From 2b70596636d4eb40634387e3e351a74d745f1af3 Mon Sep 17 00:00:00 2001
From: Thomas Eizinger <thomas@eizinger.io>
Date: Tue, 15 Jul 2025 06:44:53 -0700
Subject: [PATCH] fix(rust): only apply filter to select tracing layers (#9872)

Applying a filter globally to the entire subscriber means it filters
events for all layers. This prevents the Sentry layer from uploading
DEBUG logs if configured.
---
 rust/apple-client-ffi/src/lib.rs | 11 +++++++----
 rust/client-ffi/src/lib.rs       | 13 ++++++++-----
 rust/relay/server/src/main.rs    |  6 ++----
 3 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/rust/apple-client-ffi/src/lib.rs b/rust/apple-client-ffi/src/lib.rs
index ba7d34fdc..5bb185b49 100644
--- a/rust/apple-client-ffi/src/lib.rs
+++ b/rust/apple-client-ffi/src/lib.rs
@@ -207,12 +207,13 @@ fn init_logging(log_dir: PathBuf, log_filter: String) -> Result<()> {
         return Ok(());
     }
 
-    let (env_filter, reload_handle) = firezone_logging::try_filter(&log_filter)?;
+    let (file_log_filter, file_reload_handle) = firezone_logging::try_filter(&log_filter)?;
+    let (oslog_log_filter, oslog_reload_handle) = firezone_logging::try_filter(&log_filter)?;
 
     let (file_layer, handle) = firezone_logging::file::layer(&log_dir, "connlib");
 
     let subscriber = tracing_subscriber::registry()
-        .with(env_filter)
+        .with(file_layer.with_filter(file_log_filter))
         .with(
             tracing_subscriber::fmt::layer()
                 .with_ansi(false)
@@ -224,11 +225,13 @@ fn init_logging(log_dir: PathBuf, log_filter: String) -> Result<()> {
                 .with_writer(make_writer::MakeWriter::new(
                     "dev.firezone.firezone",
                     "connlib",
-                )),
+                ))
+                .with_filter(oslog_log_filter),
         )
-        .with(file_layer)
         .with(sentry_layer());
 
+    let reload_handle = file_reload_handle.merge(oslog_reload_handle);
+
     firezone_logging::init(subscriber)?;
 
     LOGGER_STATE
diff --git a/rust/client-ffi/src/lib.rs b/rust/client-ffi/src/lib.rs
index 9cbe05d1e..c36708a40 100644
--- a/rust/client-ffi/src/lib.rs
+++ b/rust/client-ffi/src/lib.rs
@@ -17,7 +17,7 @@ use platform::RELEASE;
 use secrecy::{Secret, SecretString};
 use socket_factory::{SocketFactory, TcpSocket, UdpSocket};
 use tokio::sync::Mutex;
-use tracing_subscriber::layer::SubscriberExt as _;
+use tracing_subscriber::{Layer, layer::SubscriberExt as _};
 
 uniffi::setup_scaffolding!();
 
@@ -296,12 +296,12 @@ fn init_logging(log_dir: &Path, log_filter: String) -> Result<()> {
         return Ok(());
     }
 
-    let (log_filter, reload_handle) = firezone_logging::try_filter(&log_filter)?;
+    let (file_log_filter, file_reload_handle) = firezone_logging::try_filter(&log_filter)?;
+    let (platform_log_filter, platform_reload_handle) = firezone_logging::try_filter(&log_filter)?;
     let (file_layer, handle) = firezone_logging::file::layer(log_dir, "connlib");
 
     let subscriber = tracing_subscriber::registry()
-        .with(log_filter)
-        .with(file_layer)
+        .with(file_layer.with_filter(file_log_filter))
         .with(
             tracing_subscriber::fmt::layer()
                 .with_ansi(false)
@@ -310,10 +310,13 @@ fn init_logging(log_dir: &Path, log_filter: String) -> Result<()> {
                         .without_timestamp()
                         .without_level(),
                 )
-                .with_writer(platform::MakeWriter::default()),
+                .with_writer(platform::MakeWriter::default())
+                .with_filter(platform_log_filter),
         )
         .with(sentry_layer());
 
+    let reload_handle = file_reload_handle.merge(platform_reload_handle);
+
     firezone_logging::init(subscriber)?;
 
     LOGGER_STATE
diff --git a/rust/relay/server/src/main.rs b/rust/relay/server/src/main.rs
index e3fef4bc0..ecc6479d0 100644
--- a/rust/relay/server/src/main.rs
+++ b/rust/relay/server/src/main.rs
@@ -250,8 +250,7 @@ fn setup_tracing(args: &Args) -> Result<FilterReloadHandle> {
             let (filter, reload_handle) = firezone_logging::try_filter(&directives)?;
 
             let dispatch: Dispatch = tracing_subscriber::registry()
-                .with(log_layer(args))
-                .with(filter)
+                .with(log_layer(args).with_filter(filter))
                 .with(sentry_layer())
                 .into();
 
@@ -296,9 +295,8 @@ fn setup_tracing(args: &Args) -> Result<FilterReloadHandle> {
             let (filter, reload_handle) = firezone_logging::try_filter(&directives)?;
 
             let dispatch: Dispatch = tracing_subscriber::registry()
-                .with(log_layer(args))
+                .with(log_layer(args).with_filter(filter))
                 .with(tracing_opentelemetry::layer().with_tracer(tracer_provider.tracer("relay")))
-                .with(filter)
                 .with(sentry_layer())
                 .into();