Forem: Thomas Nelson

Enforce Runtime Logging Governance in .NET 8 with Cerbi.MEL.Governance

Thomas Nelson — Thu, 05 Jun 2025 04:27:15 +0000

Ever wished you could automatically catch missing PII fields or forbidden values in your .NET 8 logs, without rewriting your entire logging setup? With Cerbi.MEL.Governance, you can now plug governance checks directly into any Microsoft.Extensions.Logging pipeline. It always emits your original log line—and only emits a second JSON payload when a violation occurs.

In this post, we’ll cover:

Why runtime logging governance matters
How to install Cerbi.MEL.Governance
Configuring your governance JSON (cerbi_governance.json)
A quick‐start code example (3 lines to enable)
A live demo with console output
Advanced tips: Relaxed mode, multiple profiles, performance notes

Let’s dive in!

1. Why Runtime Logging Governance Matters

When you log structured messages in production—especially with user data or payment information—you want to make sure:

Required fields (e.g., userId, email) are never missing.
Forbidden fields (e.g., password, creditCardNumber) never appear.
You can enforce these rules at runtime, without having to manually audit logs later.

Most teams adopt Serilog or other libraries for structured logging. But if you’re already using .NET’s built‐in MEL (Microsoft.Extensions.Logging), there wasn’t a turnkey way to enforce governance rules—until now.

With Cerbi.MEL.Governance, you can:

Validate structured fields at runtime against a governance profile.
Always emit the original log line (so downstream parsers/alerts work unchanged).
Emit a secondary JSON payload only if a violation exists (no extra noise when everything is valid).
Support “Relaxed mode” (if you want to temporarily bypass some rules) by passing { Relax } = true.
Plug into any MEL-compatible sink: Console, File, Seq, Application Insights, etc.

2. Installation (NuGet)

Install the latest version via CLI:

# Installs the most recent version of Cerbi.MEL.Governance
dotnet add package Cerbi.MEL.Governance

Note: Cerbi.MEL.Governance targets .NET 8.0 or higher.

3. Governance Configuration (`cerbi_governance.json`)

Create a file named cerbi_governance.json in your project root (or anywhere you like, just point ConfigPath to it). Here’s a sample:

{
  "EnforcementMode": "Strict",
  "LoggingProfiles": {
    "Orders": {
      "FieldSeverities": {
        "userId": "Required",
        "email": "Required",
        "password": "Forbidden"
      },
      "AllowRelax": true,
      "RequireTopic": true,
      "AllowedTopics": ["Orders"]
    },
    "Payments": {
      "FieldSeverities": {
        "accountNumber": "Required",
        "amount": "Required"
      },
      "AllowRelax": false,
      "RequireTopic": true,
      "AllowedTopics": ["Payments"]
    }
  }
}

EnforcementMode
- "Strict": Any missing required field or forbidden field triggers a violation.
LoggingProfiles
- Each top‐level key (e.g., "Orders", "Payments") is a profile name or topic.
- FieldSeverities: map each field name to "Required" or "Forbidden".
- AllowRelax (boolean): if true, passing { Relax } = true in your log call will suppress violations and mark "GovernanceRelaxed": true.
- RequireTopic: if true, logs without a matching [CerbiTopic] attribute or fallback Profile key will be skipped/flagged.
- AllowedTopics: list of topics allowed for this profile (helps prevent cross‐pollination).

4. Quick‐Start Code Example (3 Lines!)

In most .NET 8 console or worker‐service apps, you have something like:

using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using Cerbi; // Cerbi.MEL.Governance’s namespace

var builder = Host.CreateDefaultBuilder(args)
    .ConfigureLogging(logging =>
    {
        logging.ClearProviders();
        logging.AddSimpleConsole(options =>
        {
            options.IncludeScopes = true;
            options.SingleLine = true;
            options.TimestampFormat = "HH:mm:ss ";
        });

        // ← 3 lines to enable governance:
        logging.AddCerbiGovernance(options =>
        {
            options.Profile    = "Orders";                   // fallback topic if no [CerbiTopic] found
            options.ConfigPath = "cerbi_governance.json";    // path to your JSON profile
            options.Enabled    = true;                         // toggle enforcement on/off
        });
    })
    .ConfigureServices(services =>
    {
        services.AddTransient<OrderService>();
        services.AddTransient<PaymentService>();
    })
    .Build();

using Cerbi; is mandatory because the AddCerbiGovernance(...) extension lives there.
You can replace logging.AddSimpleConsole(...) with any other MEL sink (e.g., logging.AddConsole(), logging.AddApplicationInsights(), etc.).
options.Profile is the default fallback topic if no [CerbiTopic("…")] is found on the call stack. You can still override via [CerbiTopic] on a class or method.

