What causes "failed to marshal audit logs" in SigNoz/signoz?

Check auditor provider config and initialization (marshaler must be set by the factory)

ErrCodeAuditExportFailed

ErrCodeAuditExportFailed

Error message

failed to marshal audit logs

What it means

The OTLP-HTTP auditor failed to marshal audit events into OTLP logs via the configured marshaler before sending; wrapped with ErrCodeAuditExportFailed and classified as internal.

Source

Thrown at ee/auditor/otlphttpauditor/export.go:29

	"github.com/SigNoz/signoz/pkg/errors"
	"github.com/SigNoz/signoz/pkg/types/audittypes"
	collogspb "go.opentelemetry.io/proto/otlp/collector/logs/v1"
	"google.golang.org/protobuf/proto"

	spb "google.golang.org/genproto/googleapis/rpc/status"
)

const (
	maxHTTPResponseReadBytes int64  = 64 * 1024
	protobufContentType      string = "application/x-protobuf"
)

func (provider *provider) export(ctx context.Context, events []audittypes.AuditEvent) error {
	logs := audittypes.NewPLogsFromAuditEvents(events, "signoz", provider.build.Version(), "signoz.audit")

	request, err := provider.marshaler.MarshalLogs(logs)
	if err != nil {
		return errors.Wrapf(err, errors.TypeInternal, auditor.ErrCodeAuditExportFailed, "failed to marshal audit logs")
	}

	if err := provider.send(ctx, request); err != nil {
		provider.settings.Logger().ErrorContext(ctx, "audit export failed", errors.Attr(err), slog.Int("dropped_log_records", len(events)))
		return err
	}

	return nil
}

// Posts a protobuf-encoded OTLP request to the configured endpoint.
// Retries are handled by the underlying heimdall HTTP client.
// Ref: https://github.com/open-telemetry/opentelemetry-collector/blob/main/exporter/otlphttpexporter/otlp.go
func (provider *provider) send(ctx context.Context, body []byte) error {
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, provider.config.OTLPHTTP.Endpoint.String(), bytes.NewReader(body))
	if err != nil {
		return err
	}

View on GitHub (pinned to 5069bf80b0)

Solutions

Check auditor provider config and initialization (marshaler must be set by the factory)
Ensure the signoz-ee binary version matches the configured otel libs (rebuild/redeploy whole image, not partial)
Inspect the AuditEvent payload for unsupported field types; sanitize custom event data
Report upstream with the underlying marshaler error if config is correct

Defensive patterns

Strategy: try-catch

Try / catch

if err := auditor.Export(ctx, events); err != nil {
	if errors.Ast(err, auditor.ErrCodeAuditExportFailed) { slog.Error("audit export failed", errors.Attr(err)); /* buffer/drop per policy, do not crash request path */ }
}

Prevention

Pin consistent signoz-ee image versions across services
Add startup self-test that exports a no-op audit event
Monitor audit export failure counters

When it happens

Trigger: provider.export() on audit events that produce a PLog the marshaler cannot serialize — typically a nil marshaler (misconfigured provider), or event payloads with data the OTLP proto marshaler rejects.

Common situations: Misconfigured otlphttp auditor provider wiring; version mismatch between signoz ee and the otel collector marshaler; corrupted/unexpected fields in AuditEvent structs from a partial upgrade.

Related errors

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/977395cb78837e16. Report an issue: GitHub.