You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For some context - there are a large number of fields in the protobuf schema that are not contained in the file/syslog logs. This was done historically for a few of reasons:
To not unintentionally break compatibility. Santa log output followed a standard, but was undocumented. There was concern that not all parsers would properly handle changes to the output. To be conservative and not break users, new fields were often not added.
When streaming, syslog lines are capped to a maximum line length. To prevent lost data due to overflow, data included in the lines was kept more minimal
Structured logging via protobuf is much more easily consumed, has built in parsers, and much better type safety. The general feeling is that consumers should be migrating to protobuf as soon as possible.
Currently Santa does not log the Signing ID or Team ID in the text logs meaning that you can only get to them if you use the
json
orprotobuf
output.This should be put behind a configuration option as we know there are users that are parsing the syslogs directly.
The text was updated successfully, but these errors were encountered: