From 5519e6db0163d2d2b7dc7a23b2e4338a3b91faf6 Mon Sep 17 00:00:00 2001
From: Tobias Grieger <tobias.schottdorf@gmail.com>
Date: Wed, 22 Sep 2021 09:34:42 +0000
Subject: [PATCH] log,tracing: make traces redactable

This commit makes traces redactable, meaning that redaction markers are
included in their verbose messages. The traces are not redacted
anywhere, so the only change is the inclusion of redaction markers in
the output.

Release note: None
---
 pkg/kv/bulk/sst_batcher_test.go               |   2 +-
 .../concurrency/concurrency_manager_test.go   |   2 +-
 pkg/server/status.go                          |   2 +-
 pkg/sql/rowexec/tablereader_test.go           |   2 +-
 pkg/util/log/BUILD.bazel                      |   1 +
 pkg/util/log/channels.go                      |   4 +-
 pkg/util/log/event_log.go                     |   4 +-
 pkg/util/log/log_entry.go                     |  45 ++++++
 pkg/util/log/trace.go                         | 111 ++++---------
 pkg/util/tracing/crdbspan.go                  |  18 ++-
 pkg/util/tracing/recording.go                 |   7 +-
 pkg/util/tracing/span.go                      |   4 +-
 pkg/util/tracing/span_inner.go                |  10 +-
 pkg/util/tracing/span_test.go                 |   4 +-
 pkg/util/tracing/test_utils.go                |   4 +-
 pkg/util/tracing/tracingpb/BUILD.bazel        |   5 +-
 pkg/util/tracing/tracingpb/recorded_span.go   |   2 +-
 .../tracing/tracingpb/recorded_span.pb.go     | 146 +++++++++++-------
 .../tracing/tracingpb/recorded_span.proto     |   6 +-
 19 files changed, 221 insertions(+), 158 deletions(-)

diff --git a/pkg/kv/bulk/sst_batcher_test.go b/pkg/kv/bulk/sst_batcher_test.go
index 4a665b3d1e15..f1253af02a13 100644
--- a/pkg/kv/bulk/sst_batcher_test.go
+++ b/pkg/kv/bulk/sst_batcher_test.go
@@ -227,7 +227,7 @@ func runTestImport(t *testing.T, batchSizeValue int64) {
 			for _, rec := range getRec() {
 				for _, l := range rec.Logs {
 					for _, line := range l.Fields {
-						if strings.Contains(line.Value, "SSTable cannot be added spanning range bounds") {
+						if strings.Contains(line.Value.StripMarkers(), "SSTable cannot be added spanning range bounds") {
 							splitRetries++
 						}
 					}
diff --git a/pkg/kv/kvserver/concurrency/concurrency_manager_test.go b/pkg/kv/kvserver/concurrency/concurrency_manager_test.go
index d6b5baf36c7b..e8cf9b07e241 100644
--- a/pkg/kv/kvserver/concurrency/concurrency_manager_test.go
+++ b/pkg/kv/kvserver/concurrency/concurrency_manager_test.go
@@ -1024,7 +1024,7 @@ func (m *monitor) collectRecordings() string {
 						continue
 					}
 					logs = append(logs, logRecord{
-						g: g, value: field.Value,
+						g: g, value: field.Value.StripMarkers(),
 					})
 					g.prevEvents++
 				}
diff --git a/pkg/server/status.go b/pkg/server/status.go
index d24a5ec69a94..6de9f2204468 100644
--- a/pkg/server/status.go
+++ b/pkg/server/status.go
@@ -666,7 +666,7 @@ func recordedSpansToTraceEvents(spans []tracingpb.RecordedSpan) []*serverpb.Trac
 				Time: entry.Time,
 			}
 			if len(entry.Fields) == 1 {
-				event.Message = entry.Fields[0].Value
+				event.Message = entry.Fields[0].Value.StripMarkers()
 			} else {
 				buf.Reset()
 				for i, f := range entry.Fields {
diff --git a/pkg/sql/rowexec/tablereader_test.go b/pkg/sql/rowexec/tablereader_test.go
index 078c59e1b19d..88b75c9f37f3 100644
--- a/pkg/sql/rowexec/tablereader_test.go
+++ b/pkg/sql/rowexec/tablereader_test.go
@@ -454,7 +454,7 @@ func TestLimitScans(t *testing.T) {
 		}
 		for _, l := range span.Logs {
 			for _, f := range l.Fields {
-				match := re.FindStringSubmatch(f.Value)
+				match := re.FindStringSubmatch(f.Value.StripMarkers())
 				if match == nil {
 					continue
 				}
diff --git a/pkg/util/log/BUILD.bazel b/pkg/util/log/BUILD.bazel
index 3bee0bcb82e9..dab7560304c4 100644
--- a/pkg/util/log/BUILD.bazel
+++ b/pkg/util/log/BUILD.bazel
@@ -70,6 +70,7 @@ go_library(
         "@com_github_cockroachdb_errors//oserror",
         "@com_github_cockroachdb_logtags//:logtags",
         "@com_github_cockroachdb_redact//:redact",
+        "@com_github_cockroachdb_redact//interfaces",
         "@com_github_cockroachdb_ttycolor//:ttycolor",
         "@com_github_petermattis_goid//:goid",
         "@org_golang_x_net//trace",
diff --git a/pkg/util/log/channels.go b/pkg/util/log/channels.go
index 4cbe8c1c8f35..37f68e0acfab 100644
--- a/pkg/util/log/channels.go
+++ b/pkg/util/log/channels.go
@@ -53,7 +53,9 @@ func logfDepth(
 		ctx, sev, ch,
 		depth+1, true /* redactable */, format, args...)
 	if sp, el, ok := getSpanOrEventLog(ctx); ok {
-		eventInternal(sp, el, (sev >= severity.ERROR), entry.convertToLegacy())
+		// Prevent `entry` from moving to the heap if this branch isn't taken.
+		heapEntry := entry
+		eventInternal(sp, el, sev >= severity.ERROR, &heapEntry)
 	}
 	logger.outputLogEntry(entry)
 }
diff --git a/pkg/util/log/event_log.go b/pkg/util/log/event_log.go
index 8be4ec123833..25e3e849ad8b 100644
--- a/pkg/util/log/event_log.go
+++ b/pkg/util/log/event_log.go
@@ -39,7 +39,9 @@ func StructuredEvent(ctx context.Context, event eventpb.EventPayload) {
 		event)
 
 	if sp, el, ok := getSpanOrEventLog(ctx); ok {
-		eventInternal(sp, el, (entry.sev >= severity.ERROR), entry.convertToLegacy())
+		// Prevent `entry` from moving to the heap when this branch is not taken.
+		heapEntry := entry
+		eventInternal(sp, el, entry.sev >= severity.ERROR, &heapEntry)
 	}
 
 	logger := logging.getLogger(entry.ch)
diff --git a/pkg/util/log/log_entry.go b/pkg/util/log/log_entry.go
index 2067ee97752a..f07063d4f9ba 100644
--- a/pkg/util/log/log_entry.go
+++ b/pkg/util/log/log_entry.go
@@ -12,6 +12,7 @@ package log
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"strings"
 	"time"
@@ -24,6 +25,7 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/util/timeutil"
 	"github.com/cockroachdb/logtags"
 	"github.com/cockroachdb/redact"
+	"github.com/cockroachdb/redact/interfaces"
 	"github.com/petermattis/goid"
 )
 
@@ -83,6 +85,49 @@ type logEntry struct {
 	payload entryPayload
 }
 
+var _ redact.SafeFormatter = (*logEntry)(nil)
+var _ fmt.Stringer = (*logEntry)(nil)
+
+func (e *logEntry) SafeFormat(w interfaces.SafePrinter, _ rune) {
+	if len(e.file) != 0 {
+		// TODO(knz): The "canonical" way to represent a file/line prefix
+		// is: <file>:<line>: msg
+		// with a colon between the line number and the message.
+		// However, some location filter deep inside SQL doesn't
+		// understand a colon after the line number.
+		w.Printf("%s:%d ", redact.Safe(e.file), redact.Safe(e.line))
+	}
+	if e.tags != nil {
+		w.SafeString("[")
+		for i, tag := range e.tags.Get() {
+			if i > 0 {
+				w.SafeString(",")
+			}
+			// TODO(obs-inf/server): this assumes that log tag keys are safe, but this
+			// is not enforced. We could lint that it is true similar to how we lint
+			// that the format strings for `log.Infof` etc are const strings.
+			k := redact.SafeString(tag.Key())
+			v := tag.Value()
+			if v != nil {
+				w.Printf("%s=%v", k, tag.Value())
+			} else {
+				w.Printf("%s", k)
+			}
+		}
+		w.SafeString("] ")
+	}
+
+	if !e.payload.redactable {
+		w.Print(e.payload.message)
+	} else {
+		w.Print(redact.RedactableString(e.payload.message))
+	}
+}
+
+func (e *logEntry) String() string {
+	return redact.StringWithoutMarkers(e)
+}
+
 type entryPayload struct {
 	// Whether the payload is redactable or not.
 	redactable bool
diff --git a/pkg/util/log/trace.go b/pkg/util/log/trace.go
index 724aa91b5c2b..48f1824a18b0 100644
--- a/pkg/util/log/trace.go
+++ b/pkg/util/log/trace.go
@@ -12,16 +12,13 @@ package log
 
 import (
 	"context"
-	"strconv"
 	"strings"
 
