Skip to content

Address edge-case with audit mode logging and license key obfuscation #2813

@jasonjkeller

Description

@jasonjkeller

When audit_mode logging is enabled the agent logs the payload sent to the collector. As part of that, the request URI should obfuscate the license_key (i.e. license_key=obfuscated):

2026-03-27T09:51:05,208-0700 [28409 70] com.newrelic INFO: Sent JSON(preconnect) to: https://collector.newrelic.com:443/agent_listener/invoke_raw_method?method=preconnect&license_key=obfuscated&marshal_format=json&protocol_version=17, with payload: [{"high_security":false}]

Even though the Java agent doesn't support hot-swapping the license_key, if someone were to try it there is an edge case that will break the audit logging obfuscation.

This occurs because the license_key is set when the DataSenderImpl is first initialized and it never gets updated again (despite the hot-swap). The obfuscation logic tries to string match the old key (in the DataSenderImpl request URI) and the new hot-swapped key (returned from agent config). Since these are two different keys, the string matching fails and the license_key no longer gets obfuscated in the audit_mode logging.

Metadata

Metadata

Assignees

No one assigned

    Labels

    1Story Point EstimatebugSomething isn't working as designed/intended

    Type

    No type

    Projects

    Status

    Reviewed

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions