OpenTelemetry integration

[erwinkramer]

This project is really nice, but what i would really want is a deep integration with OpenTelemetry so you can easily relate technical traces with audit events. Would that be something to look at?

[thepirat000]

Could you please elaborate a bit more on your requirement or idea?

Do you mean implementing a custom AuditDataProvider that leverages System.Diagnostics.ActivitySource to create a span for each audit event?

[erwinkramer]

@thepirat000

What i mean is an attempt to comply to the OTLP Specification:

1. Audit Scope could translate to OTel spans
2. Audit Event could translate to OTel logs (or maybe even OTel traces)

But in OTel, spans are also separate information that's being exported. In Audit.NET i see that the idea is to send a "Custom initial audit event to use.". For example, in Azure the spans itself are being send to either dependencies or requests table in Azure Monitor, also see this mapping, including .NET Implementation objects.

[erwinkramer]

To give you even more of an idea, i just publicized this project: https://github.com/erwinkramer/otel-business. Which is very Azure specific, relying heavily on the OpenTelemetry .NET SDK.

[thepirat000]

Starting in version 28.0.0, Audit.NET provides two built-in ways to emit OpenTelemetry spans via System.Diagnostics.Activity. These give you an out-of-the-box correlation between your audit scopes and your tracing data, and serve as a foundation for deeper integration.

---

1. Automatic Activity tracing with StartActivityTrace

Enabling this option means every AuditScope will spin up an Activity when it start and stop it when it ends, no changes to your data-provider setup required.

Audit.Core.Configuration.Setup()
    .StartActivityTrace();

• Basic span lifecycle
  Each audit scope is automatically wrapped in an Activity, so you’ll see timing (start/stop) and IDs.

• Custom tags and enrichment
  To attach your audit payload or other context, hook into the OnSaving custom action:

  Audit.Core.Configuration.AddOnSavingAction(scope =>
  {
      var activity = scope.GetActivity();
  
      activity?.SetTag("audit.event_json", scope.Event.ToJson());
  });

• Span-only mode
  If you just want spans and don’t need any storage, switch to the null provider:

  Audit.Core.Configuration.Setup()
      .StartActivityTrace()
      .UseNullProvider();

---

2. Span control via ActivityDataProvider

When you need granular control over how spans are named, tagged, or tied to your service’s tracing pipeline, configure the ActivityDataProvider as your audit data provider. This provider records each audit event as an OpenTelemetry span according to the specified rules.

Audit.Core.Configuration.Setup()
    .UseActivityProvider(cfg => cfg
        .Source("MyApp", "1.0.0")
        .ActivityName(evt => evt.EventType)
        .IncludeDefaultTags()
        .OnActivityCreated((activity, evt) =>
        {
            // Add standard or custom tags
            activity.SetTag("user.id", evt.Environment.UserName);
            // Store any non-standard context
            activity.SetCustomProperty("AuditDetails", evt.ToJson());
        }));

Note: This example wires up:

1. An ActivitySource named "MyApp" (version "1.0.0")
2. Span names based on EventType
3. A bundle of default tags (timestamps, IDs…)
4. A creation hook for whatever extra tags or properties you need

[erwinkramer]

This is great!

1. In my own project i made sure that spans are guaranteed to be exported in case of a disaster, i had to make sure i used the AutoFlushActivityProcessor for that, not adding that would not export the span on time (and thus losing the span data in a worst case scenario), even if the using-block of the activity was gracefully disposed. You can see the failFast test here where i proved it: https://github.com/erwinkramer/otel-business/blob/af66da1d240494a427c647cdf75ca77852ce0f71/IntegrationTest/Tests.cs#L12 . Did u do something similar?

2. In the readme you state:

   Emits each AuditEvent as a System.Diagnostics.Activity span via an ActivitySource.

   But what does that exactly mean, i expect it to only emit the initial AuditEvent when starting an AuditScope, not with every other AuditEvent.

[thepirat000]

Apologies - English isn't my first language, and I often use ChatGPT to improve my responses. However, they can still come across as unclear at times, so let me clarify point 2.

By default, the AuditScope (and the ActivityDataProvider) will start and stop a single activity.

The only exception is when using the EventCreationPolicy InsertOnStartInsertOnEnd setting. In that case, the ActivityDataProvider starts and stops two separate activities: one at the creation of the scope and another at its disposal. In all other cases, only a single activity is involved.

Will take a look at 1. and get back to you

[thepirat000]

I'm not sure what's the purpose of the AutoFlushActivityProcessor. I wonder what are you testing/asserting after this line: PerformTomatoEvaluateActivity.cs#L43?

Environment.FailFast("Triggered a fail fast exception that should not be caught.");

[erwinkramer]

@thepirat000 if i remove AutoFlushActivityProcessor, and test it with FailFast, it will yield 0 logs or events into Azure Monitor. This proves that OTel isn't directly sending out data, even if the using-block is completed. This means that in a disaster, you cannot rely on the logging if you don't use AutoFlushActivityProcessor, you will not be sure if it has completed or not.

[thepirat000]

Oh, I see. This behavior seems more related to how Azure Monitor handles activity ingestion. In all my tests, activities were logged as soon as they were stopped or disposed, so I’d expect the AutoFlushActivityProcessor to behave similarly when used with Audit.NET