Skip to content

Commit b7779bd

Browse files
johntmyersjohntmyers
authored
feat(sandbox): integrate OCSF structured logging for sandbox events (#720)
* feat(sandbox): integrate OCSF structured logging for all sandbox events WIP: Replace ad-hoc tracing calls with OCSF event builders across all sandbox subsystems (network, SSH, process, filesystem, config, lifecycle). - Register ocsf_logging_enabled setting (defaults false) - Replace stdout/file fmt layers with OcsfShorthandLayer - Add conditional OcsfJsonlLayer for /var/log/openshell-ocsf.log - Update LogPushLayer to extract OCSF shorthand for gRPC push - Migrate ~106 log sites to OCSF builders (NetworkActivity, HttpActivity, SshActivity, ProcessActivity, DetectionFinding, ConfigStateChange, AppLifecycle) - Add openshell-ocsf to all Docker build contexts * fix(scripts): attach provider to all smoke test phases to avoid rate limits GitHub's unauthenticated API rate limit (60/hour) causes flaky 403s for Phases 1, 2, and 4. Fix by attaching the provider to all sandboxes and upgrading the Phase 1 policy to L7 so credential injection works. Phase 4 (tls:skip) cannot inject credentials by design, so relax the assertion to accept either 200 or 403 from upstream -- both prove the proxy forwarded the request. * fix(ocsf): remove timestamp from shorthand format to avoid double-timestamp The display layer (gateway logs, TUI, sandbox logs CLI) already prepends a timestamp. Having one in the shorthand output too produces redundant double-timestamps like: 15:49:11 sandbox INFO 15:49:11.649 I NET:OPEN ALLOWED ... Now the shorthand is just the severity + structured content: 15:49:11 sandbox INFO I NET:OPEN ALLOWED ... * refactor(ocsf): replace single-char severity with bracketed labels Replace cryptic single-character severity codes (I/L/M/H/C/F) with readable bracketed labels: [LOW], [MED], [HIGH], [CRIT], [FATAL]. Informational severity (the happy-path default) is omitted entirely to keep normal log output clean and avoid redundancy with the tracing-level INFO that the display layer already provides. Before: sandbox INFO I NET:OPEN ALLOWED ... After: sandbox INFO NET:OPEN ALLOWED ... Before: sandbox INFO M NET:OPEN DENIED ... After: sandbox INFO [MED] NET:OPEN DENIED ... * feat(sandbox): use OCSF level label for structured events in log push Set the level field to 'OCSF' instead of 'INFO' for OCSF events in the gRPC log push. This visually distinguishes structured OCSF events from plain tracing output in the TUI and CLI sandbox logs: sandbox OCSF NET:OPEN [INFO] ALLOWED python3(42) -> api.example.com:443 sandbox OCSF NET:OPEN [MED] DENIED python3(42) -> blocked.com:443 sandbox INFO Fetching sandbox policy via gRPC * fix(sandbox): convert new Landlock path-skip warning to OCSF PR #677 added a warn!() for inaccessible Landlock paths in best-effort mode. Convert to ConfigStateChangeBuilder with degraded state so it flows through the OCSF shorthand format consistently. * fix(sandbox): use rolling appender for OCSF JSONL file Match the main openshell.log rotation mechanics (daily, 3 files max) instead of a single unbounded append-only file. Prevents disk exhaustion when ocsf_logging_enabled is left on in long-running sandboxes. * fix(sandbox): address reviewer warnings for OCSF integration W1: Remove redundant 'OCSF' prefix from shorthand file layer — the class name (NET:OPEN, HTTP:GET) already identifies structured events and the LogPushLayer separately sets the level field. W2: Log a debug message when OCSF_CTX.set() is called a second time instead of silently discarding via let _. W3: Document the boundary between OCSF-migrated events and intentionally plain tracing calls (DEBUG/TRACE, transient, internal plumbing). W4: Migrate remaining iptables LOG rule failure warnings in netns.rs (IPv4 TCP/UDP, IPv6 TCP/UDP) to ConfigStateChangeBuilder for consistency with the IPv4 bypass rule failure already migrated. W5: Migrate malformed inference request warn to NetworkActivity with ActivityId::Refuse and SeverityId::Medium. W6: Use Medium severity for L7 deny decisions (both CONNECT tunnel and FORWARD proxy paths) to match the CONNECT deny severity pattern. Allows and audits remain Informational. * refactor(sandbox): rename ocsf_logging_enabled to ocsf_json_enabled The shorthand logs are