Development

go test -race ./...                                   # everything below except load and fuzzing
SIEMLITE_LOAD=small go test ./loadtest -run Load -v   # load tests: ci (~1 min), small (~6 min), or hard with SIEMLITE_LOAD_FOR=5m, 30m or 2h
go test ./pkg/parser -run '^$' -fuzz FuzzDraftPattern # one fuzzer; see .github/workflows/ci.yml for all of them
python3 e2e/ui_test.py ./siemlite                     # browser test (needs Playwright for Python)

The tests go beyond examples:

• Every route, every caller: the API's route table is read from the source, and each route is called with no credentials, a forged cookie, a bad token, a valid access token, a standard user and an admin, and cross-site. A new route can't ship without a permission.
• Limited users never see other sources: random users get random sets of sources and run random searches, filters and pages; their results must equal an admin's results less the sources they weren't given.
• Upgrades from every version: a populated database from every schema version SIEMLite has shipped is upgraded and must end up identical to a new one, with every row, reference and search index intact.
• Day files against one table: every search, filter and page across day files (with late events, clocks ahead and ties at midnight) must equal the same events searched in one table; the dashboard must add up the same; and moving events out of an old database while searches run must never show one twice or miss one.
• Fuzzing: log lines, parser patterns, the pattern builder, syslog framing, backup names and threat intel feeds get millions of generated inputs. This found and fixed four ways the pattern builder could draft a pattern that didn't match its own sample lines.
• Everything at once: ingest over HTTPS and syslog, searches by admins and limited users, retention, backups, the alert engine, the log generator and user changes run together, under the race detector too. Nothing may be lost, leaked or corrupted, and every backup must open. This found backups failing with "database is locked" on a busy server; fixed.
• Load: ingest over HTTPS, syslog floods and searches on millions of events, each with a floor it must reach; see Performance. Running these found and fixed slow searches for common words and deep pages, and an alert engine that would have needed minutes for a large database.
• In a browser: a real SIEMLite fed by the log generator is clicked through page by page, at desktop and phone sizes, until the generator's brute force shows up as an alert.

Every pull request and every commit on main runs these on GitHub (.github/workflows/ci.yml): formatting, go vet, the tests with the race detector, the ci load tests, 20 seconds of each fuzzer, the browser test, a build, a syntax check of the web UI's script, govulncheck for known vulnerabilities in code SIEMLite actually calls, and a build of the Docker image for x86-64 and ARM64.