Audit: logging and improvements #28056
Conversation
…ntext sensitivity of sink nodes (file, socket), update eventlogger to include context info in error
peteski22
added
core/audit
hashicorp-contributed-pr
|
CI Results: |
|
Build Results: |
| case <-ctx.Done(): | ||
| return ctx.Err() | ||
| default: | ||
| if s.fileLock.TryLock() { |
There was a problem hiding this comment.
Should there be a small sleep in an else case here? I worry that something could get spinning in here up to 100% CPU. If the lock's not ready then this thread is super busy spinning through this loop non-stop. We had a similar bug recently in Agent/Proxy leading to high CPU usage.
There was a problem hiding this comment.
This same question is true for the similar bit of code in internal/observability/event/sink_socket.go
There was a problem hiding this comment.
Yeah, it's a good point. I've pushed up some changes to just let us queue for the lock (letting Go figure it out) then check the context straight away when we get the lock (potentially just releasing the lock if we're 'done').
| sink.fileLock.Unlock() | ||
|
|
||
| // Just a little bit of time to make sure that 'log' returned and err was set. | ||
| corehelpers.RetryUntil(t, 3*time.Second, func() error { |
Description
This PR improves the audit subsystem:
go-eventloggerlibrary tov0.2.10which includes context errors when needed in logging requests/responsesTRACElogging to indicate when a context must be derived as the existing one is not viable for logging requests/responsesfile,socket) to context cancellationHashiCorp Checklist
getting backported to N-2, use the new style
backport/ent/x.x.x+entlabelsinstead of the old style
backport/x.x.xlabels.the normal
backport/x.x.xlabel (there should be only 1).of a public function, even if that change is in a CE file, double check that
applying the patch for this PR to the ENT repo and running tests doesn't
break any tests. Sometimes ENT only tests rely on public functions in CE
files.
in the PR description, commit message, or branch name.
description. Also, make sure the changelog is in this PR, not in your ENT PR.