—logger_numerics doesn’t apply to status logs
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 23.6k
- Forks
- 2.6k
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 14
Description
Bug report
What operating system and version are you using?
version = 10.16
build = 20F71
platform = darwin
What version of osquery are you using?
What steps did you take to reproduce the issue?
Look at status logs
What did you expect to see?
Numeric fields represented by numbers, not double-quote wrapped strings
{
"hostIdentifier": "CPU",
"calendarTime": "Wed Jun 9 18:29:49 2021 UTC",
"unixTime": 1623263389,
"severity": 0,
"filename": "tls.cpp",
"line": 254,
"message": "TLS/HTTPS POST request to URI: <redacted>",
"version": "4.6.0.2",
"decorations": {
"host_uuid": "6B20EF86-325D-E911-B2B6-00D861595693",
"hostname": "CPU"
}
}
What did you see instead?
Values such as line, severity, and unixTime will always be numeric, yet they are wrapped in double quotes, implying that they are string values. This can cause problems upstream for ingesting these logs when a schema on the data is being enforced.
Sample event:
{
"hostIdentifier": "CPU",
"calendarTime": "Wed Jun 9 18:29:49 2021 UTC",
"unixTime": "1623263389",
"severity": "0",
"filename": "tls.cpp",
"line": "254",
"message": "TLS/HTTPS POST request to URI: <redacted>",
"version": "4.6.0.2",
"decorations": {
"host_uuid": "6B20EF86-325D-E911-B2B6-00D861595693",
"hostname": "CPU"
}
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how status logs are serialized and where logger_numerics is applied. Compare the expected and actual JSON samples, focusing on unixTime, severity, and line. Done means these numeric fields remain JSON numbers rather than quoted strings in status logs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- observability-sre
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100