Linux

48287 readers

608 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

AgreeableLandscape@lemmy.ml

nooter692@lemmy.ml

MarcellusDrum@lemmy.ml

cypherpunks@lemmy.ml

cyclohexane@lemmy.ml

d3Xt3r@lemmy.nz

How to anonymize logs before sharing? (lemmy.world)

submitted 3 months ago by ouch@lemmy.world to c/linux@lemmy.ml

24 comments fedilink hide all child comments

Many projects ask to share lots of logs when reporting issues. It's difficult to go through all the logs and redact informarion such as usernames, environment variabled etc.

Any ideas on how to anonymize logs before sharing? Change your username to something generic?

you are viewing a single comment's thread
view the rest of the comments

[–] InEnduringGrowStrong@sh.itjust.works 7 points 3 months ago* (last edited 3 months ago)

It depends a lot on what the application is logging to begin with.
If a project prints passwords in logs, consider to just GTFO as it's terrible security practice.
There might also be sensitive info that's not coming from a static thing like your username, but from variable data such as IP addresses, gps coordinates, or whatever thing gets logged.
Meaning a simple find&replace might be insufficient.

When possible, I tend to replace the info I remove with a short name of what I replaced out as it's easier to understand context when it's not all ********** or truncated.
example:

proxy_container_1     | <redacted_client1_ip> - - [17/Aug/2024:12:39:06 +0000] "GET /u/<redacted_local_user2> HTTP/1.1" 200 963 "-" "Lemmy/0.19.4; +<redacted_remote_instance3_fqdn>"

keeping the same placeholders for subsequent substitutions helps because if everything is the same, then you don't know what's what anymore.
(this single line would be easy enough either way, but if you have a bunch and can't tell client1 from client50 apart anymore that can hinder troubleshooting.

regular expressions are useful in doing that, but something that works on a specific set of logs might miss sensitive info in another.

I'm sure people have made tools to help with that, possibly with regex patterns for common stuff, but even with that, you'd need to doublecheck the output to be 100% sure.

It helps a lot when whatever app doesn't log too much sensitive info to begin with, but that's usually out of your hands as a user.