5. Live Demo & Output

`OrderService.cs` (example)

using Cerbi;  // for [CerbiTopic]
using Microsoft.Extensions.Logging;

[CerbiTopic("Orders")]
public class OrderService
{
    private readonly ILogger<OrderService> _logger;

    public OrderService(ILogger<OrderService> logger)
    {
        _logger = logger;
    }

    public void ProcessOrder(string userId, string email)
    {
        // Example 1: Valid log (both userId and email provided)
        _logger.LogInformation("Valid order: {userId} {email}", userId, email);

        // Example 2: Missing userId → violation
        _logger.LogInformation("Missing userId, only email: {email}", email);

        // Example 3: Forbidden field (password) → violation
        _logger.LogInformation(
            "Leaking password: {userId} {email} {password}",
            userId, email, "supersecret"
        );

        // Example 4: Relaxed mode (AllowRelax = true in JSON; pass {Relax} = true)
        _logger.LogInformation(
            "Email-only (relaxed): {email} {Relax}",
            email, true
        );
    }
}

Assuming you call:

var service = host.Services.GetRequiredService<OrderService>();
service.ProcessOrder("abc123", "user@example.com");

You’ll see console output like this:

[12:34:56 INF] Valid order: abc123 user@example.com
[12:34:56 INF] {"userId":"abc123","email":"user@example.com","CerbiTopic":"Orders","GovernanceProfileUsed":"Orders","GovernanceEnforced":true,"GovernanceMode":"Strict"}

[12:34:56 INF] Missing userId, only email: user@example.com
[12:34:56 INF] {"email":"user@example.com","CerbiTopic":"Orders","GovernanceViolations":["MissingField:userId"],"GovernanceRelaxed":false,"GovernanceProfileUsed":"Orders"}

[12:34:56 INF] Leaking password: abc123 user@example.com supersecret
[12:34:56 INF] {"userId":"abc123","email":"user@example.com","password":"supersecret","CerbiTopic":"Orders","GovernanceViolations":["ForbiddenField:password"],"GovernanceRelaxed":false,"GovernanceProfileUsed":"Orders"}

[12:34:56 INF] Email-only (relaxed): user@example.com True
[12:34:56 INF] {"email":"user@example.com","CerbiTopic":"Orders","GovernanceRelaxed":true,"GovernanceProfileUsed":"Orders"}

First log: both fields present → governance enforced in “Strict” mode (JSON payload shows "GovernanceEnforced": true).
Second log: missing userId → JSON payload includes "GovernanceViolations": ["MissingField:userId"].
Third log: forbidden password → JSON payload includes "ForbiddenField:password".
Fourth log: relaxed (because { Relax } = true and AllowRelax:true in JSON) → JSON payload shows "GovernanceRelaxed": true.

Notice that your original log line always appears first, unchanged. Only when a rule is violated (or relaxed) do you see that second JSON‐only line. Downstream log processors (Seq, Kibana, Splunk) still parse your structured fields from the first line as usual.

6. Advanced Tips & Best Practices

Multiple Profiles / Topics

If your solution has multiple domains (e.g., “Orders,” “Payments,” “Users”), define each profile in the JSON.
Use [CerbiTopic("Payments")] on your PaymentService class. If no attribute is found, options.Profile kicks in as a fallback.

Turning Enforcement On/Off

Set options.Enabled = false (or toggle via an environment variable) for development or quick debugging.
You can programmatically reload the JSON file if it changes at runtime by restarting your host. A future version may support hot‐reloading.

Relaxed Mode

In JSON: "AllowRelax": true
In code: _logger.LogInformation("… {Relax}", true)
Violations are suppressed; JSON payload simply shows "GovernanceRelaxed": true, "GovernanceProfileUsed": "Orders".

