Apply benign-noise filter in scanLinuxLogs so nginx TLS-probe noise (bad key share) stops creating ledger rows

0d7a271ed3413dcb910b62fc6722f07cad23be48 · 2026-05-30 11:34:45 -0700 · SteveStudio2

Files touched

M index.js

Diff

commit 0d7a271ed3413dcb910b62fc6722f07cad23be48
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 11:34:45 2026 -0700

    Apply benign-noise filter in scanLinuxLogs so nginx TLS-probe noise (bad key share) stops creating ledger rows
---
 index.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/index.js b/index.js
index 388da8d..3af83e4 100644
--- a/index.js
+++ b/index.js
@@ -350,6 +350,14 @@ async function scanLinuxLogs(state) {
     const meaningful = /\b(error|fatal|crit|emerg|alert|panic|segfault|core dumped)\b/i.test(chunk);
     if (!meaningful) { state.logOffsets[errPath] = cur; continue; }
     const processName = path.basename(errPath).replace(/\.log$/, '');
+    // Per-process known-benign-noise filter (same as the launchd path). nginx
+    // error.log (processName === 'error') is mostly TLS-probe noise from bots —
+    // SSL_do_handshake bad key share / unsupported protocol / etc. If EVERY line
+    // in the new chunk is that noise, advance the offset without posting. A chunk
+    // mixing real errors with TLS noise still posts (isBenignNoise requires ALL
+    // lines match). Without this, a single inbound bad-key-share crit became a
+    // high-severity ledger row (2026-05-30).
+    if (isBenignNoise(processName, chunk)) { state.logOffsets[errPath] = cur; continue; }
     const posted = await postTask({
       source: 'linux',
       processName,

← bba7324 fix(collector): bump execSync maxBuffer to prevent pm2 jlist · back to Cncp Failure Collector · (newest)