Documentation
¶
Overview ¶
Package audit provides a durable, append-only audit event log. Events are written as newline-delimited JSON (JSONL) so they can be streamed with `tail -f`, parsed by any JSON tool, or forwarded to a SIEM. Each event is one security-relevant decision: an exec, a recipe run, an approval.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Event ¶
type Event struct {
Time time.Time `json:"time"`
Actor string `json:"actor,omitempty"`
Source string `json:"source,omitempty"` // "mcp"|"web"|"cli"|"webhook"
Action string `json:"action,omitempty"` // "exec"|"recipe_run"|"approval"
Target string `json:"target,omitempty"`
Command string `json:"command,omitempty"`
Risk string `json:"risk,omitempty"` // "low"|"medium"|"high"|"critical"
Decision string `json:"decision,omitempty"` // "allow"|"deny"|"require_approval"
DenyReason string `json:"deny_reason,omitempty"`
ApprovalID string `json:"approval_id,omitempty"`
ExitCode *int `json:"exit_code,omitempty"`
Extra map[string]string `json:"extra,omitempty"`
}
Event is one durable record of a security-relevant action. Zero-value fields are omitted from JSON so the log stays compact.
type FileSink ¶
type FileSink struct {
// contains filtered or unexported fields
}
FileSink writes events as JSONL to a rotating file managed by lumberjack. Each Log call writes exactly one newline-terminated JSON object. Concurrent calls are serialised by a mutex so lines never interleave.
func NewFileSink ¶
func NewFileSink(path string, opts ...RotateOptions) (*FileSink, error)
NewFileSink opens (or creates) path for writing and returns a FileSink. The caller must call Close when done. An optional RotateOptions enables size- and age-based log rotation; without it sensible defaults apply (100 MB max size, 5 backups, 30-day retention).
type RotateOptions ¶
type RotateOptions struct {
MaxSizeMB int // rotate after this many MB (default 100)
MaxBackups int // keep this many old files (default 5)
MaxAgeDays int // delete files older than this (default 30)
Compress bool // gzip old files
}
RotateOptions controls log rotation for FileSink. All fields are optional; zero values use the defaults listed below.
Source Files