test: add SIEM integration tests by Manuthor · Pull Request #1115 · Cosmian/kms

Manuthor · 2026-08-11T04:55:52Z

Proves issue #937 (syslog/CEF, SIEM integration):

mise test:audit — tamper-evident JSONL, hash chain, fields
mise test:cef — CEF v27 format (jc), UDP syslog, TCP rsyslog
mise test:siem — fluent-bit, filebeat
mise test:monitoring — OTel+VictoriaMetrics+Grafana stack health

HatemMn

Overall, multiple updates introduced are unrelated to this and should be pushed to a new branch about "Monitoring refactoring"

The last comment, about the docker-file might be a real concern with the codebase that we should have eventually noticed, to be discussed in another future issue

HatemMn · 2026-08-12T12:38:22Z

I think this file is stale documentation from the part that was deleted, shall be deleted too ?

HatemMn · 2026-08-12T12:47:21Z

+#USAGE }
+# Proves ADR-003 (tamper-evident JSONL single-writer) + ADR-004 (HTTP audit middleware).
+# Requires non-fips: audit middleware and CEF features are only in non-fips builds.
+# No Nix shell needed. Uses Cargo to build KMS binary.


Audit is not gated behind non-fips, why this constraint ?

HatemMn · 2026-08-12T12:57:14Z

Why this file is related to this PR ?

HatemMn · 2026-08-12T13:01:51Z

+      - Observability:
+          - Log output: configuration/logging.md
+          - Log call-site reference: configuration/log-reference.md
+          - Metrics & traces (OTLP): configuration/otlp-telemetry.md
+          - Monitoring stack (Grafana): configuration/monitoring-setup.md


To my understanding, this is a doc change related to the Observability stack, maybe this should be deferred to its own PR to avoid errors ?

For example, if logg call-site directory is decided to now become part of the root tree, this comment should be updated to reflect it :

Other thing to note especially if moving this : duckduckgo throws a 404 when someone searches this on google:

https://docs.cosmian.com/key_management_system/configuration/log-reference/

deferred to #1150

HatemMn · 2026-08-12T15:00:55Z

+  syslog_msg="<134>$(date '+%b %d %H:%M:%S') kms-audit: ${line}"
+  # RFC 6587 octet-counting: space between count and message, count = len(message)
+  printf '%zu %s' "${#syslog_msg}" "${syslog_msg}" |


${#msg} is a bash character count, not a byte (or octet) count

in other terms, any non ASCII character in the name field will produce a wrong count, producing an error that might cascade

Also worth checking if the ADRs do follow on this

HatemMn · 2026-08-12T16:02:59Z

+## test
+
+### Database backends
+
+| Task | Default variant | Description |
+|------|-----------------|-------------|
+| `test:sqlite` | fips | SQLite workspace tests |
+| `test:psql` | fips | PostgreSQL tests |
+| `test:mysql` | fips | MySQL tests |
+| `test:percona` | fips | Percona XtraDB tests |
+| `test:mariadb` | fips | MariaDB tests |


why did all this change ?

HatemMn · 2026-08-12T16:06:17Z

+| `result_status` | `"Success"` or `"Failure"` | No | Normalized outcome (after pipeline); use for facets and alerts |
+| `result_error` | string | Yes | Normalized error message (after pipeline); present only on Failure events |
 | `duration_ms` | integer | No | Operation latency |
 | `request_id` | string (UUID) | Yes | Correlation ID across batch operations |


This table lists request_id as a real field, and cef-export.md's devicePayloadId mapping treats it the same way, but audit-logs.md's Event schema table (which is supposed to be the canonical one) doesn't have it at all, not in the table, not in the example JSON, not in the hash-chain field list. Might be worth checking which one is actually right and fixing the other.

(careful: this comment is the result of some LLM analysis, treat it with caution)

HatemMn · 2026-08-12T16:06:29Z

@@ -94,7 +184,9 @@ field extraction, facets, or dashboards:
 | `object_uid` | string | Yes | Target object identifier (KMIP `UniqueIdentifier`) |
 | `algorithm` | string | Yes | Cryptographic algorithm (e.g. `AES`, `RSA`) |
 | `client_ip` | string | Yes | Source IP address |


client_ip here has no caveat attached to it, but on the audit-logs page it's documented as only trustworthy when --audit-trusted-proxy-cidrs is set up correctly, otherwise it's just the peer IP or an XFF value from a proxy nobody configured. This is exactly the table someone would use to wire up SOC dashboards and field mappings, so a short link back to that section would help people not treat this field as always validated.

(careful: this comment is the result of some LLM analysis, treat it with caution)

HatemMn · 2026-08-12T16:06:29Z

+# The message is a syslog PRI header + CEF line.
+while IFS= read -r line; do
+  msg="<134>$(date '+%b %d %H:%M:%S') kms-audit: ${line}"
+  printf '%zu %s' "${#msg}" "${msg}" > /dev/tcp/<host>/5514


This snippet won't actually run outside of bash. printf '%zu %s' ... throws printf: %z: invalid directive on zsh and on dash/sh, tested this live on both. The < <(...) process substitution a few lines below is already bash only too, so it might be worth adding a #!/usr/bin/env bash shebang or at least a note that this needs bash specifically, otherwise someone on macOS (zsh by default) or in a minimal container (dash) copy pastes this and nothing gets sent, with no clue why.

(careful: this comment is the result of some LLM analysis, treat it with caution)

HatemMn · 2026-08-13T12:22:27Z

This file seems like a comment only stale artifact, delete ?

fix: fixes fix: commit fix: manual edits fix: another fix

feat: WIP on feat/audit_and_siem chore: adr feat: fix the limits doc: doc is hard test: integration

feat: fix final flaws feat: fix tests that didn't pass fix: ci fix feat: 2 feat: ci fear: update reverse proxy docs fix: iris fix: another fix fix: restaure iris

…cally

Proves issue #937 (OTel audit push, syslog/CEF, SIEM integration): - mise test:audit — ADR-003/004: tamper-evident JSONL, hash chain, fields - mise test:cef — ADR-005/007: CEF v27 format (jc), UDP syslog, TCP rsyslog - mise test:siem — fluent-bit, filebeat, otlp (64-event OTLP batch guard) - mise test:monitoring — OTel+VictoriaMetrics+Grafana stack health Zero error tolerance: all Docker-prerequisite guards exit 1 (no silent skip). Pre-flight port cleanup prevents stale container conflicts on re-runs. CI: add audit and monitoring matrix entries to test_all.yml. Docs: Mermaid sequence diagrams in audit-logs.md, siems.md, monitoring-setup.md. README: single test table covering all mise test:* commands with ADRs and scripts. lychee: exclude kms.different.com (test placeholder) and percona.com (bot throttle).

…udit (see feat/other_changes_than_audit)

Manuthor force-pushed the feat/audit_integration branch from ed88871 to d6467a7 Compare August 11, 2026 04:59

Manuthor force-pushed the feat/audit_integration branch from 1f8bd3b to 4d6ead1 Compare August 11, 2026 12:49

Manuthor force-pushed the feat/audit_integration branch from 4d6ead1 to 1308d9a Compare August 11, 2026 13:48

Manuthor force-pushed the feat/audit_integration branch from 1308d9a to 9551216 Compare August 11, 2026 16:11

Manuthor force-pushed the feat/audit_integration branch from 9551216 to 3ad51e5 Compare August 11, 2026 19:52

HatemMn requested changes Aug 13, 2026

View reviewed changes

HatemMn changed the base branch from feat/audit_and_siem to feat/audit_startup August 17, 2026 12:03

Manuthor force-pushed the feat/audit_integration branch from 6570e83 to d60fb61 Compare August 20, 2026 06:29

HatemMn and others added 14 commits August 31, 2026 13:00

feat: big commit deleted history

914ea6d

feat: don't log "kmip" only

9519c0a

fix: fixes fix: commit fix: manual edits fix: another fix

feat: amazing update, IDs and algo are now recorded by audit

9863824

feat: WIP on feat/audit_and_siem chore: adr feat: fix the limits doc: doc is hard test: integration

feat: batching now works

588e1d3

feat: fix final flaws feat: fix tests that didn't pass fix: ci fix feat: 2 feat: ci fear: update reverse proxy docs fix: iris fix: another fix fix: restaure iris

test: add coverage for per-user metric labels and cardinality overflow

b1b96d6

fix: stick to CEF v27, create CEF doc page and test CEF format dynami…

68c2e8f

…cally

fix(ui): e2e tests

03a6e8e

fix: ci - wip

c001084

ci: wip

64feafd

docs: clarify SIEM integration

8e4b786

chore: remove OTLP audit

aa7571f

fix: normalize ADR file numbering to match audit_startup convention

21caed3

chore: drop off-topic changes (moved to feat/other_changes_than_audit)

f5eb626

HatemMn added 2 commits August 31, 2026 13:29

fix: post rebase fixes

d2778e0

chore: sync Cargo.lock after post-rebase fixes

cf5411d

HatemMn force-pushed the feat/audit_integration branch from d60fb61 to cf5411d Compare August 31, 2026 13:10

HatemMn mentioned this pull request Aug 31, 2026

Observability stack + Other changes #1150

Open

chore: split off observability/OTel/monitoring content unrelated to a…

a65be7a

…udit (see feat/other_changes_than_audit)

HatemMn assigned Manuthor Aug 31, 2026

Uh oh!

Conversation

Manuthor commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

HatemMn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Manuthor commented Aug 11, 2026 •

edited

Loading