Add RFC5424 syslog transport for structured StarIntel events #122

New issue

Open

opened 2026-08-25 09:22:30 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-25 09:22:30 +00:00

(Migrated from github.com)

Goal

Ship the structured events from #121 to the fleet logging backbone without coupling starintel-server to Splunk, ELK, ZincSearch, or another analytics vendor.

Requirements

Add a configurable RFC5424-compatible syslog sink for the #121 event envelope.
Prefer local journald/syslog integration when running under systemd so infrastructure can forward through the standard host path to logs.star.intel.
Where direct remote transport is justified, support TCP/TLS or RELP/TLS through a narrow adapter; no UDP default.
Configuration must cover enable/disable, facility, application name, endpoint/transport where applicable, TLS trust material, queue bounds, reconnect/backoff, and timeout.
Secrets/cert private material must come from runtime credential mechanisms, never source/Nix derivations/logs.
Serialize structured fields safely with bounded event size and deterministic truncation/drop accounting.
Logging transport failure is fail-open for normal operational events and cannot block HTTP/actor execution indefinitely.
Expose transport health and counters for queued/sent/retried/dropped events where practical.

Integration

Coordinate with starintel-infra #56/#57. The normal deployment should use the fleet collector path; this adapter must remain vendor-neutral.

Tests

RFC5424 formatting fixtures.
TLS verification failure behavior.
Collector unavailable/recovery behavior.
Queue-bound/overflow behavior.
Secret-redaction regression fixtures from #121.
Exact-head service-backed integration proving events arrive with expected service/component/event metadata.

Execution mode — AUTO-RAGE

Run the full ADARD/ADADR loop autonomously: research current Common Lisp logging/systemd/syslog paths; design and record the adapter boundary; adversarial review + failure/security threat model; autonomous decision gate; TDD-first implementation; exact-head unit and service-backed verification; push a focused branch and open/update a PR targeting master. Stop only for a genuinely unresolved requirement/security blocker, inaccessible dependency, or failed verification gate. Do not ask for approval between phases.

## Goal Ship the structured events from #121 to the fleet logging backbone without coupling `starintel-server` to Splunk, ELK, ZincSearch, or another analytics vendor. ## Requirements - Add a configurable RFC5424-compatible syslog sink for the #121 event envelope. - Prefer local journald/syslog integration when running under systemd so infrastructure can forward through the standard host path to `logs.star.intel`. - Where direct remote transport is justified, support TCP/TLS or RELP/TLS through a narrow adapter; no UDP default. - Configuration must cover enable/disable, facility, application name, endpoint/transport where applicable, TLS trust material, queue bounds, reconnect/backoff, and timeout. - Secrets/cert private material must come from runtime credential mechanisms, never source/Nix derivations/logs. - Serialize structured fields safely with bounded event size and deterministic truncation/drop accounting. - Logging transport failure is fail-open for normal operational events and cannot block HTTP/actor execution indefinitely. - Expose transport health and counters for queued/sent/retried/dropped events where practical. ## Integration Coordinate with `starintel-infra` #56/#57. The normal deployment should use the fleet collector path; this adapter must remain vendor-neutral. ## Tests - RFC5424 formatting fixtures. - TLS verification failure behavior. - Collector unavailable/recovery behavior. - Queue-bound/overflow behavior. - Secret-redaction regression fixtures from #121. - Exact-head service-backed integration proving events arrive with expected service/component/event metadata. ## Execution mode — AUTO-RAGE Run the full ADARD/ADADR loop autonomously: research current Common Lisp logging/systemd/syslog paths; design and record the adapter boundary; adversarial review + failure/security threat model; autonomous decision gate; TDD-first implementation; exact-head unit and service-backed verification; push a focused branch and open/update a PR targeting `master`. Stop only for a genuinely unresolved requirement/security blocker, inaccessible dependency, or failed verification gate. Do not ask for approval between phases.