Graylog2 / Graylog2/graylog2-server
Remove 24h backfill default from macOS unified logger collector source
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
The default behavior should be to start at the end of the log stream, not 24h earlier, to be in line with what the other major sources support.
Specifically journald and Windows Event Logs cannot look back in time without processing individual logs, so it's weird if one source behaves differently.
## Current Behavior
The macOS unified logger source has a max-age of 24h as its default that should be 0 by default.
## Possible Solution
Simply change the default, but we need to see if that is enough.
## Steps to Reproduce (for bugs)
n/a this is to have everything behave the same.
## Your Environment
* Graylog Version: 7.2 beta.1
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?
Contributor guide
Research direction
Locate the macOS unified logger collector source and find the default max-age setting. Compare its behavior with the journald and Windows Event Logs sources, change the default to 0, and run the relevant collector tests to confirm the stream starts at the end by default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, macos
- Domain
- backend, observability-sre
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100