Skip to content

fix(telemetry): keep participant identity out of log message bodies - #7156

Open
omChauhanDev wants to merge 1 commit into
livekit:mainfrom
omChauhanDev:fix/pii-in-log-message-bodies
Open

fix(telemetry): keep participant identity out of log message bodies#7156
omChauhanDev wants to merge 1 commit into
livekit:mainfrom
omChauhanDev:fix/pii-in-log-message-bodies

Conversation

@omChauhanDev

Copy link
Copy Markdown
Contributor

Problem

Redaction here is field-level filtering of log attributes.
telemetry.pii._PIIFilteringLogProcessor.on_emit rewrites record.attributes and
_TraceLevelLoggingHandler._translate does the same; neither touches the record body. The comment
in traces.py says why:

callers pass user data through extra={"lk.pii.<name>": ...} precisely because a log body
cannot be redacted

Four call sites interpolate a participant identity or a room name into the message body, so those
values are exported as written even when the project has redaction enabled:

  • job.py, the duplicate participant-task warning and the participant-entrypoint error
  • beta/workflows/warm_transfer.py, the caller-disconnect log and the room-move log

Both categories are the ones REVIEW.md lists first, and both already have a marked constant in
telemetry/trace_types.py: ATTR_PARTICIPANT_IDENTITY and ATTR_ROOM_NAME.

Changes

Each message becomes static and the value moves to extra, with the key written as a
lk.pii.<name> literal, which is how every other logger extra in the tree writes it
(llm/utils.py, beta/workflows/dtmf_inputs.py, voice/agent_activity.py). No new imports, and
job.py's warning no longer needs its # noqa: E501.

exc_info on the entrypoint error is unchanged: the exception message and stacktrace are already
handled by _TraceLevelLoggingHandler.

Both files are in one change because the new test is tree-wide, so fixing only one leaves it red.

Testing

tests/test_telemetry_pii_log_bodies.py parses livekit-agents/ and livekit-plugins/ and fails
when a plain name or attribute chain matching an identity or a room name is interpolated into a
logger message. On main it reports all five expressions across the four sites. It reads
expressions rather than values, so it stays narrow: f"{p.identity}" is flagged,
f"{identity is not None}" is not.

pytest --unit --audio_eot: 2575 passed, 5 skipped, against 2574 on unmodified main.
ruff check and ruff format --check (995 files) clean, scripts/check_types.py reports no
issues in 650 source files.
All at 4d03f505c.

Redaction is field level: the PII log processor and the trace level logging
handler both rewrite record.attributes and neither touches the body. The
comment in traces.py says why, that callers pass user data through
extra={"lk.pii.<name>": ...} precisely because a log body cannot be redacted.

Four call sites interpolate a participant identity or a room name into the
message itself, so those values are exported as written even when the project
has redaction enabled: the duplicate participant task warning and the
participant entrypoint error in job.py, and the caller disconnect and room move
logs in the warm transfer workflow.

Each message becomes static and the value moves to extra, keyed with the
lk.pii.<name> literal every other logger extra in the tree uses. The warning in
job.py no longer needs its noqa for line length.
@omChauhanDev
omChauhanDev requested a review from a team as a code owner September 7, 2026 10:41

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Devin Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant