Policy Findings emitted as OTLP log records as they arise by jerbly · Pull Request #1045 · open-telemetry/weaver

jerbly · 2025-12-01T00:47:11Z

Whenever a PolicyFinding is created in live-check a log_record is emitted to your configured OTLP endpoint. Here's an example from a Collector in debug mode:

Flags: 0
LogRecord #21
ObservedTimestamp: 2025-12-01 00:04:58.49238 +0000 UTC
Timestamp: 1970-01-01 00:00:00 +0000 UTC
SeverityText: INFO
SeverityNumber: Info(9)
EventName: weaver.live_check.finding
Body: Str(Conditionally required attribute 'server.port' is not present.)
Attributes:
     -> weaver.finding.id: Str(conditionally_required_attribute_not_present)
     -> weaver.finding.level: Str(information)
     -> weaver.finding.context.attribute_name: Str(server.port)
     -> weaver.sample.type: Str(histogram_data_point)
     -> weaver.sample.signal_type: Str(metric)
     -> weaver.sample.signal_name: Str(rpc.client.duration)
Trace ID: 
Span ID:

...and a screenshot from a back-end:

codecov · 2025-12-01T00:53:21Z

Codecov Report

❌ Patch coverage is 86.52344% with 69 lines in your changes missing coverage. Please review.
✅ Project coverage is 79.3%. Comparing base (33083ad) to head (1b10784).
⚠️ Report is 7 commits behind head on main.

Files with missing lines	Patch %	Lines
...rates/weaver_live_check/src/advice/type_advisor.rs	77.2%	36 Missing ⚠️
...weaver_live_check/src/advice/deprecated_advisor.rs	80.3%	11 Missing ⚠️
...rates/weaver_live_check/src/advice/rego_advisor.rs	83.6%	8 Missing ⚠️
crates/weaver_live_check/src/lib.rs	64.2%	5 Missing ⚠️
crates/weaver_live_check/src/otlp_logger.rs	94.1%	5 Missing ⚠️
...rates/weaver_live_check/src/advice/enum_advisor.rs	94.2%	2 Missing ⚠️
crates/weaver_live_check/src/advice/mod.rs	93.7%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1045     +/-   ##
=======================================
+ Coverage   79.0%   79.3%   +0.3%     
=======================================
  Files         85      92      +7     
  Lines       7034    7331    +297     
=======================================
+ Hits        5558    5817    +259     
- Misses      1476    1514     +38

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

martinjt · 2025-12-01T12:29:26Z

Could the message follow a message template over using interpolated strings?

So something like Conditionally required attribute {weaver.finding.context.attribute_name} is not present?

jsuereth · 2025-12-01T13:33:31Z

Very cool!

jerbly · 2025-12-01T23:24:53Z

Could the message follow a message template over using interpolated strings?

So something like Conditionally required attribute {weaver.finding.context.attribute_name} is not present?

@martinjt - not super easily, wondering what the use case is?

martinjt · 2025-12-02T00:47:24Z

The idea is that body should be low cardinality, that's always the way I've seen it. I kinda thought that was how all logging frameworks worked? Maybe thats just a go and .net thing though?

Admittedly, events and event ID should solve that usecase. The idea being that you can group together logs that are the same, but have different attributes when querying and aggregating the data.

src/registry/live_check.rs

jerbly · 2025-12-02T03:00:01Z

Oh, I see, I did not know that was the case for body - I thought that was where the human readable text went. I guess I could move it to a weaver.finding.message attribute?

martinjt · 2025-12-02T09:01:36Z

The way it works in .net is that there is a FormattedMessage attribute that you can opt in to having populated.

jerbly · 2025-12-02T11:48:58Z

I'm wondering if this is a specific thing that dot net does? The docs in the proto file, for example, say this:

  // A value containing the body of the log record. Can be for example a human-readable
  // string message (including multi-line) describing the event in a free form or it can
  // be a structured data composed of arrays and maps of other values. [Optional].
  opentelemetry.proto.common.v1.AnyValue body = 5;

I have not used logs much myself so looking for more opinions here before going one way or the other: @open-telemetry/weaver-approvers

jsuereth · 2025-12-02T11:49:51Z

I'm wondering if this is a specific thing that dot net does? The docs in the proto file, for example, say this:
  // A value containing the body of the log record. Can be for example a human-readable
  // string message (including multi-line) describing the event in a free form or it can
  // be a structured data composed of arrays and maps of other values. [Optional].
  opentelemetry.proto.common.v1.AnyValue body = 5;
I have not used logs much myself so looking for more opinions here before going one way or the other: @open-telemetry/weaver-approvers

I don't believe Java does this, not sure for other languages, but I don't think it's the "norm" or at least, it's not specified logging should do this.

martinjt · 2025-12-02T13:36:37Z

I think it depends on the framework you're doing for sure. There's a list of the frameworks supporting it at the bottom of the page.

https://messagetemplates.org/

…otlp-output

crates/weaver_live_check/src/advice/mod.rs

lmolkova · 2025-12-03T18:52:07Z

crates/weaver_live_check/src/advice/deprecated_advisor.rs

+use weaver_checker::{FindingLevel, PolicyFinding};
+use weaver_semconv::deprecated::Deprecated;
+
+use super::{Advisor, FindingBuilder};


I'm curious what's the difference between advise and finding. Could we unify them and use one term to describe both? This applies to APIs and attributes/event naming

Until very recently we had:

Advisors who advise and produce Advice

Now we have:

Advisors who advise and produce PolicyFindings

I'm not sure what I would rename Advisor and the verb advise to?

