From 9a3d4a101ca13c380ed2366ec4efdb4444810a02 Mon Sep 17 00:00:00 2001
From: Shubham Kumar <shkumar@viantinc.com>
Date: Mon, 28 Sep 2026 16:31:48 -0500
Subject: [PATCH] Skip [AUDIT] logs for /v1/api/meta/* by default.

Meta metric/status scrapes generate high-volume AUDIT noise with little
ops value. Business-route AUDIT is unchanged. Override via
AuditExcludeURIPrefixes (empty slice disables the default exclusion).

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 repository/logging/config.go       | 32 ++++++++++++
 repository/logging/logging.go      |  2 +-
 repository/logging/logging_test.go | 80 ++++++++++++++++++++++++++++++
 3 files changed, 113 insertions(+), 1 deletion(-)

diff --git a/repository/logging/config.go b/repository/logging/config.go
index efc16fcd9..21ac4d1cf 100644
--- a/repository/logging/config.go
+++ b/repository/logging/config.go
@@ -1,11 +1,19 @@
 package logging
 
+import "strings"
+
 type Config struct {
 	EnableTracing *bool
 	EnableAudit   *bool
 	IncludeSQL    *bool
+	// AuditExcludeURIPrefixes skips [AUDIT] logging when the request URI has any
+	// of these prefixes. Nil uses the default (meta introspect/metric scrapes).
+	// Set to an empty slice to disable path exclusions.
+	AuditExcludeURIPrefixes []string
 }
 
+var defaultAuditExcludeURIPrefixes = []string{"/v1/api/meta/"}
+
 func (c *Config) IsTracingEnabled() bool {
 	if c.EnableTracing == nil {
 		return false
@@ -26,3 +34,27 @@ func (c *Config) ShallIncludeSQL() bool {
 	}
 	return *c.IncludeSQL
 }
+
+func (c *Config) auditExcludePrefixes() []string {
+	if c == nil || c.AuditExcludeURIPrefixes == nil {
+		return defaultAuditExcludeURIPrefixes
+	}
+	return c.AuditExcludeURIPrefixes
+}
+
+// ShouldAuditURI reports whether [AUDIT] should be emitted for the request URI.
+func (c *Config) ShouldAuditURI(uri string) bool {
+	if !c.IsAuditEnabled() {
+		return false
+	}
+	path := uri
+	if i := strings.IndexByte(uri, '?'); i >= 0 {
+		path = uri[:i]
+	}
+	for _, prefix := range c.auditExcludePrefixes() {
+		if prefix != "" && strings.HasPrefix(path, prefix) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/repository/logging/logging.go b/repository/logging/logging.go
index e32077141..9a4938943 100644
--- a/repository/logging/logging.go
+++ b/repository/logging/logging.go
@@ -18,7 +18,7 @@ func Log(config *Config, execContext *exec.Context) {
 	if !includeSQL {
 		snap.Metrics = snap.Metrics.HideMetrics()
 	}
-	if config.IsAuditEnabled() {
+	if config.ShouldAuditURI(execContext.URI) {
 		data := safeMarshal("EXECCONTEXT", snap)
 		fmt.Println("[AUDIT]", string(data))
 	}
diff --git a/repository/logging/logging_test.go b/repository/logging/logging_test.go
index 3214c22e0..64f0b2e40 100644
--- a/repository/logging/logging_test.go
+++ b/repository/logging/logging_test.go
@@ -256,3 +256,83 @@ func TestLog_RedactsAuditAndTraceErrorsBeforeEmission(t *testing.T) {
 	assert.Contains(t, logged, "[TRACE]")
 	assert.Contains(t, logged, redactedValue)
 }
+
+func TestShouldAuditURI(t *testing.T) {
+	enabled := true
+	disabled := false
+
+	cases := []struct {
+		name   string
+		config *Config
+		uri    string
+		want   bool
+	}{
+		{
+			name:   "default excludes meta metric scrapes",
+			config: &Config{},
+			uri:    "/v1/api/meta/metric/mdp/adorder/operation/foo/recent",
+			want:   false,
+		},
+		{
+			name:   "default excludes meta status",
+			config: &Config{},
+			uri:    "/v1/api/meta/status",
+			want:   false,
+		},
+		{
+			name:   "default keeps business routes",
+			config: &Config{},
+			uri:    "/v1/api/mdp/kpiperf/produce",
+			want:   true,
+		},
+		{
+			name:   "strips query before prefix match",
+			config: &Config{},
+			uri:    "/v1/api/meta/metric/x?foo=1",
+			want:   false,
+		},
+		{
+			name:   "EnableAudit false disables all",
+			config: &Config{EnableAudit: &disabled},
+			uri:    "/v1/api/mdp/kpiperf/produce",
+			want:   false,
+		},
+		{
+			name:   "empty exclude list audits meta",
+			config: &Config{EnableAudit: &enabled, AuditExcludeURIPrefixes: []string{}},
+			uri:    "/v1/api/meta/metric/x",
+			want:   true,
+		},
+		{
+			name:   "custom exclude prefix",
+			config: &Config{AuditExcludeURIPrefixes: []string{"/v1/api/mdp/internal/"}},
+			uri:    "/v1/api/mdp/internal/health",
+			want:   false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.config.ShouldAuditURI(tc.uri))
+		})
+	}
+}
+
+func TestLog_SkipsMetaAudit(t *testing.T) {
+	oldStdout := os.Stdout
+	r, w, err := os.Pipe()
+	require.NoError(t, err)
+	os.Stdout = w
+
+	execCtx := exec.NewContext("GET", "/v1/api/meta/metric/mdp/adorder/operation/foo/recent", nil, "")
+	Log(&Config{}, execCtx)
+
+	require.NoError(t, w.Close())
+	os.Stdout = oldStdout
+	defer r.Close()
+
+	var output bytes.Buffer
+	_, err = io.Copy(&output, r)
+	require.NoError(t, err)
+	assert.NotContains(t, output.String(), "[AUDIT]")
+}