Rebrand: Sentry -> Cairn OBS

Full rebrand across cosmetic branding, code identifiers, and
infrastructure/data-plane naming, using the supplied Cairn OBS logo
package. Cosmetic: favicon/logo swap (also closes a stale license-audit
finding -- the old favicon was SvelteKit's unreplaced scaffold logo),
new centered welcome landing page, larger/legible sidebar logo, page
titles, CLAUDE.md/README/docs prose.

Code identifiers: Go module path github.com/sentry/sentry ->
github.com/cairnobs/cairnobs across all 13 modules and ~91 files (protoc
regenerated); Rust crates sentry-agent/sentry-parser/sentry-search ->
cairnobs-*; CLI sentryctl -> cairnobsctl; Terraform provider fully
renamed (sentry_dashboard etc. -> cairnobs_dashboard, provider type,
env vars); every session/auth cookie name; agent config paths and
Windows service identity.

Deliberately preserved: the gRPC wire protocol's protobuf packages
(sentry.logs.v1, sentry.agent.v1) and their Go import directory
(proto/sentry/...) -- renaming the wire-level package would break every
currently-deployed agent binary (confirmed two real hosts, including
mail.inbuxa.com, are actively streaming through this exact contract)
until rebuilt and redeployed in lockstep with an ingest cutover. Only
the Go module path wrapping the generated code changes.

Infrastructure: every docker-compose container name (root and three
component-level compose files); the Helm chart (directory, Chart.yaml,
named-template helpers, all templates, values.yaml image repos);
Kubernetes Operator (CRD group sentry.io -> cairnobs.io, both CRD YAML
files, Go identifiers, RBAC markers); the coupled enterprise/tenantcrd
package. Caught and fixed real path-coupling bugs along the way: the
Helm chart's search/ingest volume mounts and the dev-only-credential
detection constant vs. docker-compose.yml's literal values had to move
together or a security warning would have silently stopped firing.

Data plane: Postgres database sentry_metadata -> cairnobs_metadata and
role sentry -> cairnobs; ClickHouse database sentry -> cairnobs; Kafka
topic sentry.logs.raw -> cairnobs.logs.raw and its consumer groups.
Source-level defaults, docker-compose.yml, and every migrate.sh/
provision script default updated together; already-applied migration
files left untouched per this repo's immutable-migration convention.

Verified at every layer: all 13 Go modules build/vet/test clean, both
Rust workspaces (agent, search) build/clippy/test clean, npm run check/
build clean, docker compose config validates on all four compose files.
Live-verified against a real docker stack multiple times through this
work, including a final fresh-volume run confirming the actual renamed
Postgres database/role, ClickHouse database, and Kafka topic all work
end to end with a real login and query, zero console errors.
This commit is contained in:
2026-08-21 20:53:32 -07:00
parent 9e21ea17bb
commit 13cf9a30cb
291 changed files with 1565 additions and 1441 deletions
+25 -25
View File
@@ -177,6 +177,31 @@ version = "1.12.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
[[package]]
name = "cairnobs-agent"
version = "0.1.0"
dependencies = [
"anyhow",
"cairnobs-parser",
"clap",
"prost",
"quick-xml",
"serde",
"serde_json",
"tokio",
"toml",
"tonic",
"tonic-build",
"tracing",
"tracing-subscriber",
"windows",
"windows-service",
]
[[package]]
name = "cairnobs-parser"
version = "0.1.0"
[[package]]
name = "cc"
version = "1.4.2"
@@ -895,31 +920,6 @@ version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
[[package]]
name = "sentry-agent"
version = "0.1.0"
dependencies = [
"anyhow",
"clap",
"prost",
"quick-xml",
"sentry-parser",
"serde",
"serde_json",
"tokio",
"toml",
"tonic",
"tonic-build",
"tracing",
"tracing-subscriber",
"windows",
"windows-service",
]
[[package]]
name = "sentry-parser"
version = "0.1.0"
[[package]]
name = "serde"
version = "1.0.229"
+1 -1
View File
@@ -1,6 +1,6 @@
[workspace]
resolver = "2"
members = ["sentry-parser", "sentry-agent"]
members = ["cairnobs-parser", "cairnobs-agent"]
[workspace.package]
version = "0.1.0"
+4 -4
View File
@@ -1,6 +1,6 @@
# Build context must be the repo root (sentry/), not agent/, since this
# needs both agent/ and proto/:
# docker build -f agent/Dockerfile -t sentry-agent .
# docker build -f agent/Dockerfile -t cairnobs-agent .
FROM rust:1-alpine AS builder
RUN apk add --no-cache musl-dev protobuf-dev protobuf
@@ -14,8 +14,8 @@ WORKDIR /src/agent
# alongside the journald default rather than left as an opt-in most
# deployments would otherwise have to remember to ask for.
RUN rustup target add x86_64-unknown-linux-musl \
&& cargo build --release --target x86_64-unknown-linux-musl -p sentry-agent --features journald,file-tail
&& cargo build --release --target x86_64-unknown-linux-musl -p cairnobs-agent --features journald,file-tail
FROM scratch
COPY --from=builder /src/agent/target/x86_64-unknown-linux-musl/release/sentry-agent /sentry-agent
ENTRYPOINT ["/sentry-agent"]
COPY --from=builder /src/agent/target/x86_64-unknown-linux-musl/release/cairnobs-agent /cairnobs-agent
ENTRYPOINT ["/cairnobs-agent"]
+18 -18
View File
@@ -1,4 +1,4 @@
# sentry-agent
# cairnobs-agent
Distro-agnostic Linux/Windows log collector. On Linux, statically linked
against musl, no glibc runtime dependency. Tails journald (Linux default),
@@ -17,9 +17,9 @@ real before trusting it. See `/docs/phase-1-runbook.md`.
## Workspace layout
- `sentry-parser` — pure-`std` RFC 5424 syslog parser with raw-passthrough
- `cairnobs-parser` — pure-`std` RFC 5424 syslog parser with raw-passthrough
fallback. No I/O, easy to unit test in isolation.
- `sentry-agent` — the binary: config loading, sourcing (journald/file/
- `cairnobs-agent` — the binary: config loading, sourcing (journald/file/
Windows Event Log/ETW), batching, mTLS gRPC client, Windows service
wrapper.
@@ -75,7 +75,7 @@ Container build (see caveat below):
```sh
# from the repo root, not agent/
docker build -f agent/Dockerfile -t sentry-agent .
docker build -f agent/Dockerfile -t cairnobs-agent .
```
**Caveat:** the container image is provided for CI/completeness, but
@@ -117,11 +117,11 @@ automatable vs. manual-only.
No CLI flags are required for the common case:
```sh
./sentry-agent
./cairnobs-agent
```
This uses the platform's conventional config path if present
(`/etc/sentry-agent/agent.toml` on Linux, `C:\ProgramData\SentryAgent\agent.toml`
(`/etc/cairnobs-agent/agent.toml` on Linux, `C:\ProgramData\CairnObsAgent\agent.toml`
on Windows), otherwise built-in defaults: journald source on Linux (whole
journal, no unit filter), service name `default`, and mTLS material
expected under the same conventional directory
@@ -132,7 +132,7 @@ fail fast with a clear error rather than connecting insecurely.
See `config/agent.example.toml` for all fields.
```sh
./sentry-agent --config /path/to/agent.toml
./cairnobs-agent --config /path/to/agent.toml
```
## Heartbeat and unavailability alerting
@@ -142,7 +142,7 @@ schedule (`[heartbeat]` in the config, default every 60s), separate from
whatever real log traffic is flowing — see `config/agent.example.toml`.
This isn't a new wire protocol: it's an ordinary record through the same
`PushBatch` RPC and mTLS identity every log line uses, tagged with a
`sentry.heartbeat=true` attribute so it's easy to filter for and doesn't
`cairnobs.heartbeat=true` attribute so it's easy to filter for and doesn't
show up as noise in normal log views. Set `interval` to a plain number
plus `s`/`m`/`h` (matches the query language's own `earliest=`/`latest=`
units); `enabled = false` turns it off entirely.
@@ -157,7 +157,7 @@ to create.
Same shape as heartbeat, same reasoning: `[metrics]` in the config
(`enabled = false` by default) sends a periodic record — CPU%, memory
used/total, disk used/total for `/` — tagged `sentry.metrics=true`, with
used/total, disk used/total for `/` — tagged `cairnobs.metrics=true`, with
the individual numbers as their own attributes (`cpu_percent`,
`mem_used_bytes`, `mem_total_bytes`, `disk_used_bytes`,
`disk_total_bytes`), queryable directly (e.g. `cpu_percent > 80`) since
@@ -169,7 +169,7 @@ dependencies, same "shell out to a boring, ubiquitous tool" precedent
`journalctl` already sets.
**Enable this on only one agent process per physical host.** It's
common for one host to run several `sentry-agent` processes (one per
common for one host to run several `cairnobs-agent` processes (one per
log source, each needing its own `[agent] host` value to work around
the `agents` table's `UNIQUE (tenant_id, host)` constraint — see
`/docs/agent-management-design.md`) — turning `[metrics]` on for more
@@ -185,14 +185,14 @@ console — that's what `service.rs` (via the `windows-service` crate)
does. From an administrator shell:
```powershell
sentry-agent.exe install # registers the service, Automatic start, LocalSystem account
sc.exe start SentryAgent
sc.exe stop SentryAgent
sentry-agent.exe uninstall
cairnobs-agent.exe install # registers the service, Automatic start, LocalSystem account
sc.exe start CairnObsAgent
sc.exe stop CairnObsAgent
cairnobs-agent.exe uninstall
```
`install`/`uninstall`/`run-service` are subcommands only present in
Windows builds (`sentry-agent` with no subcommand is still the normal
Windows builds (`cairnobs-agent` with no subcommand is still the normal
foreground/console run, same as on Linux) — `run-service` specifically is
what the SCM itself invokes at service start; don't run it directly.
@@ -224,7 +224,7 @@ about since they're very different amounts of work:
1. **What this repo supports today, with zero extra code:** WEF is a
native Windows-to-Windows mechanism (`wecsvc`, the built-in Windows
Event Collector role) — endpoints forward to a Windows Server acting
as collector using Windows' own mechanism, no Sentry code involved in
as collector using Windows' own mechanism, no Cairn OBS code involved in
the forwarding itself. Run this agent *on the collector box*,
subscribed to the `ForwardedEvents` channel instead of the usual three:
```toml
@@ -233,9 +233,9 @@ about since they're very different amounts of work:
channels = ["ForwardedEvents"]
```
2. **What this repo does *not* implement:** a true agentless receiver —
Sentry itself speaking the WS-Management/WinRM event-subscription
Cairn OBS itself speaking the WS-Management/WinRM event-subscription
protocol so endpoints can forward directly to `ingest` without any
Windows Event Collector role or Sentry agent anywhere. That's a
Windows Event Collector role or Cairn OBS agent anywhere. That's a
standalone protocol implementation (SOAP-ish subscription/heartbeat/
delivery over WinRM), not an agent or ingest-side tweak, and it's out
of scope for Phase 1. If you need this, it's a real project of its
@@ -1,12 +1,12 @@
[package]
name = "sentry-agent"
name = "cairnobs-agent"
version.workspace = true
edition.workspace = true
license.workspace = true
description = "Sentry distro-agnostic Linux/Windows log collector"
description = "Cairn OBS distro-agnostic Linux/Windows log collector"
[[bin]]
name = "sentry-agent"
name = "cairnobs-agent"
path = "src/main.rs"
[features]
@@ -21,7 +21,7 @@ windows-eventlog = []
etw = []
[dependencies]
sentry-parser = { path = "../sentry-parser" }
cairnobs-parser = { path = "../cairnobs-parser" }
tokio = { version = "1", features = ["rt-multi-thread", "macros", "process", "io-util", "io-std", "time", "fs", "sync", "signal"] }
tonic = { version = "0.12", features = ["tls"] }
@@ -1,12 +1,12 @@
# Example sentry-agent config. Copy to the platform's conventional path
# (/etc/sentry-agent/agent.toml on Linux, C:\ProgramData\SentryAgent\agent.toml
# Example cairnobs-agent config. Copy to the platform's conventional path
# (/etc/cairnobs-agent/agent.toml on Linux, C:\ProgramData\CairnObsAgent\agent.toml
# on Windows), or pass --config /path/to/this/file.
#
# Every field has a built-in default (see src/config.rs), so this file only
# needs to contain what you're overriding. An agent with NO config file at
# all still runs: on Linux it defaults to journald, service = "default",
# and expects mTLS material at /etc/sentry-agent/{ca,client,client-key}.pem
# (Windows equivalents under C:\ProgramData\SentryAgent\).
# and expects mTLS material at /etc/cairnobs-agent/{ca,client,client-key}.pem
# (Windows equivalents under C:\ProgramData\CairnObsAgent\).
[agent]
# host = "explicit-hostname-override" # defaults to /etc/hostname (Linux) or %COMPUTERNAME% (Windows)
@@ -41,7 +41,7 @@ flush_interval_ms = 2000
[heartbeat]
# How often this agent proves it's still alive to the platform, sent as
# its own record independent of whatever real log traffic is flowing --
# pair with an "absence" alert rule on the sentry.heartbeat attribute to
# pair with an "absence" alert rule on the cairnobs.heartbeat attribute to
# get paged when a host goes quiet. Accepts a plain number + unit: s
# (seconds), m (minutes), or h (hours) -- same vocabulary as
# earliest=/latest= in the query language. See
@@ -55,7 +55,7 @@ interval = "60s"
# Host CPU/memory/disk usage, sent as its own periodic record the same
# way heartbeat is (see web/'s "Hosts" nav section). Off by default --
# unlike heartbeat, this is a deliberate per-host decision: if several
# sentry-agent processes run on the same physical host (e.g. one per log
# cairnobs-agent processes run on the same physical host (e.g. one per log
# source), enable this on only ONE of them, or the same host will report
# multiple conflicting metric series. Linux-only for now. Root disk ("/")
# only -- not configurable in this release.
@@ -66,6 +66,6 @@ interval = "60s"
endpoint = "https://ingest.internal:4317"
[tls]
ca_cert = "/etc/sentry-agent/ca.pem"
client_cert = "/etc/sentry-agent/client.pem"
client_key = "/etc/sentry-agent/client-key.pem"
ca_cert = "/etc/cairnobs-agent/ca.pem"
client_cert = "/etc/cairnobs-agent/client.pem"
client_key = "/etc/cairnobs-agent/client-key.pem"
@@ -4,9 +4,9 @@ use std::path::{Path, PathBuf};
use std::time::Duration;
#[cfg(not(windows))]
const DEFAULT_CONFIG_PATH: &str = "/etc/sentry-agent/agent.toml";
const DEFAULT_CONFIG_PATH: &str = "/etc/cairnobs-agent/agent.toml";
#[cfg(windows)]
const DEFAULT_CONFIG_PATH: &str = r"C:\ProgramData\SentryAgent\agent.toml";
const DEFAULT_CONFIG_PATH: &str = r"C:\ProgramData\CairnObsAgent\agent.toml";
#[derive(Debug, Clone, Deserialize, Default)]
#[serde(default)]
@@ -23,8 +23,8 @@ pub struct Config {
impl Config {
/// Loads config from `explicit_path` if given, else from the
/// platform's conventional config path if it exists
/// (`/etc/sentry-agent/agent.toml` on Linux,
/// `C:\ProgramData\SentryAgent\agent.toml` on Windows), else falls
/// (`/etc/cairnobs-agent/agent.toml` on Linux,
/// `C:\ProgramData\CairnObsAgent\agent.toml` on Windows), else falls
/// back to built-in defaults (journald source on Linux, default TLS
/// cert paths). Only an explicitly-passed `--config` path that doesn't
/// exist is an error; the conventional default path is optional.
@@ -150,7 +150,7 @@ impl Default for BatchConfig {
/// `flush_interval_ms` like real records do. This is the operator-facing
/// "polling resolution" knob: how often this agent proves it's still
/// alive, which a `condition_type = "absence"` alert rule on the
/// `sentry.heartbeat` attribute (see /docs/agent-heartbeat-monitoring.md)
/// `cairnobs.heartbeat` attribute (see /docs/agent-heartbeat-monitoring.md)
/// turns into "alert when this host goes quiet."