EA / Compliance-Driven Use Cases

If you’re a Lead Enterprise Architect responsible for compliance, embed your EA roadmap decisions into your governance JSON.
Use field‐severity rules to detect days when migrations aren’t passing compliance checks (e.g., new microservices missing required context fields).

Performance Considerations

On a warm VM startup, the JSON validator is built once in memory. Per‐log overhead is minimal (milliseconds) unless you have hundreds of structured fields.
Benchmarks show < 1 ms overhead on typical log calls when no violations occur. Always measure under your app’s load profile if you have extremely high‐frequency logging.

7. Next Steps & Roadmap

Relax() Helper Extension
Coming soon: a fluent logger.Relax() API so you don’t have to manually pass { Relax } = true each time.
Support for Additional EA Tools
Future releases will integrate directly with LeanIX, Alfabet, and MEGA’s REST APIs to sync governance profiles automatically.
Custom Violation Formatting
Want more context in the JSON payload? We plan to add hooks so you can control the violation‐code format (e.g., prepend environment name or correlation‐ID).
Community Contributions
We welcome issues and pull requests! If you have a scenario we haven’t covered (e.g., Azure Functions scope issues), please open an issue or PR on GitHub.

8. Links & Resources

🔗 Demo & Examples (GitHub): Zeroshi/Cerbi.MEL.Governance.Demo: Demonstrating Cerbi MEL governance implementation
📦 NuGet Package: dotnet add package Cerbi.MEL.Governance

TL;DR

Cerbi.MEL.Governance gives you runtime enforcement of required/forbidden fields in any MEL pipeline. Install one NuGet package, configure a simple JSON file, and enforce PII/compliance rules automatically. Visit the repo for a full demo; join the conversation via issues or PRs if you need help or want to contribute!

Happy logging!

CerbiStream: Real-Time Governance-Enforced Logging for .NET

Thomas Nelson — Tue, 20 May 2025 01:56:45 +0000

What if your logs could validate themselves while running — tagging violations without dropping a single event?
CerbiStream brings governance to your logs, adds structure, encrypts them, and routes them securely. All in real-time.

Enterprise-grade logging with structure, encryption, fallback, and real-time governance — built for cloud-native .NET developers.

🧠 Why CerbiStream Exists

As developers, we've all experienced logging mistakes:

Accidentally logging sensitive data like passwords or emails
Forgetting to include userId, requestId, or environment
Debugging issues with logs that have no structure, context, or traceability

CerbiStream is designed to help development teams avoid these problems — by baking in runtime validation, fallback safety, and contextual metadata into every log line.

It doesn't just log your data. It governs it.

✨ What Is CerbiStream?

CerbiStream is a modular logging framework for .NET that helps developers:

✅ Enforce runtime log structure via governance profiles
🔐 Secure logs with AES/Base64 encryption
🚦 Auto-tag logs with metadata and trace info
📂 Fallback to encrypted local files if queues fail
📡 Send to queues, cloud storage, or telemetry in parallel

🚀 Quick Setup

dotnet add package CerbiStream

builder.Logging.AddCerbiStream(options =>
{
    options.WithQueue("RabbitMQ", "localhost", "logs")
           .WithFileFallback("logs/fallback.json")
           .WithEncryptionMode(EncryptionType.AES)
           .WithEncryptionKey(myKey, myIv)
           .WithGovernanceChecks(true)
           .EnableProductionMode();
});

🔐 Real-Time Governance Enforcement

The real-time governance feature rolled out recently with Cerbi.Governance.Runtime — and it's just the beginning. We’ve built it into CerbiStream to validate logs as they happen, without slowing development workflows or requiring devs to memorize rules.

We're actively extending this to other ecosystems:

🔜 Cerbi.Serilog.GovernanceAnalyzer
🔜 Cerbi.NLog.GovernanceAnalyzer
🔜 Cerbi.Log4Net.GovernanceAnalyzer

This will bring consistent, policy-driven enforcement across the most popular logging stacks in .NET.

CerbiStream now supports real-time governance enforcement via Cerbi.Governance.Runtime, ensuring that logs are validated against governance profiles at runtime. This removes dependency on build-time analyzers and works seamlessly across environments and dynamic deployment scenarios.

How it works:

Profiles define expected fields, severity, and topics.
When a log is written, it is evaluated against the profile before being routed.
If the log is non-compliant, governance metadata is injected (e.g., GovernanceViolations, GovernanceProfileUsed, etc.).
If Relax() is applied, governance is bypassed intentionally but still tagged with "GovernanceRelaxed": true for audit and scoring.

✅ This approach ensures logs aren't dropped — they are tagged, not blocked, making it easy to score or flag them downstream without causing operational noise or alert spam.

➡️ Future versions will integrate this tagging into CerbiSense for governance scoring and trend analysis across teams and services.

CerbiStream uses JSON-based profiles and applies them at runtime, so developers aren’t locked into compile-time analyzers.

{
  "EnforcementMode": "Strict",
  "LoggingProfiles": {
    "Orders": {
      "RequireTopic": true,
      "AllowedTopics": ["Orders"],
      "FieldSeverities": {
        "userId": "Required",
        "email": "Required",
        "password": "Forbidden"
      },
      "AllowRelax": true
    }
  }
}

Tag your class with:

[CerbiTopic("Orders")]
public class OrderService { }

🛄 Example Logs

✅ Compliant Log

logger.LogInformation("Order started", new { userId = "u123", email = "demo@site.com" });

{
  "Message": "Order started",
  "userId": "u123",
  "email": "demo@site.com",
  "GovernanceProfileUsed": "Orders",
  "TimestampUtc": "2025-05-19T10:42:01Z"
}

❌ Violation (Missing Required Fields)

logger.LogWarning("Something went wrong");

{
  "Message": "Something went wrong",
  "GovernanceViolations": ["Missing: userId", "Missing: email"],
  "GovernanceMode": "Strict"
}

🛑 Relaxed Log (Explicit Bypass)

logger.Relax().LogError("Emergency override triggered");

{
  "Message": "Emergency override triggered",
  "GovernanceRelaxed": true,
  "LogLevel": "Error"
}

📂 File Fallback Example

options.WithEncryptedFallback("fallback.json", "primary.json", key, iv);

Logs are written securely:

[ENCRYPTED] <AES Payload> [/ENCRYPTED]

☁️ Supported Targets

📨 Queues: RabbitMQ, Azure Service Bus, Kafka, AWS SQS, GCP Pub/Sub
🧠 Telemetry: App Insights, OpenTelemetry, Datadog, CloudWatch
📂 Storage: Azure Blob, AWS S3, Google Cloud Storage

🧪 Preset Modes for Easy Setup

options.EnableDevModeMinimal();             // Console only
options.EnableDeveloperModeWithTelemetry(); // Local testing
options.EnableProductionMode();             // Full governance
options.EnableBenchmarkMode();              // Silent for perf tests

📊 Benchmarked vs. Serilog

Feature	CerbiStream ✅	Serilog ❌
Real-Time Governance	✅ Yes	❌ No
Full Payload Encryption	✅ Built-in AES	❌ Requires plugins
Fallback Logging	✅ Encrypted	🔸 Limited
Telemetry + Queues	✅ Dual support	🔸 Separate sinks

View benchmarks

🧾 Summary

In this article, we covered:

Why log governance is a human problem
What CerbiStream does differently
How runtime enforcement tags non-compliant logs
What compliant, violating, and relaxed log output looks like
How fallback, telemetry, and encryption features help build safer systems
The roadmap for supporting other loggers

CerbiStream was created to help developers log confidently and securely — without losing productivity. Try it out, enforce your standards, and eliminate log regret.

🔗 Try It Out

📦 NuGet Packages

CerbiStream is open source and evolving fast. Let us know your use case or suggest a feature!
Happy logging 🙌

Benchmarking Logging Frameworks: How CerbiStream Measures Up

Thomas Nelson — Wed, 23 Apr 2025 21:43:25 +0000

Logging shouldn’t be an afterthought. It should be fast, structured, and governed—without slowing your app down.

Meet CerbiStream, a developer-first logging library built with governance and performance at its core. But how does it actually perform compared to industry staples like Serilog, NLog, and Log4Net?

That’s what CerbiStream.BenchmarkTests was created to answer.

🔬 What’s Inside?

This open-source benchmark suite uses BenchmarkDotNet to give you real, comparable results across popular logging frameworks.

It includes:

🔁 Throughput tests — logging 10k+ entries per run
💾 Memory benchmarks — allocations, GC behavior, per-log overhead
🧱 Payload scenarios — from flat logs to nested structured objects
✅ Governance enforcement — CerbiStream uniquely validates required & forbidden fields

All test outputs are saved under the charts/ folder and are easy to extend. Want to add your own logger? Just plug it in.

📈 Sample Benchmark: Logs/sec

Logger	Logs/sec (Structured)	Memory/Log	Governance?
CerbiStream	🟢 82,000+	~128 B	✅ Full support
NLog	🔵 84,000	~120 B	❌
Serilog	🟡 80,000	~146 B	⚠️ Plugin only
Log4Net	🟠 60,000	~160 B	❌

✅ CerbiStream is the only logger with compile-time analyzers and runtime validation for governance rules.

More detailed charts → View Benchmarks

⚡ What Makes CerbiStream Different?

builder.Logging.AddCerbiStream(options =>
{
    options.UseGovernanceFromJson("Configs/governance.json");
});

CerbiStream – Bringing Governance to the Wild West of Logging

Thomas Nelson — Thu, 10 Apr 2025 16:42:00 +0000

Hi everyone,

I’m excited to share deeper insights into CerbiStream — a free logging framework built for .NET that’s designed to solve persistent challenges faced by growing companies, decoupled teams, contracting organizations, and industries under strict regulations like HIPAA and GDPR. While CerbiStream is currently optimized for .NET, plans are already underway to extend support to other popular frameworks.

Why Governance in Logging Matters

Logging today is often the wild west of modern systems. Many organizations suffer from:

Inconsistent Logging

Developers working across multiple services use varied logging approaches, leading to confusing and unstructured log outputs.
Unpredictable Data

Without enforced structure, you never know what data will be captured—making troubleshooting and traceability challenging.
Compliance and Security Challenges

For industries dealing with sensitive data, inconsistent logging can lead to major compliance issues and security risks.

Having held roles across several companies and industries, I saw how these issues resulted in operational headaches and wasted time. That's why I built CerbiStream — to enforce governance in logging from the ground up.

What Makes CerbiStream Different

CerbiStream isn’t just another logging library. It is engineered with a governance-first mindset while ensuring integration with modern observability tools.

Decoupled Logging Pipeline

CerbiStream sends logs through queues — supporting RabbitMQ, Kafka, Azure Service Bus, AWS SQS, and GCP Pub/Sub — offloading processing to downstream systems like Application Insights and others. This ensures minimal latency and maximum durability.

Governance-First Approach

With built-in compile-time analyzers and runtime validators, every log entry must include the required metadata (e.g., UserId, IPAddress). This simplifies troubleshooting and helps meet strict audit and compliance standards.

Performance Optimized

Using BenchmarkDotNet, local benchmarks were run comparing CerbiStream to Serilog, NLog, and Log4Net. CerbiStream consistently matched or exceeded their performance — while offering governance and queue-first routing as a bonus.

Flexible and Developer-Friendly

In development mode, rapid iteration is effortless. Production mode supports telemetry and governance seamlessly. CerbiStream’s intuitive API enables quick integration, even for decentralized or remote teams.

Built for .NET — and Beyond

CerbiStream is currently focused on .NET, but we’re actively working to support other frameworks like Node.js, Python, and Java, making cross-platform structured logging with governance a reality.

The Need for a Unified, Governed Logging Approach

For growing companies — especially those with distributed teams or contractors — consistent logging is critical. CerbiStream guarantees that every log entry follows strict governance rules, helping:

Reduce production troubleshooting time
Strengthen security and compliance postures
Enable consistent audit trails
Standardize developer logging practices across teams

Let’s Drive the Conversation Forward

I’d love to hear your feedback on:

API Clarity — Is the CerbiStream API intuitive enough for your team?
Compliance & Governance — Would enforced log structure simplify your audit/security processes?
Feature Enhancements — What would make CerbiStream even more powerful for your use case?
Enterprise Integration — Would a governance dashboard like CerbiShield (coming soon!) revolutionize how you handle log auditing?

Try It Free

CerbiStream is completely free on NuGet.

You can check out the full source code on GitHub: CerbiStream GitHub Repo

Additionally, to add governance add: CerbiStream.GovernanceAnalyzer

Feel free to drop your comments or questions below. Whether you're working on a tightly regulated enterprise app or just want clean, consistent logs across services — your feedback will help shape the future of CerbiStream.

Let’s redefine logging together.

CerbiStream: .NET Logging with Governance Enforcement, Queue Routing, and Developer-First Config

Thomas Nelson — Wed, 09 Apr 2025 04:11:11 +0000

Hey,

I'm new to the site. I created this account because I wanted to gather some feedback on a product I've been building.

Over the past few months, I’ve been working on a .NET logging framework that solves a handful of pain points I’ve consistently run into on large-scale enterprise systems:

Logging that's too open-ended or poorly structured
Inconsistent developer output across microservices
Centralized routing to multiple observability tools
Difficulty enforcing governance or auditing policies

So I built CerbiStream — a governance-first, developer-friendly logging solution for .NET 8 and beyond.

What Is CerbiStream?

CerbiStream is a structured logging library built to help teams enforce log structure, send logs through queues, and stay secure and consistent.

🔹 CerbiStream on NuGet

🔹 Governance Analyzer Add-on

🔹 GitHub Repo (MIT)

🔹 CerbiSuite Website

Key Features

✅ Out-of-the-box support for ILogger<T>

✅ Works with RabbitMQ, Kafka, Azure Service Bus, AWS SQS, GCP Pub/Sub

✅ Optional encryption (Base64, AES with custom keys or Azure Key Vault)

✅ Governance Analyzer for compile-time structured logging enforcement

✅ External validator support for EF Core/Blazor-safe validation

✅ Presets for development, benchmarking, and telemetry-enabled modes

Quick Example

builder.Logging.AddCerbiStream(options =>
{
    options.WithQueue("AzureServiceBus", "sb://...", "audit-logs")
           .WithEncryptionMode(EncryptionType.Base64)
           .EnableDeveloperModeWithTelemetry();
});

✅ To enable governance without using the Roslyn analyzer:

options.WithGovernanceValidator((profile, log) =>
{
    return log.ContainsKey("UserId") && log.ContainsKey("IPAddress");
});

Why Cerbi?
CerbiStream is part of a bigger ecosystem I'm working on:

CerbiStream – Dev-first logging SDK
CerbiStream.GovernanceAnalyzer – Optional Roslyn analyzer
CerbIQ – Routing & observability pipeline (pulls from queue, sends to sinks like Splunk, Elastic, etc.)
CerbiShield – (Coming soon!) Governance rule dashboard with RBAC & audit logging

📈 Adoption & Status
📦 Over 2,000+ downloads on NuGet

Used by Checkmarx, Artifactory, CI systems, and private mirrors

Benchmarked Against Other Loggers

CerbiStream was built with performance in mind. It’s benchmarked alongside:

🪵 Serilog
🧱 NLog
🔩 Log4Net

Benchmarks show CerbiStream achieving competitive performance while offering additional features like:

Governance rule enforcement (optional Roslyn or runtime validator)
Queue-first routing (Kafka, RabbitMQ, Azure, AWS, GCP)
Minimal dev-mode presets for fast local iteration

We’re actively working on a public benchmark suite that compares:

Feature	Serilog	NLog	Log4Net	CerbiStream
Structured logging	✅	✅	❌	✅
Governance enforcement	❌	❌	❌	✅
Queue-first routing	❌	❌	❌	✅
Roslyn analyzer for log rules	❌	❌	❌	✅ (optional)
Encryption support	❌	❌	❌	✅ (AES/Base64)
Minimal dev mode toggle	❌	❌	❌	✅

Let me know what else you'd like to see compared in future benchmarks!

In development: Azure Marketplace onboarding & enterprise governance dashboard

🙏 I Need Your Feedback!
I'd love your thoughts on:

API clarity — is it intuitive enough?

Would you use this for audit or security logs?

What features would make this more useful to you?

Would a CerbiShield dashboard help your team?

Thanks for checking it out — and if you install it or give it a test, I’d really appreciate your feedback!