Goal
One example repository that shows, in defensible numbers, what SolidSyslog costs on a
realistic secure networked device — and doubles as an integration walk-through. The diff (and
the commit history) between two tags is the tutorial; the committed measurements are the cost.
Target: FreeRTOS + lwIP + mbedTLS + FatFs on QEMU mps2-an385 (Cortex-M3), syslog-ng as the
collector. One target — we sell deltas, not absolute numbers.
Four states (git tags)
| Tag |
What it is |
Reference |
| Baseline |
The device you already have — networking, storage, crypto — with zero SolidSyslog. Every delta is measured against this. |
— |
| Minimal |
The least: a valid, timestamped RFC 5424 record over UDP. |
SL1 |
| Secure (recommended) |
Untrusted network: server-auth TLS, store-and-forward, at-rest integrity. |
SL2 / CRA |
| Hardened |
Non-repudiation: mutual TLS, tamper-evident storage, origin evidence. |
SL3+ |
Each state is the previous one plus more capability selected from the same platform. Secure
is the recommended target for most CRA-facing or SL2 devices; Minimal is the cheaper floor;
Hardened is for when more must be proven. SL4 (write-once storage, hardware-held keys) is
platform/hardware, not library code — doc-only.
IEC 62443 certifies systems, not components, and the CRA concerns the whole product. These
examples show how a device contributes to a compliant system's audit-logging story —
guidance, not a guarantee of compliance.
How it's built
- One frozen Baseline. lwIP up, FatFs mounted, mbedTLS linked-but-not-run — the platform
cost, below the line. SolidSyslog is not present in it.
- The device measures itself — flash, RAM, heap, and per-task stack on the two seams
SolidSyslog occupies (a log source and a service worker) — and reports
current − Baseline. A Baseline build reports ~0, which the test suite asserts, guarding
against drift.
- One capability per commit; infra frozen at Baseline.
git diff Baseline..Secure and the
commit log between are the integration guide. A board-support/infra file changing in a later
diff means something is wrong.
- One way to run —
./run.sh, the same locally and in CI: fire up the collector, build and
run under QEMU, and report the measurements plus whatever the collector received.
Tracking
Work is tracked as the sub-issues of this epic. Any gap this surfaces in the library itself
(a missing callback, a needed tunable, a manifest hole) is filed as a normal story on the
solid-syslog board.
Goal
One example repository that shows, in defensible numbers, what SolidSyslog costs on a
realistic secure networked device — and doubles as an integration walk-through. The diff (and
the commit history) between two tags is the tutorial; the committed measurements are the cost.
Target: FreeRTOS + lwIP + mbedTLS + FatFs on QEMU mps2-an385 (Cortex-M3), syslog-ng as the
collector. One target — we sell deltas, not absolute numbers.
Four states (git tags)
Each state is the previous one plus more capability selected from the same platform. Secure
is the recommended target for most CRA-facing or SL2 devices; Minimal is the cheaper floor;
Hardened is for when more must be proven. SL4 (write-once storage, hardware-held keys) is
platform/hardware, not library code — doc-only.
How it's built
cost, below the line. SolidSyslog is not present in it.
SolidSyslog occupies (a log source and a service worker) — and reports
current − Baseline. A Baseline build reports ~0, which the test suite asserts, guarding
against drift.
git diff Baseline..Secureand thecommit log between are the integration guide. A board-support/infra file changing in a later
diff means something is wrong.
./run.sh, the same locally and in CI: fire up the collector, build andrun under QEMU, and report the measurements plus whatever the collector received.
Tracking
Work is tracked as the sub-issues of this epic. Any gap this surfaces in the library itself
(a missing callback, a needed tunable, a manifest hole) is filed as a normal story on the
solid-syslog board.