Project

General

Profile

Actions

Optimization #3314

open

rust: integrate log crate with suricata logging

Added by Victor Julien almost 5 years ago. Updated almost 5 years ago.

Status:
Feedback
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Make sure macros like debug!, info!, warn! etc. are useable and plugged to suricata's logging functions.

Actions #1

Updated by Victor Julien almost 5 years ago

Pierre do you have an idea about how this can be done?

Actions #2

Updated by Jason Ish almost 5 years ago

There are some issues we would run into here. The Rust std log implements:
- error
- warn
- info
- debug
- trace

All these follow the same call pattern, and do not give us a place to pass the code in error and warn. We could certainly intercept all these and pass them to our logging system with some default error code where required.

A pattern I've seen is an implemenatation of these so you get output when call them, but then application specific macros (ie: scwarn!, scerr!) where a lot more application specific context was added to meet the business requirements.

I'm not sure if looking into larger log implementations is worth it at this time as we're still best off passing to the C implementation of our logger for the forseeable future.

Actions #3

Updated by Danny Browning almost 5 years ago

Log crate doesn't actually provide a logger implementation, so we would have to implement a logger that can receive them, and pass them to the C implementation.

For error and warn, can use a generic error code.

Actions #4

Updated by Victor Julien almost 5 years ago

The error code concern might go away depending how we deal with #3160.

Actions #5

Updated by Jason Ish almost 5 years ago

I think I need a little reminder as to why this is necessary. I've created a PR that implements a logger here:

https://github.com/OISF/suricata/pull/4365

The only benefit I see is that we can now see the output from external crates that may log diagnostic information using the standard log macros. There is not much benefit for us to use it in tree.

Idea: Rename macros like SCLogNotice to simply scnotice!() (scinfo, scerror, etc) if that would help make this more usable, feel more Rusty.

Actions

Also available in: Atom PDF