code_public/logcorrelator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Keep-Alive correlation, TTL management, SIGHUP handling, logrotate support
Some checks failed
Build and Test / test (push) Has been cancelled
Details
Build and Test / build (push) Has been cancelled
Details
Build and Test / docker (push) Has been cancelled
Details

Browse Source 
Major features:
- One-to-many correlation mode (Keep-Alive) for HTTP connections
- Dynamic TTL for network events with reset on each correlation
- Separate configurable buffer sizes for HTTP and network events
- SIGHUP signal handling for log rotation without service restart
- FileSink.Reopen() method for log file rotation
- logrotate configuration included in RPM
- ExecReload added to systemd service

Configuration changes:
- New YAML structure with nested sections (time_window, orphan_policy, matching, buffers, ttl)
- Backward compatibility maintained for deprecated fields

Packaging:
- RPM version 1.1.0 with logrotate config
- Updated spec file and changelog
- All distributions: el8, el9, el10

Tests:
- New tests for Keep-Alive mode and TTL reset
- Updated mocks with Reopen() interface method

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
This commit is contained in:
Jacquin Antoine
2026-03-02 20:32:59 +01:00
parent a415a3201a
commit 33e19b4f52
19 changed files with 974 additions and 321 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
CHANGELOG.md
View File

@ -5,6 +5,36 @@ All notable changes to logcorrelator are documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [1.1.0] - 2026-03-02
### Added
- **Keep-Alive support**: One-to-many correlation mode allows a single network event (B) to correlate with multiple HTTP events (A)
- **Dynamic TTL**: Network events (source B) now have configurable TTL that resets on each successful correlation
- **Separate buffer sizes**: Configurable `max_http_items` and `max_network_items` for independent buffer control
- **SIGHUP handling**: Service now handles SIGHUP signal for log rotation without restart
- **logrotate configuration**: RPM includes `/etc/logrotate.d/logcorrelator` for automatic log rotation
- **ExecReload**: Systemd service now supports `systemctl reload logcorrelator`
### Changed
- **Configuration structure**: New YAML structure with nested sections:
- `time_window` (object with `value` and `unit`)
- `orphan_policy` (object with `apache_always_emit` and `network_emit`)
- `matching.mode` (string: `one_to_one` or `one_to_many`)
- `buffers` (object with `max_http_items` and `max_network_items`)
- `ttl` (object with `network_ttl_s`)
- Backward compatibility maintained for old config fields (`time_window_s`, `emit_orphans`)
### Technical Details
- `CorrelationService` now supports `MatchingMode` configuration
- Network events tracked with individual TTL expiration times
- `FileSink.Reopen()` method for log file rotation
- All sinks implement `Reopen()` interface method
---
## [1.0.7] - 2026-03-01
### Added