#[derive(Debug, Clone, Deserialize)]
#[serde(default)]
@@ -321,10 +321,10 @@ impl Default for TlsConfig {
#[cfg(not(windows))]
fn default_cert_path(name: &str) -> PathBuf {
PathBuf::from(format!("/etc/sentry-agent/{name}"))
PathBuf::from(format!("/etc/cairnobs-agent/{name}"))
}
#[cfg(windows)]
fn default_cert_path(name: &str) -> PathBuf {
PathBuf::from(format!(r"C:\ProgramData\SentryAgent\{name}"))
PathBuf::from(format!(r"C:\ProgramData\CairnObsAgent\{name}"))
}
@@ -31,7 +31,7 @@ use tokio::sync::mpsc;
use tonic::transport::Channel;
#[derive(Parser)]
#[command(name = "sentry-agent", about = "Sentry Linux/Windows log collector")]
#[command(name = "cairnobs-agent", about = "Cairn OBS Linux/Windows log collector")]
struct Cli {
/// Path to a TOML config file. Defaults to the platform's conventional
/// path if present, otherwise built-in defaults — see config::Config::load.
@@ -53,7 +53,7 @@ enum WindowsCommand {
Uninstall,
/// Entry point the Service Control Manager invokes when starting the
/// registered service. Not meant to be run directly by a user — use
/// `sentry-agent` with no subcommand for a normal foreground/console
/// `cairnobs-agent` with no subcommand for a normal foreground/console
/// run, same as on Linux.
RunService,
}
@@ -244,7 +244,7 @@ pub async fn run_agent(config_path: Option<PathBuf>) -> Result<()> {
tracing::warn!("source exited, flushing remaining batch and shutting down");
break;
};
let parsed = sentry_parser::parse(&raw.line);
let parsed = cairnobs_parser::parse(&raw.line);
let severity = to_pb_severity(raw.severity_hint.or(parsed.severity));
let mut attributes: std::collections::HashMap<String, String> =
parsed.attributes.into_iter().collect();
@@ -476,7 +476,7 @@ async fn spawn_source(source: config::SourceConfig, tx: source::LineSender) {
/// ticker's own comment above): a heartbeat that got queued behind
/// `batch.max_size` or `batch.flush_interval_ms` would defeat the point
/// of a punctual "still alive" signal. Distinguished from a real log
/// record purely by the `sentry.heartbeat` attribute -- `service` stays
/// record purely by the `cairnobs.heartbeat` attribute -- `service` stays
/// the agent's real configured service so it doesn't pollute
/// service-based dashboards/faceting with a fake value. See
/// /docs/agent-heartbeat-monitoring.md for how an absence alert rule
@@ -488,7 +488,7 @@ async fn send_heartbeat(client: &mut LogIngestClient<Channel>, host: &str, servi
service: service.to_string(),
severity: Severity::Info as i32,
message: "agent heartbeat".to_string(),
attributes: std::collections::HashMap::from([("sentry.heartbeat".to_string(), "true".to_string())]),
attributes: std::collections::HashMap::from([("cairnobs.heartbeat".to_string(), "true".to_string())]),
record_id: String::new(),
};
match grpc::send_batch(client, format!("heartbeat-{}", batch_id()), vec![record]).await {
@@ -499,7 +499,7 @@ async fn send_heartbeat(client: &mut LogIngestClient<Channel>, host: &str, servi
/// Same "no new proto, no new ingest code, no new ClickHouse schema"
/// shape as `send_heartbeat` above -- a metrics sample is just another
/// tagged `LogRecord`, distinguished by the `sentry.metrics` attribute.
/// tagged `LogRecord`, distinguished by the `cairnobs.metrics` attribute.
