers the dewpoint, which makes condensation less likely.”
• It is seasonal in a specific way. It arrives with the first hard cold and disappears in spring, rather than following the storm calendar.

A hygrometer that reads indoor temperature and relative humidity, left in the room below the stain, will usually settle this within a couple of weeks — the log column exists for exactly that. If wetting follows cold snaps rather than rainfall, the problem is air sealing, humidity, and the assembly’s moisture design, which is the subject of the ventilation guide, and no amount of work on the covering will touch it.

One guardrail while you are there: both vented attics and correctly designed unvented ones are legitimate. BASC describes the unvented approach as working by keeping the roof deck — “the principal condensing surface in roof assemblies” — sufficiently warm. “More ventilation” is not a universal answer, and adding vents to an assembly that was designed unvented can make things worse.

Plumbing above the ceiling

A supply line, a waste line, a failed shower pan, or a bad seal at a toilet on the floor above all produce a ceiling stain that is indistinguishable from a roof leak by appearance. What separates them is correlation: plumbing leaks follow use, not weather. If the stain grows during a dry two weeks, or grows on the day the guest bathroom gets used, the roof is not the suspect.

Air-conditioning condensate

An air handler in an attic produces condensate continuously in cooling weather and drains it through a small line that is easy to block. A blocked line overflows the pan; the pan overflows onto the ceiling. The signature is unmistakable once you look for it: it happens in hot humid weather with the system running, it does not care whether it is raining, and it often stops within a day of switching the system off.

Gutters and drainage rather than the roof itself

An overflowing or blocked gutter can push water back behind the fascia and into the eave, producing a stain at the outer edge of a ceiling or at the ceiling-to-wall junction. It only happens in heavy rain, only at one point along the run, and it is visible from the ground while it is happening — which makes it one of the few roof-water problems you can confirm by standing outside with an umbrella.

The water itself is evidence

Roof water is not clean. It has been across a covering and through a cavity, so it carries dirt, mineral staining, and often granules from asphalt shingles, and it leaves a brown or rust-colored ring. Clean, clear water with no staining is a hint away from the roof and toward plumbing or condensation. Like everything else here, that is a probability, not a proof.

1. Clear the room and cut the risk. People and pets out from under it. Nothing electrical touched. If the water is near a fixture, a fan, or a panel, that is the callout at the top of this page and it outranks every other item on this list.
2. Move what matters. Electronics, papers, instruments, and anything that absorbs water, out of the room — and remember that water spreads across the ceiling before it drops, so the safe zone is larger than the wet patch.
3. Catch it, and give it a path. A bucket on a towel, not a bucket on a hard floor, because the noise and the splash are both worse than they need to be. Empty it before it gets heavy.
4. Do not stand under a bulge to drain it. A bulging ceiling is holding water at roughly 8.3 pounds a US gallon. Draining it deliberately is a job done from the side, with a pole, by someone who has decided the ceiling is coming down anyway — and is a reasonable thing to leave to a professional.
5. Photograph before you tidy. Wide shot of the room, then the ceiling, then a close-up with something for scale, then the outside of the building from the ground on every elevation. Same day. Dated by the camera.
6. Start drying immediately. Not because it helps the diagnosis, but because of the clock: EPA guidance is that materials dried within 24–48 hours will in most cases not grow mold. Air movement and, if you have one, a dehumidifier. Do not close the ceiling up.
7. Make the call, and say the right thing. “Water is coming through a ceiling, here is when it happens, here is what the weather was doing” gets a better visit than “my roof is leaking”. If intrusion is ongoing and the covering is visibly damaged, that is an emergency protection job first and a diagnosis second.
8. Then start the log. Once it is safe and contained, the worksheet above is what turns this event into the first row of an answer.

If you are renting, insert one step at the top: report it to the landlord or managing agent in writing, with the photographs, on the day it happens. What a landlord must then do, and how quickly, is set by the tenancy agreement and by the law where you live, and nothing here is a statement about either. What is true everywhere is that a tenant with a dated log and a photograph series is in a materially better position than one with a phone call nobody wrote down.