Could Advisors produce PolicyAdvices ?

I think we should have Advisors produce Findings. The Findings can be advice violation or warning.

Previously Advice as a violation was a bit awkward. So I don't think we're any "worse" here if Advisors produce a Finding - where finding could be one of these three things.

crates/weaver_live_check/README.md

Co-authored-by: Liudmila Molkova <neskazu@gmail.com>

crates/weaver_live_check/src/otlp_logger.rs

jsuereth · 2025-12-04T15:52:05Z

src/registry/live_check.rs


+    /// Enable OTLP log emission for live check policy findings
+    #[arg(long, default_value = "false")]
+    emit_otlp_logs: bool,


Nit: Should we bundle these into a struct?

jerbly added 5 commits November 30, 2025 13:27

initial poc for otlp live-check emission

dee1ee8

otlp emit working

d2d1c19

fixed missing otlp emission

53c936e

fixed missing metric emissions

31037f8

added to readme

2c60f29

jerbly added 2 commits November 30, 2025 21:33

fixes tokio runtime blocking

26f6f28

removed unneeded closure

52d0560

tests

5441201

removed unused fns

196bf6d

github-advanced-security bot found potential problems Dec 2, 2025

View reviewed changes

src/registry/live_check.rs Fixed Show fixed Hide fixed

src/registry/live_check.rs Fixed Show fixed Hide fixed

src/registry/live_check.rs Fixed Show fixed Hide fixed

src/registry/live_check.rs Fixed Show fixed Hide fixed

oops

65e3978

jerbly added 6 commits December 2, 2025 18:20

Merge branch 'main' of https://github.com/open-telemetry/weaver into …

9933533

…otlp-output

added otlp emission for log

355dd4d

Refactor OTLP emitter to use AnyValue for log attributes

0a7fec1

refactored advice mod into multiple files and added a FindingBuilder

27012a8

fmt

e303ddb

switched sample_* modules to use the FindingBuilder

6295df1

github-advanced-security bot found potential problems Dec 3, 2025

View reviewed changes

clippy

ba7725a

jerbly changed the title ~~[WIP] Policy Findings emitted as OTLP log records as they arise~~ Policy Findings emitted as OTLP log records as they arise Dec 3, 2025

jerbly marked this pull request as ready for review December 3, 2025 15:56

jerbly requested a review from a team as a code owner December 3, 2025 15:56

lmolkova reviewed Dec 3, 2025

View reviewed changes

crates/weaver_live_check/README.md Outdated Show resolved Hide resolved

lmolkova reviewed Dec 3, 2025

View reviewed changes

crates/weaver_live_check/README.md Outdated Show resolved Hide resolved

lmolkova reviewed Dec 3, 2025

View reviewed changes

crates/weaver_live_check/README.md Outdated Show resolved Hide resolved

jerbly and others added 2 commits December 3, 2025 20:09

Update crates/weaver_live_check/README.md

a9f8c6e

Co-authored-by: Liudmila Molkova <neskazu@gmail.com>

updated attribute names and added a model for our event

56076ba

jsuereth reviewed Dec 4, 2025

View reviewed changes

crates/weaver_live_check/src/otlp_logger.rs Outdated Show resolved Hide resolved

jsuereth approved these changes Dec 4, 2025

View reviewed changes

jerbly added 2 commits December 4, 2025 21:37

Add env var detector for service.name with fallback

cf761cc

readme update for service.name

1b10784

jerbly enabled auto-merge (squash) December 5, 2025 02:44

jerbly merged commit 5f71818 into open-telemetry:main Dec 5, 2025
21 checks passed

Conversation

jerbly commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

martinjt commented Dec 1, 2025

Uh oh!

jsuereth commented Dec 1, 2025

Uh oh!

jerbly commented Dec 1, 2025

Uh oh!

martinjt commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jerbly commented Dec 2, 2025

Uh oh!

martinjt commented Dec 2, 2025

Uh oh!

jerbly commented Dec 2, 2025

Uh oh!

jsuereth commented Dec 2, 2025

Uh oh!

martinjt commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lmolkova Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

jerbly Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

lmolkova Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

jsuereth Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jsuereth Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jerbly commented Dec 1, 2025 •

edited

Loading

codecov bot commented Dec 1, 2025 •

edited

Loading