/// Unlike heartbeat, the numeric fields themselves are real query-language
/// attributes too (`cpu_percent`, `mem_used_bytes`, etc.) rather than
/// being folded into `message` -- confirmed before building this that
@@ -523,7 +523,7 @@ async fn send_metrics(client: &mut LogIngestClient<Channel>, host: &str, service
severity: Severity::Info as i32,
message: "host metrics".to_string(),
attributes: std::collections::HashMap::from([
("sentry.metrics".to_string(), "true".to_string()),
("cairnobs.metrics".to_string(), "true".to_string()),
("cpu_percent".to_string(), format!("{:.2}", m.cpu_percent)),
("mem_used_bytes".to_string(), m.mem_used_bytes.to_string()),
("mem_total_bytes".to_string(), m.mem_total_bytes.to_string()),
@@ -27,12 +27,12 @@ use windows_service::service_control_handler::{self, ServiceControlHandlerResult
use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};
use windows_service::{define_windows_service, service_dispatcher};
pub const SERVICE_NAME: &str = "SentryAgent";
pub const SERVICE_NAME: &str = "CairnObsAgent";
const SERVICE_TYPE: ServiceType = ServiceType::OWN_PROCESS;
/// Registers this binary as a Windows service: Automatic start,
/// LocalSystem account, invoked with the `run-service` subcommand (which
/// is what the SCM actually launches — not a bare `sentry-agent` with no
/// is what the SCM actually launches — not a bare `cairnobs-agent` with no
/// arguments). Requires an administrator shell.
pub fn install() -> Result<()> {
let manager = ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CREATE_SERVICE)
@@ -42,7 +42,7 @@ pub fn install() -> Result<()> {
let service_info = ServiceInfo {
name: OsString::from(SERVICE_NAME),
display_name: OsString::from("Sentry Log Agent"),
display_name: OsString::from("Cairn OBS Log Agent"),
service_type: SERVICE_TYPE,
start_type: ServiceStartType::AutoStart,
error_control: ServiceErrorControl::Normal,
@@ -57,7 +57,7 @@ pub fn install() -> Result<()> {
.create_service(&service_info, ServiceAccess::CHANGE_CONFIG)
.context("creating service")?;
service
.set_description("Ships local logs to Sentry ingest over mTLS.")
.set_description("Ships local logs to Cairn OBS ingest over mTLS.")
.context("setting service description")?;
tracing::info!(service = SERVICE_NAME, "installed Windows service");
@@ -44,7 +44,7 @@ use windows::Win32::System::Diagnostics::Etw::{
PROCESS_TRACE_MODE_REAL_TIME, TRACE_LEVEL_VERBOSE,
};
const SESSION_NAME: &str = "SentryAgentEtw";
const SESSION_NAME: &str = "CairnObsAgentEtw";
pub async fn run(providers: &[String], tx: LineSender) -> Result<()> {
let providers = providers.to_vec();
@@ -212,7 +212,7 @@ unsafe extern "system" fn event_record_callback(record: *mut EVENT_RECORD) {
// No TDH-based message rendering (see module doc comment) -- this is
// a coarse, structured summary rather than a human-authored message.
// Downstream (sentry_parser's raw-passthrough fallback) handles a
// Downstream (cairnobs_parser's raw-passthrough fallback) handles a
// non-RFC5424 line like this the same as any other raw line.
let message = format!(
"ETW event: provider={:?} id={} level={}",
@@ -226,7 +226,7 @@ fn parse_event_xml(xml: &str, channel: &str) -> Option<RawLine> {
// rendered properly. Real message-template rendering needs
// EvtFormatMessage against the provider's message-table resource --
// worth a follow-up, not required for a raw-passthrough-shaped record
// (sentry_parser's raw fallback handles this fine either way).
// (cairnobs_parser's raw fallback handles this fine either way).
let message = if event_data_values.is_empty() {
xml.to_string()
} else {
@@ -1,5 +1,5 @@
[package]
name = "sentry-parser"
name = "cairnobs-parser"
version.workspace = true
edition.workspace = true
license.workspace = true
+1 -1
View File
@@ -88,7 +88,7 @@ ignore = [
# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
# Sentry's own AGPLv3-project license policy (Phase 6 license audit --
# Cairn OBS's own AGPLv3-project license policy (Phase 6 license audit --
# see /docs/compliance/license-policy.md for the full rationale per
# category). Every license actually found in this crate's dependency
# tree at audit time is listed explicitly here, not just the common