already OCSF-structured events. The setting specifically controls the JSONL file export, so the name should reflect that: ocsf_json_enabled. * fix(ocsf): add timestamps to shorthand file layer output The OcsfShorthandLayer writes directly to the log file with no outer display layer to supply timestamps. Add a UTC timestamp prefix to every line so the file output matches what tracing::fmt used to provide. Before: CONFIG:VALIDATED [INFO] Validated 'sandbox' user exists in image After: 2026-04-01T15:49:11.649Z CONFIG:VALIDATED [INFO] Validated ... * fix(docker): touch openshell-ocsf source to invalidate cargo cache The supervisor-workspace stage touches sandbox and core sources to force recompilation over the rust-deps dummy stubs, but openshell-ocsf was missing. This caused the Docker cargo cache to use stale ocsf objects from the deps stage, preventing changes to the ocsf crate (like the timestamp fix) from appearing in the final binary. Also adds a shorthand layer test verifying timestamp output, and drafts the observability docs section. * fix(ocsf): add OCSF level prefix to file layer shorthand output Without a level prefix, OCSF events in the log file have no visual anchor at the position where standard tracing lines show INFO/WARN. This makes scanning the file harder since the eye has nothing consistent to lock onto after the timestamp. Before: 2026-04-01T04:04:13.065Z CONFIG:DISCOVERY [INFO] ... After: 2026-04-01T04:04:13.065Z OCSF CONFIG:DISCOVERY [INFO] ... * fix(ocsf): clean up shorthand formatting for listen and SSH events - Fix double space in NET:LISTEN, SSH:LISTEN, and other events where action is empty (e.g., 'NET:LISTEN [INFO] 10.200.0.1' -> 'NET:LISTEN [INFO] 10.200.0.1') - Add listen address to SSH:LISTEN event (was empty) - Downgrade SSH handshake intermediate steps (reading preface, verifying) from OCSF events to debug!() traces. Only the final verdict (accepted/denied) is an OCSF event now, reducing noise from 3 events to 1 per SSH connection. - Apply same spacing fix to HTTP shorthand for consistency. * docs(observability): update examples with OCSF prefix and formatting fixes Align doc examples with the deployed output: - Add OCSF level prefix to all shorthand examples in the log file - Show mixed OCSF + standard tracing in the file format section - Update listen events (no double space, SSH includes address) - Show one SSH:OPEN per connection instead of three - Update grep patterns to use 'OCSF NET:' etc. * docs(agents): add OCSF logging guidance to AGENTS.md Add a Sandbox Logging (OCSF) section to AGENTS.md so agents have in-context guidance for deciding whether new log emissions should use OCSF structured logging or plain tracing. Covers event class selection, severity guidelines, builder API usage, dual-emit pattern for security findings, and the no-secrets rule. Also adds openshell-ocsf to the Architecture Overview table. * fix: remove workflow files accidentally included during rebase These files were already merged to main in separate PRs. They got pulled into our branch during rebase conflict resolution for the deleted docs-preview-pr.yml file. * docs(observability): use sandbox connect instead of raw SSH Users access sandboxes via 'openshell sandbox connect', not direct SSH. * fix(docs): correct settings CLI syntax in OCSF JSON export page The settings CLI requires --key and --value named flags, not positional arguments. Also fix the per-sandbox form: the sandbox name is a positional argument, not a --sandbox flag. * fix(e2e): update log assertions for OCSF shorthand format The E2E tests asserted on the old tracing::fmt key=value format (action=allow, l7_decision=audit, FORWARD, L7_REQUEST, always-blocked). Update to match the new OCSF shorthand (ALLOWED/DENIED, HTTP:, NET:, engine:ssrf, policy:). * feat(sandbox): convert WebSocket upgrade log calls to OCSF PR #718 added two log calls for WebSocket upgrade handling: - 101 Switching Protocols info → NetworkActivity with Upgrade activity. This is a significant state change (L7 enforcement drops to raw relay). - Unsolicited 101 without client Upgrade header → DetectionFinding with High severity. A non-compliant upstream sending 101 without a client Upgrade request could be attempting to bypass L7 inspection.
1 parent 428ba4b commit b7779bd

