<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 13/03/2024 01:40, Wei-Jun Wang
wrote:<br>
</div>
<blockquote type="cite" cite="mid:DBFEE820-9D41-4647-9660-EA40A87D5046@oracle.com">
<pre><blockquote type="cite" style="color: #007cff;"><pre class="moz-quote-pre" wrap="">Thinking about this raises the question: wouldn't it be possible to have these components emit Flight Recorder events as well?
I understand this is a dubious topic, as some arguments contain secrets, but it would be interesting to know.
Maybe restricting FR events when security debug logging is enabled anyways would be an option?
</pre></blockquote><pre class="moz-quote-pre" wrap="">Seán is our expert on JFR events. He has already created some security-related events, like provider loading and security properties access. You can tell him what else you are interested in.</pre></pre>
</blockquote>
<p>Using JFR events is certainly worthy of discussion. What would
those JFR events looks like ? Would you propose one for each log
action currently in the krb5 code ? It becomes unmaintainable IMO.
<br>
</p>
<p>The suggestion has also been made for the TLS logging code in the
past. It's not trivial to convert every log entry to a JFR event.
A typical client/server handshake in TLS can generate 1000's of
lines of log output with -Djavax.net.debug=all enabled. It doesn't
translate easily to JFR events. Reading text is probably easier
also.<br>
<br>
On a related note, I think the current TLS logging is too verbose
at the moment. Over 3,500 lines of output are generated before a
ClientHello gets created in a typical TLS debug capture. It's too
much. Most of it is iterating over certs found in the truststore
(cacerts by default). Need to log a bug on that.</p>
<p>regards,<br>
Sean.<br>
</p>
</body>
</html>