Skip to content

Add initial audit logging pipeline (API, SDK, OTLP exporter, and autoconfigure)#7

Open
hilmarf wants to merge 27 commits into
mainfrom
auditing
Open

Add initial audit logging pipeline (API, SDK, OTLP exporter, and autoconfigure)#7
hilmarf wants to merge 27 commits into
mainfrom
auditing

Conversation

@hilmarf

@hilmarf hilmarf commented Apr 28, 2026

Copy link
Copy Markdown
Member

Summary

This PR introduces an initial end-to-end audit logging pipeline for OpenTelemetry Java, including new API and SDK modules, OTLP HTTP export support, and autoconfiguration wiring.

What changed

  • Added a new Audit API module with core audit types and contracts, including:
    • provider and global provider access
    • logger and logger builder
    • audit record builder and receipt model
    • actor/outcome semantics and delivery exception handling
  • Added a new Audit SDK module with runtime implementation, including:
    • SDK audit provider and logger implementations
    • read/write record model
    • exporter and processor contracts
    • processor implementations (simple, batch, multi, noop)
    • in-memory exporter for testing scenarios
  • Added a new OTLP HTTP audit exporter module:
    • OTLP audit record data adapter
    • HTTP exporter and builder for audit records
  • Added autoconfigure integration for audit:
    • audit provider configuration bootstrap
    • audit exporter selection and SPI loading
    • new SPI interface for configurable audit exporters
  • Wired new modules into the build:
    • included new projects in settings
    • added audit SDK to the sdk aggregate module
  • Added a GitHub workflow for fork synchronization:
    • sync-fork.yaml

Configuration behavior

  • New property: otel.audit.exporter
  • Default exporter: otlp
  • Special value: none (disables audit exporting)
  • Validation: configuration fails if none is combined with other exporters or if an unknown exporter name is configured

Why

This lays the foundation for first-class audit logging support in OpenTelemetry Java with:

  • clear API/SDK separation
  • pluggable exporter model
  • out-of-the-box OTLP export path
  • autoconfigure-based runtime setup

Notes

  • This change is primarily additive and introduces new modules and integration points.
  • No existing tracing/metrics/logging APIs are replaced by this PR.

@hilmarf hilmarf force-pushed the auditing branch 2 times, most recently from 50b5619 to beec303 Compare June 8, 2026 14:10
@apeirora-bot

apeirora-bot Bot commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ API changes detected — additional maintainer review required

@jack-berg @jkwatson

This PR modifies the public API surface area of the following module(s):

  • opentelemetry-api
  • opentelemetry-common
  • opentelemetry-context
  • opentelemetry-exporter-common
  • opentelemetry-exporter-logging
  • opentelemetry-exporter-logging-otlp
  • opentelemetry-exporter-zipkin
  • opentelemetry-extension-kotlin
  • opentelemetry-extension-trace-propagators
  • opentelemetry-opentracing-shim
  • opentelemetry-sdk
  • opentelemetry-sdk-extension-autoconfigure-spi

Please review the changes in docs/apidiffs/current_vs_latest/ carefully before approving.

@hilmarf hilmarf moved this from Backlog to In progress in OTel-Audit-Logging Jun 9, 2026
@hilmarf hilmarf force-pushed the main branch 2 times, most recently from 6e99b21 to e768afa Compare June 10, 2026 15:15
@CLAassistant

CLAassistant commented Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@jkwatson

jkwatson commented Jun 11, 2026

Copy link
Copy Markdown

I think you probably don't want to be running all of the core github actions on your fork....

@hilmarf hilmarf force-pushed the main branch 2 times, most recently from 1a17e0d to 98d9423 Compare June 26, 2026 15:02
hilmarf added 11 commits June 26, 2026 17:03
@hilmarf
Add initial audit logging pipeline:
0fc5d2a 
- API
- SDK
- OTLP exporter
- autoconfigure

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
Ensure GHA work properly on fork or are disabled!
286d3a2 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
refactor: migrated the separate package api\audit into api\all
ab977fa 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
refactored fields to attributes
0cf1ed0 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
integrityValue + algorithm + certificate
2b42761 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
Add audit signal tests, fix exporter imports, update apidiffs and bui…
7228c89 
…ld config

- Add unit tests for SdkAuditProvider, SimpleAuditRecordProcessor,
  BatchAuditRecordProcessor, and AuditLogRecordDataAdapter
- Fix OtlpHttpAuditRecordExporter/Builder to use otlp.internal HTTP classes
  instead of removed exporter.internal.http package
- Fix Checkstyle import order in SimpleAuditRecordProcessorTest
- Update build.gradle.kts dependencies for audit exporter tests
- Refresh apidiffs to compare against 1.63.0 baseline
- Disable Gradle parallel/caching/config-cache for reproducible local builds

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
sync with main
ff2dc41 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
gradle jApiCmp
506fe01 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
fix spotlessJavaCheck issues
d9f3f82 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
audit.* semantic conventions
9826997 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
AuditRecordData extends LogRecordData
8df71fd 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
hilmarf added 15 commits June 26, 2026 17:03
@hilmarf
simplify audit API
d8d93b7 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
fix: resolve AutoValue constructor mismatch in SdkAuditRecordData
9164af9 
AuditRecordData extends LogRecordData. AutoValue generates constructor
parameters for all abstract (non-default) getter methods. The previous
code passed arguments in the wrong order and included fields (body,
InstrumentationScopeInfo, etc.) that AutoValue did not expect.

- Add default implementations in AuditRecordData for LogRecordData
  fields not applicable to audit: InstrumentationScopeInfo, SpanContext,
  Severity, SeverityText, Body, TotalAttributeCount
- Declare getEventName() abstract in AuditRecordData so AutoValue
  generates a field for it
- Fix argument order in SdkAuditRecordData.create() and
  SdkReadWriteAuditRecord.toAuditRecordData() to match AutoValue order
- Remove unused body field from SdkReadWriteAuditRecord; setBody() in
  SdkAuditRecordBuilder is now a no-op per spec (body travels via
  AuditRecordData.getBodyValue() default)
- Update tests to use combined API methods setActor(), setTarget(),
  setSource() instead of the removed individual setActorId() etc.

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
apidiffs
12c33f0 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
remove duplicate condition
82ce56f 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
clean API
2d3ea52 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
use proper delegate method
e39fe58 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
why are all classes final?
0636ace 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
remove NoOp
973e387 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
Collection is sufficient
94c723d 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
fix return types
65a6fda 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
using fallback name: "unknown"
1a2d68f 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
remove useless null checks
400cd48 
we're using @nullable to indicate what could be null

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
spotlessapply
4c6de38 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
null is not allowed
9aa88eb 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
depend on generic https://maven.pkg.github.com/apeirora/AuditAPI
38b9242 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf
set env GITHUB_TOKEN
3f8a119 
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

api-change

Projects

OTel-Audit-Logging
Status: In progress

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hilmarf @CLAassistant @jkwatson