Configuring single rabbitmq, sensu is able to redact the password in client logs after restart.
But when configuring multiple rabbitmqs, plain text password is visible.
Logs for single rabbitmq config :
{
"timestamp":"2016-04-08T16:41:35.699673-0700",
"level":"warn",
"message":"config file applied changes",
"file":"/etc/sensu/conf.d/rabbitmq.json",
"changes":{
"rabbitmq":[
null,
{
"host":"1.1.1.1",
"port":"5671",
"user":"sensu",
"password":"REDACTED"
}
]
}
}
Logs for multiple rabbitmq config :
{
"timestamp":"2016-04-08T16:41:35.699673-0700",
"level":"warn",
"message":"config file applied changes",
"file":"/etc/sensu/conf.d/rabbitmq.json",
"changes":{
"rabbitmq":[
null,
[
{
"host":"1.1.1.1",
"port":"5671",
"user":"sensu",
"password":"abc123"
},
{
"host":"1.1.1.2",
"port":"5671",
"user":"sensu",
"password":"abc123"
}
]
]
}
}
This issue seems to occur because multilpe rabbitmq config is stored in a nested array format. Sensu is not able to look up the password keyword inside the hash, inside the array and hence, not able to redact the password in logs.
Configuring single rabbitmq, sensu is able to redact the password in client logs after restart.
But when configuring multiple rabbitmqs, plain text password is visible.
Logs for single rabbitmq config :
Logs for multiple rabbitmq config :
This issue seems to occur because multilpe rabbitmq config is stored in a nested array format. Sensu is not able to look up the password keyword inside the hash, inside the array and hence, not able to redact the password in logs.