Crate zerodds_security_logging 

Crate zerodds-security-logging. Safety classification: SAFE (a pure I/O wrapper; no secrets are buffered outside the log line itself).

Production-grade logging backends for DDS-Security 1.1/1.2 §8.6 (the LoggingPlugin SPI from zerodds-security).

Layer position

Layer 4 — Core Services. Consumed by end-user builds + the DCPS runtime (feature security).

Public API (as of 1.0.0-rc.1)

• StderrLoggingPlugin — structured log lines to stderr.
• JsonLinesLoggingPlugin — application/x-ndjson to a file.
• SyslogLoggingPlugin — RFC-5424 UDP backend (facility LOCAL0).
• FanOutLoggingPlugin — fan-out to multiple backends.

What this crate provides

1. StderrLoggingPlugin — writes structured log lines to stderr. Default for development + container deployments with a stdout/stderr collector (Loki, Vector, Fluentd).
2. JsonLinesLoggingPlugin — writes JSON lines (application/x-ndjson) to a file. Each line = one event. A second process (e.g. auditd, filebeat) rotates the file.
3. FanOutLoggingPlugin — routes each event to multiple backends (e.g. stderr + JSON file simultaneously).

All backends filter events by LogLevel; the default level is Warning — lower (Informational, Debug) is silently discarded.

Non-goals

• Syslog TCP (RFC 5425) and syslog TLS — most syslog deployments run in a trusted segment; re-add on demand.
• Structured telemetry (OpenTelemetry / OTLP) — covered by zerodds-observability-otlp (layer 4.6).
• Log rotation in the plugin itself — the job of the operating system / logrotate.

Structs

FanOutLoggingPlugin

Fan-out adapter — broadcasts an event to all registered backends. Useful for a setup with stderr + an audit JSON file in parallel.

JsonLinesLoggingPlugin

Writes security events as JSON lines to a file.

StderrLoggingPlugin

Logs security events to stderr as human-readable text.

SyslogLoggingPlugin

UDP-based syslog client.

Enums

LogConfigError

Error materializing a logger from dds.sec.log.* properties.

Constants

PROP_LOG_JSONL_PATH

dds.sec.log.jsonl.path — output file for the jsonl sink.

PROP_LOG_LEVEL

dds.sec.log.level — minimum level. Default: Informational.

PROP_LOG_PLUGIN

dds.sec.log.plugin — comma-separated sink list (stderr,jsonl,syslog).

PROP_LOG_SYSLOG_ADDR

dds.sec.log.syslog.addr — host:port target for the syslog sink.

PROP_LOG_SYSLOG_APP

dds.sec.log.syslog.app — RFC-5424 app name (default zerodds).

PROP_LOG_SYSLOG_HOST

dds.sec.log.syslog.host — RFC-5424 hostname (default localhost).

Functions

logging_plugin_from_properties

Build a LoggingPlugin from dds.sec.log.* properties, fanning out to every named sink. Returns Ok(None) if dds.sec.log.plugin is absent or names no sinks.

parse_log_level

Parse a DDS-Security log-level name (case-insensitive; info aliases informational).