fix: operational logs to stderr (v0.9.1) — NDJSON stdout was polluted

Deep testing found the collector's tracing logs went to STDOUT, interleaved with the NDJSON
event stream, so a consumer (jq / vector / OTel filelog) would choke on the INFO log lines.
Logs now go to stderr (INFO by default); stdout is pure NDJSON. OTel json_parser skips
non-JSON lines for the k8s interleaved-pod-log case. Deep test: all event types flow together,
dropped=0 at ~110k events/60s, RSS flat (no leak), no panics. 0.9.0 -> 0.9.1.

Author: RoyLin

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to a3s-observer will be documented in this file.
 
+## [0.9.1] — fix: operational logs to stderr (NDJSON stdout was polluted)
+
+### Fixed
+
+- **Logs now go to stderr** (were on stdout, interleaved with the NDJSON event stream) — found
+  by deep testing: an NDJSON consumer (`jq` / vector / OTel `filelog`) would hit the `INFO …`
+  log lines and fail. stdout is now pure NDJSON; the operational logs (startup, throughput, drop
+  counter) are on stderr at INFO by default. The OTel sample's `json_parser` now also skips
+  non-JSON lines (for the k8s pod log, where stdout+stderr interleave).
+
+### Tested
+
+- Deep test (sustained mixed workload): all event types flow together, **dropped=0** at ~110 k
+  events/60 s, RSS flat (no leak), no panics.
+
 ## [0.9.0] — file deletions (destructive actions)
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer"
-version = "0.9.0"
+version = "0.9.1"
 edition = "2021"
 license = "MIT"
 description = "General-purpose, language-agnostic eBPF observability for AI agents (LLM calls, tools, files, network egress)."

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-collector"
-version = "0.9.0"
+version = "0.9.1"
 edition = "2021"
 license = "MIT"
 description = "a3s-observer collector: loads the eBPF probes and exports enriched events."

a3s-observer-collector/Cargo.toml

@@ -45,7 +45,12 @@ async fn main() -> anyhow::Result<()> {
         }
         _ => {}
     }
-    tracing_subscriber::fmt::init();
+    // Logs go to STDERR so STDOUT stays pure NDJSON (the event stream a pipeline parses), at
+    // INFO by default so the operational logs (throughput, drop counter) are actually visible.
+    tracing_subscriber::fmt()
+        .with_writer(std::io::stderr)
+        .with_max_level(tracing::Level::INFO)
+        .init();
 
     let mut ebpf = Ebpf::load(aya::include_bytes_aligned!(concat!(
         env!("OUT_DIR"),

a3s-observer-collector/src/main.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-common"
-version = "0.9.0"
+version = "0.9.1"
 edition = "2021"
 license = "MIT"
 description = "Shared no_std types crossing the eBPF <-> userspace boundary for a3s-observer."

a3s-observer-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-ebpf"
-version = "0.9.0"
+version = "0.9.1"
 edition = "2021"
 license = "MIT"
 publish = false

a3s-observer-ebpf/Cargo.toml

@@ -25,7 +25,7 @@ spec:
       terminationGracePeriodSeconds: 30 # the collector flushes a final report on SIGTERM
       containers:
         - name: a3s-observer
-          image: 10.12.111.133:49164/a3s/observer:0.9.0 # mirror of ghcr.io/a3s-lab/observer:0.9.0
+          image: 10.12.111.133:49164/a3s/observer:0.9.1 # mirror of ghcr.io/a3s-lab/observer:0.9.1
           securityContext:
             # eBPF load + tracepoint attach requires privileged. (Verified: a non-root
             # process with only CAP_BPF+CAP_PERFMON fails to attach — the tracefs tracepoint

deploy/daemonset.yaml

@@ -28,6 +28,7 @@ receivers:
     include: [/var/log/a3s-observer.ndjson]
     operators:
       - type: json_parser # each line → structured attributes (identity/provider/event)
+        if: 'body matches "^[{]"' # only parse NDJSON; skip any interleaved stderr log lines
         parse_from: body
 
 processors: