ja4_fingerprint: Add an option to disable logging by maskit · Pull Request #12938 · apache/trafficserver

maskit · 2026-03-04T18:32:50Z

This adds --nologging option to ja4_fingerprint plugin. If it's specified, the plugin does not make a log file.

Current documentation says that the plugin does not have any options, but there is --preserve actually. I added documentation for it as well.

Copilot

Pull request overview

Adds a --nologging runtime option to the experimental ja4_fingerprint plugin so operators can disable creation/writing of the plugin’s text log file, and updates the admin documentation to reflect available options.

Changes:

Add --nologging option parsing and conditional log file creation / write behavior in the plugin.
Move the debug (Dbg) fingerprint message out of the file-log write helper so it always logs when debug tags are enabled.
Update plugin documentation to describe --preserve and --nologging, and adjust logging description/limitations.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
plugins/experimental/ja4_fingerprint/plugin.cc	Adds `--nologging` option and guards log file creation and `log_fingerprint()` calls.
doc/admin-guide/plugins/ja4_fingerprint.en.rst	Documents plugin options and updates logging/limitations text.

Copilot · 2026-03-04T18:38:35Z

doc/admin-guide/plugins/ja4_fingerprint.en.rst

+.. option:: --preserve
+
+This option controls whether the plugin preserves any existing JA4 header. If the option is specified the plugin keep the header
+intact. If the option is not speficied, the plugins appends a generated fingerprint to the existing header value.


Typo in documentation: "speficied" should be "specified".

Suggested change

intact. If the option is not speficied, the plugins appends a generated fingerprint to the existing header value.

intact. If the option is not specified, the plugins appends a generated fingerprint to the existing header value.

Copilot · 2026-03-04T18:38:36Z

doc/admin-guide/plugins/ja4_fingerprint.en.rst

+This option controls whether the plugin preserves any existing JA4 header. If the option is specified the plugin keep the header
+intact. If the option is not speficied, the plugins appends a generated fingerprint to the existing header value.


The --preserve option description has several grammar issues and is hard to read as a single long line (e.g., "the plugin keep", "the plugins appends"). Please fix the wording and wrap the text consistently with the rest of this RST file.

Suggested change

This option controls whether the plugin preserves any existing JA4 header. If the option is specified the plugin keep the header

intact. If the option is not speficied, the plugins appends a generated fingerprint to the existing header value.

This option controls whether the plugin preserves any existing JA4 header.

If the option is specified, the plugin keeps the header intact. If the

option is not specified, the plugin appends a generated fingerprint to the

existing header value.

Copilot · 2026-03-04T18:38:36Z

doc/admin-guide/plugins/ja4_fingerprint.en.rst

+
+.. option:: --nologging
+
+This option disables log output.


"This option disables log output" is ambiguous now that debug logging (Dbg) still emits fingerprints when debug tags are enabled. Please clarify that --nologging disables writing to ja4_fingerprint.log (text log), and whether debug output is still expected.

Suggested change

This option disables log output.

This option disables writing fingerprints to the :file:`ja4_fingerprint.log` text log file. It does not affect Traffic Server debug

logging (``Dbg``); if relevant debug tags are enabled, fingerprints may still appear in debug logs.

Copilot · 2026-03-04T18:38:36Z

doc/admin-guide/plugins/ja4_fingerprint.en.rst

 The plugin writes to ``ja4_fingerprint.log`` in the Traffic Server log
-directory (typically ``/var/log/trafficserver/``).
+directory (typically ``/var/log/trafficserver/``) if the feature is not disabled.


"if the feature is not disabled" is unclear—this appears to refer specifically to --nologging. Consider rephrasing to explicitly mention --nologging, and also update earlier sections (e.g., the "Plugin Behavior" bullet that says it always "Log to File") to reflect the conditional logging behavior.

Copilot · 2026-03-04T18:38:36Z

plugins/experimental/ja4_fingerprint/plugin.cc

    // The VCONN_CLOSE handler is now responsible for freeing the resource.
    TSUserArgSet(ssl_vc, *get_user_arg_index(), static_cast<void *>(data.release()));
  }


TSUserArgSet() stores a JA4_data* on the vconn, but other hooks treat this user arg as a std::string* (see TSUserArgGet() usage in handle_read_request_hdr() and the delete in handle_vconn_close()). Deleting/using a JA4_data* as a std::string* is undefined behavior even if the std::string is the first member. Please make the stored type consistent (e.g., store JA4_data* and update the later casts/deletes, or store only a std::string* and adjust log_fingerprint() accordingly).

Copilot · 2026-03-04T18:38:37Z

plugins/experimental/ja4_fingerprint/plugin.cc

+  if (!global_nologging_enabled) {
+    if (!create_log_file()) {
+      TSError("[%s] Failed to create log.", PLUGIN_NAME);
+      return;
+    } else {
+      Dbg(dbg_ctl, "Created log file.");
+    }
  }


The new --nologging behavior isn't covered by existing tests. Since there are already gold tests for this plugin, please add a test case that runs with ja4_fingerprint.so --nologging and asserts (1) no ja4_fingerprint.log is created/written and (2) JA4 headers are still injected.

maskit · 2026-03-04T20:57:20Z

I also started working on adding options to change header names, and now I feel like it may be nice if the default behavior is different.

How about output nothing by default, and have these 3 options to enable each output, instead of introducing --nologging that I suggested on this PR.

[--log <filename>] [--header=<header-name>] [--via-header <another-header-name>]

It would be an incompatible change though.

bneradt · 2026-03-10T22:57:45Z

I also started working on adding options to change header names, and now I feel like it may be nice if the default behavior is different.

How about output nothing by default, and have these 3 options to enable each output, instead of introducing --nologging that I suggested on this PR.
[--log <filename>] [--header=<header-name>] [--via-header <another-header-name>]
It would be an incompatible change though.

I'm fine with this. That sounds reasonable.

Just please keep it consistent with ja3_fingerprint as well.

maskit · 2026-03-11T16:46:04Z

Just please keep it consistent with ja3_fingerprint as well.

Ah, the design came from the ja3 version.... Although the difference from ja3 is noted on README, logging is disabled by default on ja3. The behavior is already inconsistent.

And the ja3 version does not have ways to specify filename and header names. There isn't a way to disable adding the "via" header either.

It doesn't seem like the design is good to me. Should we stick to it? Or should the ja3 version be updated (with incompatible changes) as well? This makes me want to add another ja4 plugin for people who don't use ja3.

ja4_fingerprint: Add an option to disable logging

890d494

maskit added this to the 11.0.0 milestone Mar 4, 2026

maskit self-assigned this Mar 4, 2026

maskit added the ja4_fingerprint Work related to JA4 fingerprinting label Mar 4, 2026

maskit requested a review from Copilot March 4, 2026 18:32

Copilot started reviewing on behalf of maskit March 4, 2026 18:33 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

bryancall requested a review from bneradt March 9, 2026 22:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ja4_fingerprint: Add an option to disable logging#12938

ja4_fingerprint: Add an option to disable logging#12938
maskit wants to merge 1 commit intoapache:masterfrom
maskit:ja4_no_logging

maskit commented Mar 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

maskit commented Mar 4, 2026

Uh oh!

bneradt commented Mar 10, 2026

Uh oh!

maskit commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	intact. If the option is not speficied, the plugins appends a generated fingerprint to the existing header value.
	intact. If the option is not specified, the plugins appends a generated fingerprint to the existing header value.

		This option controls whether the plugin preserves any existing JA4 header. If the option is specified the plugin keep the header
		intact. If the option is not speficied, the plugins appends a generated fingerprint to the existing header value.

	This option disables log output.
	This option disables writing fingerprints to the :file:`ja4_fingerprint.log` text log file. It does not affect Traffic Server debug
	logging (``Dbg``); if relevant debug tags are enabled, fingerprints may still appear in debug logs.

Conversation

maskit commented Mar 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

maskit commented Mar 4, 2026

Uh oh!

bneradt commented Mar 10, 2026

Uh oh!

maskit commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants