Files
logstream/selflog.go
cedricandClaude Opus 5.5 076c01aac4 Linux audit (auditd) source and LogStream internal logs
Audit source (source_type=audit), off until enabled in Settings > Sources:
- follows /var/log/audit/audit.log (path configurable, AUDIT_LOG), with
  rotation (end of audit.log.1 read first) and an offset checkpoint in
  /data/audit-state.json; last AUDIT_BACKFILL (1h) read on first enable
- groups the records of an event by msg=audit(time:serial), closed on EOE,
  after 2 s without a record, or once the log has moved 2 s past it
- fields audit_type, audit_serial, auid, user (enriched name, host
  /etc/passwd or uid), exe, res, key, audit_raw; app = audit_type, host =
  node= / AUDIT_HOST / /host/etc/hostname; summary "who: what [key] →
  result"; warning when res=failed / success=no, info otherwise
- hexadecimal values (proctitle, cmd, exec arguments…) decoded

Internal logs (source_type=logstream, host=logstream, app=component):
- logEvent() for VictoriaLogs unreachable / back, lost batches, spooled
  batches refused, syslog listener errors, Docker API and container
  streams lost, failing sources, start and stop
- on by default from warning; switch and minimum level in Settings >
  Sources (/data/selflog.json)
- bounded queue, never waits for the Store, same event at most once per
  30 s with a count of the repeats: a failing Store cannot loop

UI: violet (audit) and turquoise (LogStream) left edge and tint, AUDIT /
LS badge before the app, raw audit record under the summary (folded in
compact density until the row is opened), Audit and LogStream in the
source filter, FR/EN translations. docker-compose: optional
/var/log/audit, /etc/passwd and /etc/hostname mounts. README (EN/FR):
host prerequisites (log_group, ACL for UID 10001).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-04 15:01:58 +02:00

188 lines
4.5 KiB
Go

package main
import (
"context"
"encoding/json"
"fmt"
"log"
"os"
"path/filepath"
"sync"
"time"
)
// selfLogConfig is saved in /data/selflog.json and edited in Settings > Sources.
type selfLogConfig struct {
Enabled bool `json:"enabled"`
MinLevel string `json:"min_level"` // severity name: "err", "warning", "notice", "info"…
}
// SelfLog turns the internal events of LogStream (storage errors, listener
// failures, sources that stop…) into log entries, with host=logstream and
// app=component. Events go through a bounded queue and a per-message
// throttle: an event about a failing Store is itself stored through that
// Store, so it must never be able to loop or pile up.
type SelfLog struct {
cfgPath string
sink func(*Entry)
queue chan *Entry
interval time.Duration // one event per component and message format per interval
mu sync.Mutex
cfg selfLogConfig
last map[string]time.Time
suppressed map[string]int
emitted uint64
dropped uint64
throttled uint64
}
// selfLog receives the events of logEvent; nil (tests) only writes them to
// the process log.
var selfLog *SelfLog
func NewSelfLog(dataDir string, sink func(*Entry)) *SelfLog {
s := &SelfLog{
cfgPath: filepath.Join(dataDir, "selflog.json"),
sink: sink,
queue: make(chan *Entry, 256),
interval: 30 * time.Second,
cfg: selfLogConfig{Enabled: true, MinLevel: "warning"},
last: map[string]time.Time{},
suppressed: map[string]int{},
}
if b, err := os.ReadFile(s.cfgPath); err == nil {
var cfg selfLogConfig
if json.Unmarshal(b, &cfg) == nil {
s.cfg = normSelfLogConfig(cfg)
}
}
return s
}
func normSelfLogConfig(cfg selfLogConfig) selfLogConfig {
if sevNum(cfg.MinLevel) < 0 {
cfg.MinLevel = "warning"
}
return cfg
}
func sevNum(name string) int {
for i, n := range severityNames {
if n == name {
return i
}
}
return -1
}
// logEvent writes an internal event to the process log and, when the
// self-logs source is on and the level is high enough, emits it as an entry.
// sev is a syslog severity (3 err, 4 warning, 5 notice, 6 info).
func logEvent(component string, sev int, format string, args ...any) {
msg := fmt.Sprintf(format, args...)
log.Printf("%s: %s", component, msg)
if s := selfLog; s != nil {
s.Emit(component, sev, format, msg, time.Now())
}
}
// Emit queues an event without ever blocking. The same component and message
// format are let through once per interval; the next one says how many were
// left out in between.
func (s *SelfLog) Emit(component string, sev int, format, msg string, now time.Time) {
sev = min(max(sev, 0), 7)
key := component + "\x00" + format
s.mu.Lock()
if !s.cfg.Enabled || sev > sevNum(s.cfg.MinLevel) {
s.mu.Unlock()
return
}
if t, ok := s.last[key]; ok && now.Sub(t) < s.interval {
s.suppressed[key]++
s.throttled++
s.mu.Unlock()
return
}
s.last[key] = now
if n := s.suppressed[key]; n > 0 {
msg += fmt.Sprintf(" (%d similar events not shown)", n)
delete(s.suppressed, key)
}
if len(s.last) > 1000 { // formats are constants: only a bug could get here
clear(s.last)
}
s.mu.Unlock()
e := &Entry{
Time: now,
Received: now,
Host: "logstream",
App: component,
Facility: "syslog",
Severity: severityNames[sev],
SevNum: sev,
Message: msg,
Proto: "internal",
SourceType: "logstream",
// Wait stays false: when the Store queue is full, the event is dropped
// instead of blocking the component that reports it.
}
select {
case s.queue <- e:
default:
s.mu.Lock()
s.dropped++
s.mu.Unlock()
}
}
// Run hands the queued events to the sink until the context ends, then
// delivers what is left (the stop event among them).
func (s *SelfLog) Run(ctx context.Context) {
for {
select {
case e := <-s.queue:
s.deliver(e)
case <-ctx.Done():
for {
select {
case e := <-s.queue:
s.deliver(e)
default:
return
}
}
}
}
}
func (s *SelfLog) deliver(e *Entry) {
s.sink(e)
s.mu.Lock()
s.emitted++
s.mu.Unlock()
}
// Configure saves and applies the configuration.
func (s *SelfLog) Configure(cfg selfLogConfig) error {
cfg = normSelfLogConfig(cfg)
s.mu.Lock()
s.cfg = cfg
s.mu.Unlock()
return writeJSONFile(s.cfgPath, cfg)
}
// Status is the state shown in Settings > Sources.
func (s *SelfLog) Status() map[string]any {
s.mu.Lock()
defer s.mu.Unlock()
return map[string]any{
"enabled": s.cfg.Enabled,
"min_level": s.cfg.MinLevel,
"emitted": s.emitted,
"dropped": s.dropped,
"throttled": s.throttled,
}
}