Skip to content

Conversation

@Arunodoy18
Copy link

Addresses #14431

Establishes formal security guidelines for logging to prevent exposure of sensitive telemetry data at Info/Warn/Error levels.
Added docs/security/logging.md with policy rules:

  • Prohibits logging metric names, attribute values, and other telemetry data at Info or higher levels.
  • Requires generic error messages without embedded sensitive context.
  • Allows detailed diagnostic logging only at Debug level.
  • Provides implementation examples (correct vs. incorrect patterns).

documentation aspect of #14431. Code changes to existing processors (in the contrib repository) will be handled in a separate PR.

@Arunodoy18 Arunodoy18 requested review from a team, bogdandrutu and dmitryax as code owners January 17, 2026 18:56
When service.telemetry.metrics.level is set to 'none', the collector
should skip registering process metrics to avoid errors on platforms
where gopsutil is not supported (such as AIX).

This change conditionally registers process metrics only when the
metrics level is not LevelNone, preventing the 'failed to register
process metrics: not implemented yet' error on unsupported platforms.

Fixes regression introduced in v0.136.0 where the check for metrics
level was removed.
Similar to the resolution for pcommon.Value in previous changes, this update
ensures consistent documentation across all pdata types by clarifying that
calling functions on zero-initialized instances is invalid usage.

Changes:
- Updated template files (one_of_field.go, one_of_message_value.go) to generate
  improved comment wording
- Updated pcommon/value.go comments manually
- Updated all generated pdata files to use consistent wording:
  'is invalid and will cause a panic' instead of 'will cause a panic'

This makes it clearer that using zero-initialized instances is not just
dangerous but explicitly invalid usage, improving API documentation clarity.
Fixes open-telemetry#14326

mdatagen was generating invalid Go code for histogram metrics by using NumberDataPoint API methods (SetDoubleValue, ValueType) on HistogramDataPoint types, causing compilation errors.

Changes: Update metrics.go.tmpl to use HistogramDataPoint API for histogram metrics with dp.SetCount(1) and dp.SetSum(val). Update metrics_test.go.tmpl to assert dp.Count() and dp.Sum() for histograms. Add system.cpu.utilization histogram to samplescraper metadata for validation.
@Arunodoy18 Arunodoy18 force-pushed the docs/add-sensitive-data-logging-policy branch from 6bb1997 to 3182b70 Compare January 17, 2026 18:56
@Arunodoy18
Copy link
Author

Hey there , I will highly appreciate a review from the reviewers and update with any follow ups and changes if required .
Hope it works , Cheers .

@dmathieu
Copy link
Member

Please keep your PRs atomic, without unrelated things within them.

@Arunodoy18
Copy link
Author

Arunodoy18 commented Jan 19, 2026 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants