The otel.instrumentation.common.db-statement-sanitizer.enabled parameter is not effective for PreparedStatement?

[lvguoqiang]

The otel.instrumentation.common.db-statement-sanitizer.enabled parameter is not effective for PreparedStatement?

[mateuszrzeszutek]

(Moving issue to the instrumentation repo)

Hey @lvguoqiang ,

Queries/statements passed to the PreparedStatement already contain placeholders; you're seeing them exactly as the JDBC API receives them.

[lvguoqiang]

Is there a way to show PreparedStatement as the original value, I tested by setting OTEL_INSTRUMENTATION_COMMON_DB_STATEMENT_SANITIZER_ENABLED false did not take effect

[mateuszrzeszutek]

If otel.instrumentation.common.db-statement-sanitizer.enabled is set to false then what you're seeing is the original value; when the sanitization is disabled the javaagent does not do anything with the DB statements, they're exported in the same form the JDBC API sees them.

[trask]

@lvguoqiang I think you are asking for a new feature to (optionally) capture the jdbc bind parameters?

[ryanrupp]

It would be nice to have an opt-in mode that "unbinds" the bind variables, maybe just for some subset of queries (slow), or writes etc. This can be done by having instrumentation intercept the PreparedStatement set arguments then lazily (if conditional) build into the literal SQL. I've written about this in the past for Elastic APM agent here and in the OpenTelemetry slack here. I believe New Relic (unclear if this is just literals or binds as well, user here seems to say it's binds) and AppDynamics have similar features although I haven't used them specifically. Understandably this has performance/security/privacy concerns though so would be opt-in with caution.

[trask]

can someone open a new issue to request this feature? surprisingly I don't think we have an issue for it yet

[ryanrupp]

@trask I logged #7413

[trask]

@lvguoqiang let us know if this can be closed in favor of #7413? thx!

[Neptunium1129]

Why isn't there a basic binding method? Does no one use it anymore?