diff --git a/.chloggen/log.type.yaml b/.chloggen/log.type.yaml new file mode 100644 index 0000000000..94d9093716 --- /dev/null +++ b/.chloggen/log.type.yaml @@ -0,0 +1,22 @@ +# Use this changelog template to create an entry for release notes. +# +# If your change doesn't affect end users you should instead start +# your pull request title with [chore] or use the "Skip Changelog" label. + +# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix' +change_type: enhancement + +# The name of the area of concern in the attributes-registry, (e.g. http, cloud, db) +component: log + +# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`). +note: "Introduce `log.type` attribute to classify log entries by type." + +# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists. +# The values here must be integers. +issues: [ 3429 ] + +# (Optional) One or more lines of additional information to render under the primary note. +# These lines will be padded with 2 spaces and then inserted directly into the document. +# Use pipe (|) for multiline entries. +subtext: diff --git a/docs/general/logs.md b/docs/general/logs.md index 8ec1584ebb..eac876d659 100644 --- a/docs/general/logs.md +++ b/docs/general/logs.md @@ -43,12 +43,22 @@ These attributes may be used for identifying a Log Record. | --- | --- | --- | --- | --- | --- | | [`log.record.original`](/docs/registry/attributes/log.md) | ![Development](https://img.shields.io/badge/-development-blue) | `Opt-In` | string | The complete original Log Record. [1] | `77 <86>1 2015-08-06T21:58:59.694Z 192.168.2.133 inactive - - - Something happened`; `[INFO] 8/3/24 12:34:56 Something happened` | | [`log.record.uid`](/docs/registry/attributes/log.md) | ![Development](https://img.shields.io/badge/-development-blue) | `Opt-In` | string | A unique identifier for the Log Record. [2] | `01ARZ3NDEKTSV4RRFFQ69G5FAV` | +| [`log.type`](/docs/registry/attributes/log.md) | ![Development](https://img.shields.io/badge/-development-blue) | `Opt-In` | string | The type or category of the log record. See below for a list of well-known values. | `audit`; `app` | **[1] `log.record.original`:** This value MAY be added when processing a Log Record which was originally transmitted as a string or equivalent data type AND the Body field of the Log Record does not contain the same value. (e.g. a syslog or a log record read from a file.) **[2] `log.record.uid`:** If an id is provided, other log records with the same id will be considered duplicates and can be removed safely. This means, that two distinguishable log records MUST have different values. The id MAY be an [Universally Unique Lexicographically Sortable Identifier (ULID)](https://github.com/ulid/spec), but other identifiers (e.g. UUID) may be used as needed. +--- + +`log.type` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used. + +| Value | Description | Stability | +| --- | --- | --- | +| `app` | Default regular application log - everything which is NOT audit relevant | ![Development](https://img.shields.io/badge/-development-blue) | +| `audit` | Audit log recording security-relevant activities for compliance and forensics. When log.type='audit', the log record SHOULD not get lost and body not changed. | ![Development](https://img.shields.io/badge/-development-blue) | + diff --git a/docs/registry/attributes/log.md b/docs/registry/attributes/log.md index c4e59774a4..8dccd4374d 100644 --- a/docs/registry/attributes/log.md +++ b/docs/registry/attributes/log.md @@ -16,6 +16,7 @@ This document defines log attributes | Key | Stability | Value Type | Description | Example Values | | --- | --- | --- | --- | --- | | `log.iostream` | ![Development](https://img.shields.io/badge/-development-blue) | string | The stream associated with the log. See below for a list of well-known values. | `stdout`; `stderr` | +| `log.type` | ![Development](https://img.shields.io/badge/-development-blue) | string | The type or category of the log record. See below for a list of well-known values. | `audit`; `app` | --- @@ -26,6 +27,15 @@ This document defines log attributes | `stderr` | Events from stderr stream | ![Development](https://img.shields.io/badge/-development-blue) | | `stdout` | Logs from stdout stream | ![Development](https://img.shields.io/badge/-development-blue) | +--- + +`log.type` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used. + +| Value | Description | Stability | +| --- | --- | --- | +| `app` | Default regular application log - everything which is NOT audit relevant | ![Development](https://img.shields.io/badge/-development-blue) | +| `audit` | Audit log recording security-relevant activities for compliance and forensics. When log.type='audit', the log record SHOULD not get lost and body not changed. | ![Development](https://img.shields.io/badge/-development-blue) | + ## Log File Attributes Attributes for a file to which log was emitted. diff --git a/model/log/common.yaml b/model/log/common.yaml index 47b7af71f5..d228754305 100644 --- a/model/log/common.yaml +++ b/model/log/common.yaml @@ -4,6 +4,8 @@ groups: brief: > The attributes described in this section are rather generic. They may be used in any Log Record they apply to. attributes: + - ref: log.type + requirement_level: opt_in - ref: log.record.uid requirement_level: opt_in - ref: log.record.original diff --git a/model/log/registry.yaml b/model/log/registry.yaml index d42a00e1d3..901762736d 100644 --- a/model/log/registry.yaml +++ b/model/log/registry.yaml @@ -5,6 +5,22 @@ groups: brief: > This document defines log attributes attributes: + - id: log.type + stability: development + brief: > + The type or category of the log record. See below for a list of well-known values. + type: + members: + - id: audit + value: 'audit' + brief: > + Audit log recording security-relevant activities for compliance and forensics. When log.type='audit', the log record SHOULD not get lost and body not changed. + stability: development + - id: application + value: 'app' + brief: 'Default regular application log - everything which is NOT audit relevant' + stability: development + - id: log.iostream stability: development brief: >