Diagnostics SDK
What data is collected
A field-by-field inventory of what the SDK sends, what is masked, and what is never collected.
What data is collected
An inventory of everything the SDK can send, with its default state. "Masked" means the value passes the always-on secret-redaction pipeline before it is written to the local spool or the network.
Always collected (when enabled)
| Field | Source | Masked |
|---|---|---|
| App name, version, build id, git commit, environment | env vars, assembly metadata | no |
| Exception type and stack trace | the exception | no |
| Exception message, including the inner chain | the exception | yes |
| Fingerprint (a hash, no payload data) | computed | no |
| OS type and description, host name | runtime | no |
| Process id, executable name, runtime version, uptime, bitness | runtime | no |
| Memory working set and heap statistics | runtime | no |
| Container id, Kubernetes pod and namespace | cgroup and env, when present | no |
| Trace and span id | Activity.Current (W3C), .NET | no |
| Breadcrumbs (recent log events, Information/info and above) | ILogger in .NET; pino/winston in Node.js | yes |
| HTTP URL and query, method, status, User-Agent | ASP.NET Core middleware or Express middleware | yes (URL and query) |
| SDK name and version | the SDK | no |
Opt-in only
| Field | Enabled by | Masked |
|---|---|---|
| Request body (size-capped, truncated flag) | TICKETMAN_DIAG_CAPTURE_REQUEST_BODY=true | yes |
| User id, username, tenant, roles | TICKETMAN_DIAG_CAPTURE_USER=true | no |
| Minidump (thread stacks and module list, no full heap) | TICKETMAN_DIAG_ENABLE_DUMPS=true | no; raw memory cannot be masked, so enable only where acceptable |
Never collected
- Full heap dumps. A heap contains unmaskable secrets, so this is deliberately unsupported.
- Response bodies.
- Request headers other than User-Agent.
AuthorizationandCookieare never captured, not even masked. - Anything at all when
TICKETMAN_DIAG_ENDPOINTis not configured. The SDK is then fully inert.
Masking rules
Masking is applied to every masked field: known secret key names in JSON pairs,
form and query key=value pairs, connection strings (password, secret,
token, apikey, authorization, cookie, accesskey, credential and more,
extendable via TICKETMAN_DIAG_MASK_EXTRA_KEYS), plus JWT-shaped tokens anywhere
in the text. If masking cannot complete on pathological input, the whole value is
replaced. Masking cannot be turned off.
Retention on the client
Reports wait in the local spool directory until delivered, capped by
TICKETMAN_DIAG_SPOOL_MAX_MB with the oldest evicted first. Delivered and rejected
reports are deleted immediately after the server responds.