Struct RingBufferLogger 

pub struct RingBufferLogger { /* private fields */ }

Ring buffer logger with bounded memory usage.

Uses RwLock for concurrent read scalability - multiple threads can call get_recent() simultaneously without contention.

Implementations

impl RingBufferLogger

pub fn new(max_entries: usize, max_entry_bytes: usize) -> Self

Create a new ring buffer logger.

Arguments

• max_entries - Maximum number of entries before FIFO eviction
• max_entry_bytes - Maximum bytes per entry (defensive cap)

Example

use palisade_errors::ring_buffer::RingBufferLogger;

// Typical honeypot: 10k entries, 1KB each = 10MB max
let logger = RingBufferLogger::new(10_000, 1024);

pub fn log(&self, err: &AgentError, source_ip: &str)

Log an error with automatic eviction if buffer is full.

Arguments

• err - The error to log
• source_ip - Source IP or identifier for tracking

Example

let logger = RingBufferLogger::new(100, 1024);
let err = AgentError::config(definitions::CFG_PARSE_FAILED, "op", "details");
logger.log(&err, "192.168.1.100");

pub fn get_recent(&self, count: usize) -> Vec<ForensicEntry>

Get the N most recent entries in reverse chronological order.

Uses read lock for concurrent access - multiple threads can call this simultaneously without blocking each other.

Example

// Get last 10 errors
let recent = logger.get_recent(10);
for entry in recent {
    println!("[{}] {} - {}", entry.timestamp, entry.code, entry.operation);
}

pub fn get_all(&self) -> Vec<ForensicEntry>

Get all entries in reverse chronological order.

pub fn get_filtered<F>(&self, predicate: F) -> Vec<ForensicEntry>

where F: Fn(&ForensicEntry) -> bool,

Get entries matching a predicate (e.g., filter by source IP).

Example

// Get all errors from specific IP
let from_attacker = logger.get_filtered(|entry| {
    entry.source_ip.as_ref() == "192.168.1.100"
});

pub fn len(&self) -> usize

Get current number of entries in buffer.

pub fn is_empty(&self) -> bool

Check if buffer is empty.

pub fn payload_bytes(&self) -> usize

Get total payload bytes (lower-bound estimate).

pub fn eviction_count(&self) -> u64

Get total number of evictions since creation.

High eviction rate indicates sustained attack volume.

pub fn clear(&self)

Clear all entries (useful after archival or testing).

pub fn capacity(&self) -> usize

Get buffer capacity.

pub fn is_full(&self) -> bool

Check if buffer is at capacity.

Trait Implementations

impl Clone for RingBufferLogger

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.