DependencyTrack / DependencyTrack/dependency-track

Make use of logback's MDC to add context to log statements

Open
#3,234 0 comments 3 reactions 0 assignees View on GitHub
enhancement p3
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Dependency-Track performs many tasks asynchronously. Status updates, warnings, and errors are logged during task execution, however those logs lack context:

* When BOM processing fails, it's unclear for *which* BOM, uploaded to *what* project
* When VEX processing fails, it's unclear for *which* VEX, uploaded to *what* project
* When repository metadata analysis fails, it's unclear for *which* component, and for *what* repository
* etc.

### Proposed Behavior

Logback offers a feature to add additional context to log statements via [Mapped Diagnostic Context](https://logback.qos.ch/manual/mdc.html) (MDC).

We should use that to attach context information, for example:

* Project UUID, name, version
* Component UUID, name, version
* BOM / VEX format, spec version, serial number, version
* etc.

wherever appropriate. When logging to JSON format, those context variables are represented as dedicated JSON fields and can thus be indexed by log aggregators (Elasticsearch, Splunk, ...).

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Research direction

Start by reviewing Logback's MDC documentation and tracing the asynchronous task paths that log BOM, VEX, repository metadata, and component-analysis failures. Identify which project, component, BOM, VEX, or repository values are available at each logging point. Done means appropriate context appears as dedicated fields in JSON logs without leaking between asynchronous tasks.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, observability-sre
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.