Merge pull request #367 from cipherstash/slow-db-config

feat: add configurable logging thresholds for slow db response logging

Author: calvinbrewer

.gitignore

@@ -26,4 +26,6 @@ tests/benchmark/results/*.csv
 tests/benchmark/benchmark-*.png
 
 ## Local helm chart testing
-testing-chart.yaml
+testing-chart.yaml
+
+.env.proxy.dev

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to CipherStash Proxy will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [2.1.22] - 2026-02-05
+
+### Added
+
+- **Configurable slow database response threshold**: The "Slow database response" log threshold is now configurable via `CS_LOG__SLOW_DB_RESPONSE_MIN_DURATION_MS` (default: 100ms). This controls per-message logging for individual slow reads from the PostgreSQL server.
+
 ## [2.1.21] - 2026-02-04
 
 ### Changed

Cargo.lock

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["packages/*"]
 
 [workspace.package]
-version = "2.1.21"
+version = "2.1.22"
 edition = "2021"
 
 [profile.dev]

Cargo.toml

@@ -28,6 +28,10 @@ pub struct LogConfig {
     #[serde(default = "LogConfig::default_slow_statement_min_duration_ms")]
     pub slow_statement_min_duration_ms: u64,
 
+    /// Threshold in milliseconds for slow database response logging (default: 100ms)
+    #[serde(default = "LogConfig::default_slow_db_response_min_duration_ms")]
+    pub slow_db_response_min_duration_ms: u64,
+
     // All log target levels - automatically generated and flattened from LogTargetLevels
     // To add a new target: just add it to the define_log_targets! macro in log/targets.rs
     #[serde(flatten)]
@@ -100,6 +104,7 @@ impl LogConfig {
             level,
             slow_statements: false,
             slow_statement_min_duration_ms: Self::default_slow_statement_min_duration_ms(),
+            slow_db_response_min_duration_ms: Self::default_slow_db_response_min_duration_ms(),
             // All target levels automatically set using generated LogTargetLevels
             targets: LogTargetLevels::with_level(level),
         }
@@ -133,6 +138,16 @@ impl LogConfig {
     pub const fn default_slow_statement_min_duration_ms() -> u64 {
         2000
     }
+
+    /// Default threshold for slow database response logging (100 milliseconds).
+    ///
+    /// This value represents the threshold for logging individual slow messages from
+    /// the PostgreSQL server. Unlike slow statement logging which tracks total query
+    /// time, this tracks per-message read latency from the server connection.
+    /// Operators can adjust via CS_LOG__SLOW_DB_RESPONSE_MIN_DURATION_MS.
+    pub const fn default_slow_db_response_min_duration_ms() -> u64 {
+        100
+    }
 }
 
 #[cfg(test)]

packages/cipherstash-proxy/src/config/log.rs

@@ -311,6 +311,11 @@ impl TandemConfig {
     pub fn slow_statement_min_duration(&self) -> std::time::Duration {
         std::time::Duration::from_millis(self.log.slow_statement_min_duration_ms)
     }
+
+    /// Returns the slow database response minimum duration as a Duration
+    pub fn slow_db_response_min_duration(&self) -> std::time::Duration {
+        std::time::Duration::from_millis(self.log.slow_db_response_min_duration_ms)
+    }
     #[cfg(test)]
     pub fn for_testing() -> Self {
         Self {

packages/cipherstash-proxy/src/config/tandem.rs

@@ -114,6 +114,7 @@ mod tests {
             level: LogLevel::Info,
             slow_statements: false,
             slow_statement_min_duration_ms: LogConfig::default_slow_statement_min_duration_ms(),
+            slow_db_response_min_duration_ms: LogConfig::default_slow_db_response_min_duration_ms(),
             targets: LogTargetLevels {
                 development_level: LogLevel::Info,
                 authentication_level: LogLevel::Debug,

packages/cipherstash-proxy/src/log/mod.rs

@@ -162,8 +162,8 @@ where
         let sent: u64 = bytes.len() as u64;
         counter!(SERVER_BYTES_RECEIVED_TOTAL).increment(sent);
 
-        // Log slow database responses (>100ms is concerning)
-        if read_duration.as_millis() > 100 {
+        // Log slow database responses (configurable threshold, default 100ms)
+        if read_duration > self.context.slow_db_response_min_duration() {
             warn!(
                 client_id = self.context.client_id,
                 msg = "Slow database response",

packages/cipherstash-proxy/src/postgresql/backend.rs

@@ -816,6 +816,10 @@ where
         self.config.mapping_errors_enabled()
     }
 
+    pub fn slow_db_response_min_duration(&self) -> std::time::Duration {
+        self.config.slow_db_response_min_duration()
+    }
+
     pub fn prometheus_enabled(&self) -> bool {
         self.config.prometheus_enabled()
     }