34 files changed

+2471
-542
lines changed

‎AGENTS.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
3535
| `crates/openshell-policy/` | Policy engine | Filesystem, network, process, and inference constraints |
3636
| `crates/openshell-router/` | Privacy router | Privacy-aware LLM routing |
3737
| `crates/openshell-bootstrap/` | Cluster bootstrap | K3s cluster setup, image loading, mTLS PKI |
38+
| `crates/openshell-ocsf/` | OCSF logging | OCSF v1.7.0 event types, builders, shorthand/JSONL formatters, tracing layers |
3839
| `crates/openshell-core/` | Shared core | Common types, configuration, error handling |
3940
| `crates/openshell-providers/` | Provider management | Credential provider backends |
4041
| `crates/openshell-tui/` | Terminal UI | Ratatui-based dashboard for monitoring |
@@ -66,6 +67,85 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
6667
- Store plan documents in `architecture/plans`. This is git ignored so its for easier access for humans. When asked to create Spikes or issues, you can skip to GitHub issues. Only use the plans dir when you aren't writing data somewhere else specific.
6768
- When asked to write a plan, write it there without asking for the location.
6869

70+
## Sandbox Logging (OCSF)
71+
72+
When adding or modifying log emissions in `openshell-sandbox`, determine whether the event should use OCSF structured logging or plain `tracing`.
73+
74+
### When to use OCSF
75+
76+
Use an OCSF builder + `ocsf_emit!()` for events that represent **observable sandbox behavior** visible to operators, security teams, or agents monitoring the sandbox:
77+
78+
- Network decisions (allow, deny, bypass detection)
79+
- HTTP/L7 enforcement decisions
80+
- SSH authentication (accepted, denied, nonce replay)
81+
- Process lifecycle (start, exit, timeout, signal failure)
82+
- Security findings (unsafe policy, unavailable controls, replay attacks)
83+
- Configuration changes (policy load/reload, TLS setup, inference routes, settings)
84+
- Application lifecycle (supervisor start, SSH server ready)
85+
86+
### When to use plain tracing
87+
88+
Use `info!()`, `debug!()`, `warn!()` for **internal operational plumbing** that doesn't represent a security decision or observable state change:
89+
90+
- gRPC connection attempts and retries
91+
- "About to do X" events where the result is logged separately
92+
- Internal SSH channel state (unknown channel, PTY resize)
93+
- Zombie process reaping, denial flush telemetry
94+
- DEBUG/TRACE level diagnostics
95+
96+
### Choosing the OCSF event class
97+
98+
| Event type | Builder | When to use |
99+
|---|---|---|
100+
| TCP connections, proxy tunnels, bypass | `NetworkActivityBuilder` | L4 network decisions, proxy operational events |
101+
| HTTP requests, L7 enforcement | `HttpActivityBuilder` | Per-request method/path decisions |
102+
| SSH sessions | `SshActivityBuilder` | Authentication, channel operations |
103+
| Process start/stop | `ProcessActivityBuilder` | Entrypoint lifecycle, signal failures |
104+
| Security alerts | `DetectionFindingBuilder` | Nonce replay, bypass detection, unsafe policy. Dual-emit with the domain event. |
105+
| Policy/config changes | `ConfigStateChangeBuilder` | Policy load, Landlock apply, TLS setup, inference routes, settings |
106+
| Supervisor lifecycle | `AppLifecycleBuilder` | Sandbox start, SSH server ready/failed |
107+
108+
### Severity guidelines
109+
110+
| Severity | When |
111+
|---|---|
112+
| `Informational` | Allowed connections, successful operations, config loaded |
113+
| `Low` | DNS failures, non-fatal operational warnings, LOG rule failures |
114+
| `Medium` | Denied connections, policy violations, deprecated config |
115+
| `High` | Security findings (nonce replay, Landlock unavailable) |
116+
| `Critical` | Process timeout kills |
117+
118+
### Example: adding a new network event
119+
120+
```rust
121+
use openshell_ocsf::{
122+
ocsf_emit, NetworkActivityBuilder, ActivityId, ActionId,
123+
DispositionId, Endpoint, Process, SeverityId, StatusId,
124+
};
125+
126+
let event = NetworkActivityBuilder::new(crate::ocsf_ctx())
127+
.activity(ActivityId::Open)
128+
.action(ActionId::Denied)
129+
.disposition(DispositionId::Blocked)
130+
.severity(SeverityId::Medium)
131+
.status(StatusId::Failure)
132+
.dst_endpoint(Endpoint::from_domain(&host, port))
133+
.actor_process(Process::new(&binary, pid))
134+
.firewall_rule(&policy_name, &engine_type)
135+
.message(format!("CONNECT denied {host}:{port}"))
136+
.build();
137+
ocsf_emit!(event);
138+
```
139+
140+
### Key points
141+
142+
- `crate::ocsf_ctx()` returns the process-wide `SandboxContext`. It is always available (falls back to defaults in tests).
143+
- `ocsf_emit!()` is non-blocking and cannot panic. It stores the event in a thread-local and emits via `tracing::info!()`.
144+
- The shorthand layer and JSONL layer extract the event from the thread-local. The shorthand format is derived automatically from the builder fields.
145+
- For security findings, **dual-emit**: one domain event (e.g., `SshActivityBuilder`) AND one `DetectionFindingBuilder` for the same incident.
146+
- Never log secrets, credentials, or query parameters in OCSF messages. The OCSF JSONL file may be shipped to external systems.
147+
- The `message` field should be a concise, grep-friendly summary. Details go in builder fields (dst_endpoint, firewall_rule, etc.).
148+
69149
## Sandbox Infra Changes
70150

