A worked integration of SolidSyslog, built up in stages — from a device with no syslog at all to one whose records are authenticated and encrypted.
Each stage is one commit. It says what it does, what it changes, what it gives you, and what it costs. The costs are measured by the device itself, not estimated.
It builds on a baseline that simulates the sort of device you might be adding this to, and that measures itself: see docs/baseline.md for what the baseline is, how the figures are made, and how to run it.
The device logs one RFC 5424 record carrying four SD elements — sequence and uptime, time quality, origin, and a private element naming the protection its own log pipeline is under. The record goes to the collector over mutual TLS and is spooled to a local store encrypted with AES-256-GCM, so records survive a failed send and a disk that leaves the device gives nothing away.
Cost above baseline: Flash +13,780 B, RAM +37,748 B.
Most devices want less than that. The table below prices every stage, and the cheapest row that does anything useful — a valid, timestamped record on the wire — is a fraction of it.
Read it as a sequence. Start at the Baseline commit and step forward: git show on any stage
gives you the diff to apply to your own build, the reasoning behind it, and the measured cost of
applying it — each stage's run is committed alongside it as run-report.md. Stop
where your device's threat model does.
| Stage | What it gives you | Flash | RAM |
|---|---|---|---|
| Baseline | a device that already networks, stores, and holds an mTLS session — before any syslog | — | — |
| Linked | the core library and lwIP raw-mode networking, linked but not yet called | +0 | +0 |
| Error handler | a fault inside the logger reaches the console instead of being silent | +412 | +8 |
| Logger created | the logger object, reporting exactly what is still missing from it | +1,044 | +180 |
| First record | a valid RFC 5424 record on the wire, over UDP | +4,716 | +368 |
| Header fields | a timestamped record naming the device, instead of nil values | +5,100 | +368 |
| Sequence numbers | every record numbered, so a gap in the sequence is visible | +6,036 | +432 |
| Message cap | a bounded record size, so a long message truncates instead of being dropped | +6,036 | +1,952 |
| Buffered | logging that returns immediately, with the send moved off the logging task | +6,788 | +5,672 |
| TCP | records the network retransmits instead of dropping, and a send that fails when the collector is gone | +7,332 | +5,852 |
| Time quality | a timestamp the collector knows how far to trust, and an uptime that tells a reboot from a counter wrap | +7,620 | +5,876 |
| File store | records that survive a failed send, spooled to disk with a checksum at rest | +11,572 | +7,088 |
| Origin | the device named in the record itself, not inferred from the source address | +11,980 | +7,132 |
| Larger cap | headroom for the grown record, so full-width counters cannot push it into truncation | +11,996 | +9,436 |
| Smaller ring | most of the cap rise given back, now the store rather than the ring holds a backlog | +11,996 | +7,380 |
| Origin address | the device's own address in the record, which a relay or NAT between it and the collector cannot rewrite | +12,388 | +7,380 |
| TLS | a collector the device authenticates, and records no longer readable on the wire | +13,076 | +35,660 |
| HMAC at rest | stored records that cannot be edited undetected, not merely checked for corruption | +13,424 | +35,680 |
| Private SD-ELEMENT | a record that states the protection its own log pipeline was under | +13,564 | +35,684 |
| Mutual TLS | a collector that knows which device sent the record, not just that one did | +13,632 | +37,736 |
| AES-GCM at rest | spooled records unreadable to anyone holding the disk, not just unforgeable | +13,780 | +37,748 |
Deltas are bytes above the baseline, which is itself Flash 350,124 B, RAM 111,192 B.
This example's own code is 0BSD — completely open, no conditions.
Third-party code keeps its own license: the vendored Arm SMSC9220 driver (app/net/smsc9220/) is
Apache-2.0 (see its LICENSE). SolidSyslog and the four upstream projects are under third_party/
and used under their own licenses — third_party/README.md says which,
and how each is pinned or vendored.