search

northpolesec / santa

A binary authorization and monitoring system for macOS
https://northpole.dev
Apache License 2.0
68 stars 8 forks source link

Add Signing ID to the Text / Syslog logs #137

Open pmarkowsky opened 2 days ago

pmarkowsky commented 2 days ago

Currently Santa does not log the Signing ID or Team ID in the text logs meaning that you can only get to them if you use the json or protobuf output.

This should be put behind a configuration option as we know there are users that are parsing the syslogs directly.

mlw commented 2 days ago

For some context - there are a large number of fields in the protobuf schema that are not contained in the file/syslog logs. This was done historically for a few of reasons:

  1. To not unintentionally break compatibility. Santa log output followed a standard, but was undocumented. There was concern that not all parsers would properly handle changes to the output. To be conservative and not break users, new fields were often not added.
  2. When streaming, syslog lines are capped to a maximum line length. To prevent lost data due to overflow, data included in the lines was kept more minimal
  3. Structured logging via protobuf is much more easily consumed, has built in parsers, and much better type safety. The general feeling is that consumers should be migrating to protobuf as soon as possible.