71151
- If you change sandbox infrastructure, ensure `mise run sandbox` succeeds.

‎Cargo.lock‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎crates/openshell-core/src/settings.rs‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,13 @@ pub struct RegisteredSetting {
4949
/// keys are accepted.
5050
/// 5. Add a unit test in this module's `tests` section to cover the new key.
5151
pub const REGISTERED_SETTINGS: &[RegisteredSetting] = &[
52-
// Production settings go here. Add entries following the steps above.
53-
//
52+
// When true the sandbox writes OCSF v1.7.0 JSONL records to
53+
// `/var/log/openshell-ocsf*.log` (daily rotation, 3 files) in addition
54+
// to the human-readable shorthand log. Defaults to false (no JSONL written).
55+
RegisteredSetting {
56+
key: "ocsf_json_enabled",
57+
kind: SettingValueKind::Bool,
58+
},
5459
// Test-only keys live behind the `dev-settings` feature flag so they
5560
// don't appear in production builds.
5661
#[cfg(feature = "dev-settings")]

‎crates/openshell-ocsf/src/format/shorthand.rs‎

Lines changed: 68 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,37 @@ pub fn severity_char(severity_id: u8) -> char {
3636
}
3737
}
3838

39+
/// Format the severity as a bracketed tag placed after the `CLASS:ACTIVITY`.
40+
///
41+
/// Placed as a suffix so the class name always starts at column 0, keeping
42+
/// logs vertically scannable:
43+
///
44+
/// ```text
45+
/// NET:OPEN [INFO] ALLOWED python3(42) -> api.example.com:443
46+
/// NET:OPEN [MED] DENIED python3(42) -> blocked.com:443
47+
/// FINDING:BLOCKED [HIGH] "NSSH1 Nonce Replay Attack"
48+
/// ```
49+
#[must_use]
50+
pub fn severity_tag(severity_id: u8) -> &'static str {
51+
match severity_id {
52+
1 => "[INFO]",
53+
2 => "[LOW]",
54+
3 => "[MED]",
55+
4 => "[HIGH]",
56+
5 => "[CRIT]",
57+
6 => "[FATAL]",
58+
_ => "[INFO]",
59+
}
60+
}
61+
3962
impl OcsfEvent {
4063
/// Produce the single-line shorthand for `openshell.log` and gRPC log push.
4164
///
4265
/// This is a display-only projection — the full OCSF JSON is the source of truth.
4366
#[must_use]
4467
pub fn format_shorthand(&self) -> String {
4568
let base = self.base();
46-
let ts = format_ts(base.time);
47-
let sev = severity_char(base.severity.as_u8());
69+
let sev = severity_tag(base.severity.as_u8());
4870

4971
match self {
5072
Self::NetworkActivity(e) => {
@@ -85,7 +107,13 @@ impl OcsfEvent {
85107
format!(" {actor_str} -> {dst}")
86108
};
87109

