DependencyTrack / DependencyTrack/dependency-track
Make use of logback's MDC to add context to log statements
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Dependency-Track performs many tasks asynchronously. Status updates, warnings, and errors are logged during task execution, however those logs lack context:
* When BOM processing fails, it's unclear for *which* BOM, uploaded to *what* project
* When VEX processing fails, it's unclear for *which* VEX, uploaded to *what* project
* When repository metadata analysis fails, it's unclear for *which* component, and for *what* repository
* etc.
### Proposed Behavior
Logback offers a feature to add additional context to log statements via [Mapped Diagnostic Context](https://logback.qos.ch/manual/mdc.html) (MDC).
We should use that to attach context information, for example:
* Project UUID, name, version
* Component UUID, name, version
* BOM / VEX format, spec version, serial number, version
* etc.
wherever appropriate. When logging to JSON format, those context variables are represented as dedicated JSON fields and can thus be indexed by log aggregators (Elasticsearch, Splunk, ...).
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Research direction
Start by reviewing Logback's MDC documentation and tracing the asynchronous task paths that log BOM, VEX, repository metadata, and component-analysis failures. Identify which project, component, BOM, VEX, or repository values are available at each logging point. Done means appropriate context appears as dedicated fields in JSON logs without leaking between asynchronous tasks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, observability-sre
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100