Skip to content

feat: auditlog syslog writer #1383

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

Serjick
Copy link

@Serjick Serjick commented Jul 5, 2025

Thank you for contributing to Coraza WAF, your effort is greatly appreciated
Before submitting check if what you want to add to coraza list meets quality standards before sending pull request. Thanks!

Make sure that you've checked the boxes below before you submit PR:

Summary:
Implementation of plugintypes.AuditLogWriter to send audit logs into syslog. Stdlib log/syslog package has been used, so no extra dependencies needed.
Writes directed into local0 syslog facility with LOG_INFO severity by default. Interrupted transactions will have LOG_ERR severity.

Changes:
SecAuditLogType directive now accept syslog value.
SecAuditLog directive now accept all supported by log/syslog values of network and raddr by pattern network://raddr (e.g. udp://127.0.0.1:514, unixgram:///var/run/syslog). Empty value will force log/syslog to select destination by it's internal logic.

Limitations:
Not available for tinygo because of not verified log/syslog support.
Not available for windows and plan9 operating systems because of log/syslog limitations.

Thanks for your contribution ❤️

@Serjick Serjick requested a review from a team as a code owner July 5, 2025 11:05
@fzipi fzipi changed the title Auditlog Syslog writer feat: auditlog syslog writer Jul 6, 2025
Copy link

codecov bot commented Jul 6, 2025

Codecov Report

Attention: Patch coverage is 67.44186% with 14 lines in your changes missing coverage. Please review.

Project coverage is 84.27%. Comparing base (d0ca474) to head (d1e6583).

Files with missing lines Patch % Lines
internal/auditlog/syslog_writer.go 70.27% 8 Missing and 3 partials ⚠️
internal/auditlog/init_tinygo.go 0.00% 2 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1383      +/-   ##
==========================================
- Coverage   84.34%   84.27%   -0.08%     
==========================================
  Files         170      171       +1     
  Lines        9933     9976      +43     
==========================================
+ Hits         8378     8407      +29     
- Misses       1310     1320      +10     
- Partials      245      249       +4     
Flag Coverage Δ
coraza.rule.case_sensitive_args_keys 84.23% <67.44%> (-0.08%) ⬇️
coraza.rule.multiphase_evaluation 83.93% <67.44%> (-0.08%) ⬇️
coraza.rule.no_regex_multiline 84.21% <67.44%> (-0.08%) ⬇️
default 84.27% <67.44%> (-0.08%) ⬇️
examples+ 16.25% <0.00%> (-0.08%) ⬇️
examples+coraza.rule.case_sensitive_args_keys 84.23% <67.44%> (-0.08%) ⬇️
examples+coraza.rule.multiphase_evaluation 83.77% <67.44%> (-0.08%) ⬇️
examples+coraza.rule.no_regex_multiline 84.13% <67.44%> (-0.08%) ⬇️
examples+memoize_builders 84.24% <72.50%> (-0.08%) ⬇️
examples+no_fs_access 81.62% <67.44%> (-0.07%) ⬇️
ftw 84.27% <67.44%> (-0.08%) ⬇️
memoize_builders 84.37% <72.50%> (-0.08%) ⬇️
no_fs_access 83.77% <67.44%> (-0.08%) ⬇️
tinygo 84.24% <67.44%> (-0.08%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Serjick Serjick force-pushed the auditlog_syslog branch from d1e6583 to dd946d7 Compare July 7, 2025 07:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants