fix(correlation/bug3): emit pending orphans on B TTL expiry (v1.1.15)
Some checks failed
Build and Test / test (push) Has been cancelled
Build and Test / build (push) Has been cancelled
Build and Test / docker (push) Has been cancelled

cleanNetworkBufferByTTL was deleting pendingOrphans without emitting them,
causing silent data loss when a B event (network connection) expired while
A events were still waiting in the 500ms orphan delay buffer.

Fix: cleanNetworkBufferByTTL now returns []CorrelatedLog for forced orphans;
cleanExpired propagates them; ProcessEvent includes them in returned results.

TestBTTLExpiry_PurgesPendingOrphans extended to assert the orphan is actually
returned in ProcessEvent results (not just removed from internal state).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
toto
2026-03-05 18:20:08 +01:00
parent 0fca6e4e93
commit b47f4258fd
4 changed files with 74 additions and 44 deletions

View File

@ -145,6 +145,13 @@ exit 0
%config(noreplace) /etc/logrotate.d/logcorrelator
%changelog
* Thu Mar 05 2026 logcorrelator <dev@example.com> - 1.1.15-1
- Fix(correlation/bug3): perte de donnees quand B expire avec des orphelins en attente
cleanNetworkBufferByTTL supprimait les pendingOrphans sans les emettre (perte silencieuse).
Desormais, les orphelins A sont retournes immediatement a l'appelant quand B expire,
et cleanExpired/ProcessEvent propagent ces resultats vers le sink.
Test: TestBTTLExpiry_PurgesPendingOrphans etendu pour verifier l'emission effective.
* Thu Mar 05 2026 logcorrelator <dev@example.com> - 1.1.14-1
- Fix(correlation/bug1): Keep-Alive sessions au-dela de TimeWindow ne correlent plus en orphelins
Le matcher dans processSourceA utilisait eventsMatch (comparaison de timestamps) en mode