[TS-4917] Trying to WIPE_FIELD_VALUE on some fields breaks logging

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: 7.1.0
• Component/s: Logging
• Assignee: Unassigned
• Reporter: Phillip Moore
• Created: 30/Sep/16 20:30
• Updated: 03/Oct/16 19:16

Description

If you setup a LogFilter with an Action of "WIPE_FIELD_VALUE" on cqtx it breaks logging and no lines are logged to the LogObject that uses that filter.

In the example below if remove_access_token_cquuc is used it works correctly. remove_access_token_cqtx makes no lines be logged.

<LogFilter>
<Name = "remove_access_token_cquuc" />
<Condition = "%<cquuc> CONTAIN access_token" />
<Action = "WIPE_FIELD_VALUE" />
</LogFilter>
<LogFilter>
<Name = "remove_access_token_cqtx" />
<Condition = "%<cqtx> CONTAIN access_token" />
<Action = "WIPE_FIELD_VALUE" />
</LogFilter>
<LogFormat>
<Name = "b_json" />
<Format = "{\"chi\":\"%<chi>\",\"chp\":\"%<chp>\",\"caun\":\"%<caun>\",\"cqtn\":\"%<cqtn>\",\"cqhm\":\"%<cqhm>\",\"cquuc\":\"%<cquuc>\",\"cqtx\":\"%<cqtx>\",\"shi\":\"%<shi>\",\"pssc\":\"%<pssc>\",\"pscl\":%<pscl>,\"sssc\":\"%<sssc>\",\"sscl\":%<sscl>,\"cqbl\":%<cqbl>,\"pqbl\":%<pqbl>,\"cqhl\":%<cqhl>,\"pshl\":%<pshl>,\"pqhl\":%<pqhl>,\"sshl\":%<sshl>,\"ttms\":%<ttms>,\"phr\":\"%<phr>\",\"cfsc\":\"%<cfsc>\",\"pfsc\":\"%<pfsc>\",\"crc\":\"%<crc>\",\"cquuh\":\"%<cquuh>\",\"sshcl\":\"%<

{Content-Length}ssh>\",\"pshce\":\"%<{Content-Encoding}psh>\",\"cqhcl\":\"%<{Content-Length}

cqh>\"}" />
</LogFormat>
<LogObject>
<Format = "b_json" />
<Filename = "b_json" />
<Filters = "remove_healthcheck,remove_access_token_cqtx" />
</LogObject>

Issue Links

• relates to: TS-4918 WIPE_FIELD_VALUE only works with some fields but is not documented