Will logging RPC ever be pushed to Qubes stable?

shantyspruce · December 27, 2025, 2:00am

This has been in Github for a while, but never pushed into stable repos (or even testing IIRC), and I’d just like to know what’s preventing that, for personal gratification at worst and being able to help at best:

github.com/QubesOS/qubes-core-agent-linux

qubes-rpc/qubes.Syslog

009e973b1

#!/usr/bin/env python3
# vim: fileencoding=utf-8
#
# The Qubes OS Project, https://www.qubes-os.org/
#
# Copyright (C) 2021
#                   David Hobach <tripleh@hackingthe.net>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,

This file has been truncated. show original

rustybird · December 27, 2025, 2:19am

The commit you’ve linked was never merged into the official QubesOS/qubes-core-agent-linux Git repo, even though the URL might give this impression (which is a GitHub quirk). Note the yellow warning saying “This commit […] may belong to a fork outside of the repository.”

I’m not sure. There’s some discussion in the closed pull request corresponding to the commit, and in the issue:

github.com/QubesOS/qubes-issues

logvm(s)

opened 05:08PM - 08 Mar 15 UTC

marmarek

help wanted C: other P: major release notes

**Reported by joanna on 25 Apr 2014 16:41 UTC** A VM to collect logs from other …VMs via qrexec service. Allow tools to easy copy logs to other VMs, as well as do log processing (logs are untrusted, but the logvm should be considered not-sensitive). Potentially allow more than one logvm for paranoid configurations, cofigurable via qrexec policy. Migrated-From: https://wiki.qubes-os.org/ticket/830

shantyspruce · December 27, 2025, 2:26am

Didn’t read that part fully, I just thought it was talking about the origin. Weird that code not belonging to Qubes is in their repo, regardless of anything. Thanks for clarifying.

I just want logvms. Even if it’s not full-featured, I’d prefer at least the option to install, even on a testing repo so no one can complain it’s not complete. I salt all my templates, and I’m not about to insert manual parts that can (will) be forgotten or easily borked.

But the other thing is that logs are the stepping stone for a lot of post-event handling, like SIEMs or forensics, and appVMs don’t (and shouldn’t) store logs.

shantyspruce · December 27, 2025, 4:26am

It kind of looks like @marmarek just never responded, and @tripleh closed the PR after a few months. The issue is P:Major, so obviously they want the feature. Maybe it was forgotten, or something happened in private?

qubist · December 27, 2025, 7:52am

@shantyspruce

You could probably ask on the qubes-devel mailing list.

tripleh · December 27, 2025, 8:40am

Back then I had the suspicion that there’s some conflict of interest for the Qubes Devs as they probably provide that feature to enterprise/state customers via ITL.
I had no evidence, but I’m in the IT security business for >10 years and know how it goes: All such customers will ask for that feature, but few consumers will.

Anyway the lack of interest caused me to close the MR.
I also didn’t want users to incorrectly believe that it’s still maintained by me. In fact I currently don’t even use it.