<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Tahoma, Geneva, sans-serif;">
<p>Hi,</p>
<p><br>
</p>
<p>one of the common requirements for my team is to "hide" sensitive information in production logs, with a varying definition of sensitive. One idea for this we had was to introduce another pattern in the format strings, and a global flag that handles that
pattern differently.</p>
<p><br>
</p>
<p>Concrete example: `logger.info("user {} has password {}", user, password);` is ok for debug, but not for production. So instead we would use `logger.info("user {} has password $$", user, password);`, and based on some parameter this would be rendered as
"user nkiesel has password secret" or "user nkiesel has password *hidden*".</p>
<p><br>
</p>
<p>This looks better than `logger.info("user {} has password {}, user, sensitive(password)";` and could also be slightly more efficient (because is would avoid invoking `sensitive` if threshold is higher than info). However, this approach fails when the parameter
is a Java object and only part of the `toString()` is sensitive. One idea to solve this would be to support a `SensitiveRenderer` interface with a "toString(boolean sensitve) method. Then Java objects with sensitive data could override that.<br>
</p>
<p><br>
</p>
Anyone out there who has an advice? We have a rough implementation (with a `static public MessageFormatter.setSensitive(boolean arg);` to toggle the behavior) that passes the existing test cases (actually fails the perf tests right now because we used a Matcher.find
based implementation that is 5 times slower), which we of course would be happy to share if anyone is interested.
<p><br>
</p>
<p><br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px"><span lang="en-US">
<div style="margin:0" align="justify"><font face="Arial,sans-serif" size="2"><span style="font-size:10pt"><font color="#17365D" face="Calibri,sans-serif" size="3"><span style="font-size:12pt"></nk><br>
<br>
---<br>
<br>
</span></font></span></font><br>
<div style="color:Black; font-size:10pt">
<div style="color:DarkBlue">Norbert Kiesel</div>
<div style="color:DarkBlue">Systems Architect | Engineering</div>
<div style="font-size:12pt"><span style="font-weight:bold">Metric</span>Stream</div>
<div>2600 E. Bayshore Road | Palo Alto, CA - 94303</div>
<div>+1-650-620-2954 | nkiesel@metricstream.com | <span style="color:Blue">www.metricstream.com</span></div>
</div>
<font face="Arial,sans-serif" size="2"><span style="font-size:10pt"><font color="#17365D" face="Calibri,sans-serif" size="3"><span style="font-size:12pt"><font size="2"></font></span></font></span></font></div>
</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p style="font-size:9pt; color:gray; line-height:8pt; font-family: calibri;"><b><u>Confidentiality Notice:</u></b>This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed.
This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received
this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited</p>
</body>
</html>