88-
format!("{ts} {sev} NET:{activity} {action}{arrow}{rule_ctx}")
110+
let detail = match (action.is_empty(), arrow.is_empty()) {
111+
(true, true) => String::new(),
112+
(true, false) => arrow,
113+
(false, true) => format!(" {action}"),
114+
(false, false) => format!(" {action}{arrow}"),
115+
};
116+
format!("NET:{activity} {sev}{detail}{rule_ctx}")
89117
}
90118

91119
Self::HttpActivity(e) => {
@@ -116,7 +144,13 @@ impl OcsfEvent {
116144
format!(" {actor_str} -> {method} {url_str}")
117145
};
118146

119-
format!("{ts} {sev} HTTP:{method} {action}{arrow}{rule_ctx}")
147+
let detail = match (action.is_empty(), arrow.is_empty()) {
148+
(true, true) => String::new(),
149+
(true, false) => arrow,
150+
(false, true) => format!(" {action}"),
151+
(false, false) => format!(" {action}{arrow}"),
152+
};
153+
format!("HTTP:{method} {sev}{detail}{rule_ctx}")
120154
}
121155

122156
Self::SshActivity(e) => {
@@ -143,7 +177,21 @@ impl OcsfEvent {
143177
})
144178
.unwrap_or_default();
145179

146-
format!("{ts} {sev} SSH:{activity} {action} {peer}{auth_ctx}")
180+
let detail = [
181+
if action.is_empty() { "" } else { &action },
182+
if peer.is_empty() { "" } else { &peer },
183+
]
184+
.iter()
185+
.filter(|s| !s.is_empty())
186+
.copied()
187+
.collect::<Vec<_>>()
188+
.join(" ");
189+
let detail = if detail.is_empty() {
190+
String::new()
191+
} else {
192+
format!(" {detail}")
193+
};
194+
format!("SSH:{activity} {sev}{detail}{auth_ctx}")
147195
}
148196

149197
Self::ProcessActivity(e) => {
@@ -160,7 +208,7 @@ impl OcsfEvent {
160208
.map(|c| format!(" [cmd:{c}]"))
161209
.unwrap_or_default();
162210

163-
format!("{ts} {sev} PROC:{activity} {proc_str}{exit_ctx}{cmd_ctx}")
211+
format!("PROC:{activity} {sev} {proc_str}{exit_ctx}{cmd_ctx}")
164212
}
165213

166214
Self::DetectionFinding(e) => {
@@ -173,7 +221,7 @@ impl OcsfEvent {
173221
.map(|c| format!(" [confidence:{}]", c.label().to_lowercase()))
174222
.unwrap_or_default();
175223

176-
format!("{ts} {sev} FINDING:{disposition} \"{title}\"{confidence_ctx}")
224+
format!("FINDING:{disposition} {sev} \"{title}\"{confidence_ctx}")
177225
}
178226

179227
Self::ApplicationLifecycle(e) => {
@@ -185,7 +233,7 @@ impl OcsfEvent {
185233
.map(|s| s.label().to_lowercase())
186234
.unwrap_or_default();
187235

188-
format!("{ts} {sev} LIFECYCLE:{activity} {app} {status}")
236+
format!("LIFECYCLE:{activity} {sev} {app} {status}")
189237
}
190238

191239
Self::DeviceConfigStateChange(e) => {
@@ -214,7 +262,7 @@ impl OcsfEvent {
214262
})
215263
.unwrap_or_default();
216264

217-
format!("{ts} {sev} CONFIG:{state} {what}{version_ctx}")
265+
format!("CONFIG:{state} {sev} {what}{version_ctx}")
218266
}
219267

220268
Self::Base(e) => {
@@ -240,7 +288,7 @@ impl OcsfEvent {
240288
})
241289
.unwrap_or_default();
242290

243-
format!("{ts} {sev} EVENT {message}{unmapped_ctx}")
291+
format!("EVENT {sev} {message}{unmapped_ctx}")
244292
}
245293
}
246294
}
@@ -337,7 +385,7 @@ mod tests {
337385
let shorthand = event.format_shorthand();
338386
assert_eq!(
339387
shorthand,
340-
"14:00:00.000 I NET:OPEN ALLOWED python3(42) -> api.example.com:443 [policy:default-egress engine:mechanistic]"
388+
"NET:OPEN [INFO] ALLOWED python3(42) -> api.example.com:443 [policy:default-egress engine:mechanistic]"
341389
);
342390
}
343391

@@ -366,7 +414,7 @@ mod tests {
366414
let shorthand = event.format_shorthand();
367415
assert_eq!(
368416
shorthand,
369-
"14:00:00.000 M NET:REFUSE DENIED node(1234) -> 93.184.216.34:443/tcp [policy:bypass-detect engine:iptables]"
417+
"NET:REFUSE [MED] DENIED node(1234) -> 93.184.216.34:443/tcp [policy:bypass-detect engine:iptables]"
370418
);
371419
}
372420

@@ -395,7 +443,7 @@ mod tests {
395443
let shorthand = event.format_shorthand();
396444
assert_eq!(
397445
shorthand,
398-
"14:00:00.000 I HTTP:GET ALLOWED curl(88) -> GET https://api.example.com/v1/data [policy:default-egress]"
446+
"HTTP:GET [INFO] ALLOWED curl(88) -> GET https://api.example.com/v1/data [policy:default-egress]"
399447
);
400448
}
401449

@@ -416,7 +464,7 @@ mod tests {
416464
let shorthand = event.format_shorthand();
417465
assert_eq!(
418466
shorthand,
419-
"14:00:00.000 I SSH:OPEN ALLOWED 10.42.0.1:48201 [auth:NSSH1]"
467+
"SSH:OPEN [INFO] ALLOWED 10.42.0.1:48201 [auth:NSSH1]"
420468
);
421469
}
422470

@@ -435,7 +483,7 @@ mod tests {
435483
let shorthand = event.format_shorthand();
436484
assert_eq!(
437485
shorthand,
438-
"14:00:00.000 I PROC:LAUNCH python3(42) [cmd:python3 /app/main.py]"
486+
"PROC:LAUNCH [INFO] python3(42) [cmd:python3 /app/main.py]"
439487
);
440488
}
441489

@@ -459,10 +507,7 @@ mod tests {
459507
});
460508

461509
let shorthand = event.format_shorthand();
462-
assert_eq!(
463-
shorthand,
464-
"14:00:00.000 I PROC:TERMINATE python3(42) [exit:0]"
465-
);
510+
assert_eq!(shorthand, "PROC:TERMINATE [INFO] python3(42) [exit:0]");
466511
}
467512

468513
#[test]
@@ -487,7 +532,7 @@ mod tests {
487532
let shorthand = event.format_shorthand();
488533
assert_eq!(
489534
shorthand,
490-
"14:00:00.000 H FINDING:BLOCKED \"NSSH1 Nonce Replay Attack\" [confidence:high]"
535+
"FINDING:BLOCKED [HIGH] \"NSSH1 Nonce Replay Attack\" [confidence:high]"
491536
);
492537
}
493538

@@ -514,7 +559,7 @@ mod tests {
514559
let shorthand = event.format_shorthand();
515560
assert_eq!(
516561
shorthand,
517-
"14:00:00.000 I LIFECYCLE:START openshell-sandbox success"
562+
"LIFECYCLE:START [INFO] openshell-sandbox success"
518563
);
519564
}
520565

@@ -536,7 +581,7 @@ mod tests {
536581
let shorthand = event.format_shorthand();
537582
assert_eq!(
538583
shorthand,
539-
"14:00:00.000 I CONFIG:LOADED policy reloaded [version:v3 hash:sha256:abc123def456]"
584+
"CONFIG:LOADED [INFO] policy reloaded [version:v3 hash:sha256:abc123def456]"
540585
);
541586
}
542587

@@ -551,7 +596,7 @@ mod tests {
551596
let shorthand = event.format_shorthand();
552597
assert_eq!(
553598
shorthand,
554-
"14:00:00.000 I EVENT Network namespace created [ns:openshell-sandbox-abc123]"
599+
"EVENT [INFO] Network namespace created [ns:openshell-sandbox-abc123]"
555600
);
556601
}
557602
}

‎crates/openshell-ocsf/src/lib.rs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,4 +62,6 @@ pub use builders::{
6262
};
6363

6464
// --- Tracing layers ---
65-
pub use tracing_layers::{OcsfJsonlLayer, OcsfShorthandLayer, emit_ocsf_event};
65+
pub use tracing_layers::{
66+
OCSF_TARGET, OcsfJsonlLayer, OcsfShorthandLayer, clone_current_event, emit_ocsf_event,
67+
};

0 commit comments

Comments
 (0)