 	"github.com/cockroachdb/cockroach/pkg/util/log/channel"
-	"github.com/cockroachdb/cockroach/pkg/util/log/logpb"
 	"github.com/cockroachdb/cockroach/pkg/util/log/severity"
 	"github.com/cockroachdb/cockroach/pkg/util/syncutil"
 	"github.com/cockroachdb/cockroach/pkg/util/tracing"
 	"github.com/cockroachdb/logtags"
-	"github.com/cockroachdb/redact"
 	"golang.org/x/net/trace"
 )
 
@@ -103,66 +100,33 @@ func getSpanOrEventLog(ctx context.Context) (*tracing.Span, *ctxEventLog, bool)
 	return nil, nil, false
 }
 
-// eventInternal is the common code for logging an event. If no args are given,
-// the format is treated as a pre-formatted string.
-//
-// Note that when called from a logging function, this is taking the log
-// message as input after introduction of redaction markers.  This
-// means the message may or may not contain markers already depending
-// of the configuration of --redactable-logs.
-func eventInternal(sp *tracing.Span, el *ctxEventLog, isErr bool, entry logpb.Entry) {
-	var msg string
-	if len(entry.Tags) == 0 && len(entry.File) == 0 && !entry.Redactable {
-		// Shortcut.
-		msg = entry.Message
-	} else {
-		var buf strings.Builder
-		if len(entry.File) != 0 {
-			buf.WriteString(entry.File)
-			buf.WriteByte(':')
-			// TODO(knz): The "canonical" way to represent a file/line prefix
-			// is: <file>:<line>: msg
-			// with a colon between the line number and the message.
-			// However, some location filter deep inside SQL doesn't
-			// understand a colon after the line number.
-			buf.WriteString(strconv.FormatInt(entry.Line, 10))
-			buf.WriteByte(' ')
-		}
-		if len(entry.Tags) > 0 {
-			buf.WriteByte('[')
-			buf.WriteString(entry.Tags)
-			buf.WriteString("] ")
-		}
-		buf.WriteString(entry.Message)
-		msg = buf.String()
-
-		if entry.Redactable {
-			// This is true when eventInternal is called from logfDepth(),
-			// ie. a regular log call. In this case, the tags and message may contain
-			// redaction markers. We remove them here.
-			msg = redact.RedactableString(msg).StripMarkers()
-		}
+// eventInternal is the common code for logging an event to trace and/or event
+// logs. All entries passed to this method should be redactable.
+func eventInternal(sp *tracing.Span, el *ctxEventLog, isErr bool, entry *logEntry) {
+	if sp != nil {
+		sp.Recordf("%s", entry)
+		// TODO(obs-inf): figure out a way to signal that this is an error. We could
+		// use a different "error" key (provided it shows up in LightStep). Things
+		// like NetTraceIntegrator would need to be modified to understand the
+		// difference. We could also set a special Tag or Baggage on the span. See
+		// #8827 for more discussion.
+		_ = isErr
+		return
 	}
 
-	if sp != nil {
-		sp.Record(msg)
-		// if isErr {
-		// 	// TODO(radu): figure out a way to signal that this is an error. We
-		// 	// could use a different "error" key (provided it shows up in
-		// 	// LightStep). Things like NetTraceIntegrator would need to be modified
-		// 	// to understand the difference. We could also set a special Tag or
-		// 	// Baggage on the span. See #8827 for more discussion.
-		// }
-	} else {
-		el.Lock()
-		if el.eventLog != nil {
-			if isErr {
-				el.eventLog.Errorf("%s", msg)
-			} else {
-				el.eventLog.Printf("%s", msg)
-			}
+	// No span, record to event log instead.
+	//
+	// TODO(obs-inf): making this either/or doesn't seem useful, but it
+	// is the status quo, and the callers only pass one of the two even
+	// if they have both.
+	el.Lock()
+	defer el.Unlock()
+	if el.eventLog != nil {
+		if isErr {
+			el.eventLog.Errorf("%s", entry)
+		} else {
+			el.eventLog.Printf("%s", entry)
 		}
-		el.Unlock()
 	}
 }
 
@@ -194,16 +158,13 @@ func Event(ctx context.Context, msg string) {
 	}
 
 	// Format the tracing event and add it to the trace.
-	entry := MakeLegacyEntry(ctx,
+	entry := makeUnstructuredEntry(ctx,
 		severity.INFO, /* unused for trace events */
 		channel.DEV,   /* unused for trace events */
 		1,             /* depth */
-		// redactable is false because we want to flatten the data in traces
-		// -- we don't have infrastructure yet for trace redaction.
-		false, /* redactable */
-		"")
-	entry.Message = msg
-	eventInternal(sp, el, false /* isErr */, entry)
+		true,          /* redactable */
+		msg)
+	eventInternal(sp, el, false /* isErr */, &entry)
 }
 
 // Eventf looks for an opentracing.Trace in the context and formats and logs
@@ -217,15 +178,13 @@ func Eventf(ctx context.Context, format string, args ...interface{}) {
 	}
 
 	// Format the tracing event and add it to the trace.
-	entry := MakeLegacyEntry(ctx,
+	entry := makeUnstructuredEntry(ctx,
 		severity.INFO, /* unused for trace events */
 		channel.DEV,   /* unused for trace events */
 		1,             /* depth */
-		// redactable is false because we want to flatten the data in traces
-		// -- we don't have infrastructure yet for trace redaction.
-		false, /* redactable */
+		true,          /* redactable */
 		format, args...)
-	eventInternal(sp, el, false /* isErr */, entry)
+	eventInternal(sp, el, false /* isErr */, &entry)
 }
 
 func vEventf(
@@ -244,15 +203,13 @@ func vEventf(
 			// Nothing to log. Skip the work.
 			return
 		}
-		entry := MakeLegacyEntry(ctx,
+		entry := makeUnstructuredEntry(ctx,
 			severity.INFO, /* unused for trace events */
 			channel.DEV,   /* unused for trace events */
 			depth+1,
-			// redactable is false because we want to flatten the data in traces
-			// -- we don't have infrastructure yet for trace redaction.
-			false, /* redactable */
+			true, /* redactable */
 			format, args...)
-		eventInternal(sp, el, isErr, entry)
+		eventInternal(sp, el, isErr, &entry)
 	}
 }
 
diff --git a/pkg/util/tracing/crdbspan.go b/pkg/util/tracing/crdbspan.go
index c17c6139d92f..cbcf1bca67be 100644
--- a/pkg/util/tracing/crdbspan.go
+++ b/pkg/util/tracing/crdbspan.go
@@ -22,6 +22,7 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/util/timeutil"
 	"github.com/cockroachdb/cockroach/pkg/util/tracing/tracingpb"
 	"github.com/cockroachdb/logtags"
+	"github.com/cockroachdb/redact"
 	"github.com/gogo/protobuf/types"
 	"github.com/opentracing/opentracing-go"
 )
@@ -290,7 +291,7 @@ func (s *crdbSpan) setTagLocked(key string, value interface{}) {
 	s.mu.tags[key] = value
 }
 
-func (s *crdbSpan) record(msg string) {
+func (s *crdbSpan) record(msg redact.RedactableString) {
 	if s.recordingType() != RecordingVerbose {
 		return
 	}
@@ -397,13 +398,14 @@ func (s *crdbSpan) setBaggageItemLocked(restrictedKey, value string) {
 // optimization as stringifying the tag values can be expensive.
 func (s *crdbSpan) getRecordingLocked(wantTags bool) tracingpb.RecordedSpan {
 	rs := tracingpb.RecordedSpan{
-		TraceID:      s.traceID,
-		SpanID:       s.spanID,
-		ParentSpanID: s.parentSpanID,
-		GoroutineID:  s.goroutineID,
-		Operation:    s.mu.operation,
-		StartTime:    s.startTime,
-		Duration:     s.mu.duration,
+		TraceID:        s.traceID,
+		SpanID:         s.spanID,
+		ParentSpanID:   s.parentSpanID,
+		GoroutineID:    s.goroutineID,
+		Operation:      s.mu.operation,
+		StartTime:      s.startTime,
+		Duration:       s.mu.duration,
+		RedactableLogs: true,
 	}
 
 	if rs.Duration == -1 {
diff --git a/pkg/util/tracing/recording.go b/pkg/util/tracing/recording.go
index cae39839ddff..cff98c5d26f3 100644
--- a/pkg/util/tracing/recording.go
+++ b/pkg/util/tracing/recording.go
@@ -208,7 +208,10 @@ func (r Recording) visitSpan(sp tracingpb.RecordedSpan, depth int) []traceLogDat
 			Fields:    make([]otlog.Field, len(l.Fields)),
 		}
 		for i, f := range l.Fields {
-			lr.Fields[i] = otlog.String(f.Key, f.Value)
+			// TODO(obs-inf): the use of opentracing data structures here seems
+			// like detritus and prevents good redactability of the result.
+			// It looks like this is only used for Recording.String() though.
+			lr.Fields[i] = otlog.String(f.Key, f.Value.StripMarkers())
 		}
 		lastLog := ownLogs[len(ownLogs)-1]
 		ownLogs = append(ownLogs, conv(lr, lastLog.Timestamp))
@@ -507,7 +510,7 @@ func TestingCheckRecordedSpans(rec Recording, expected string) error {
 		for _, l := range rs.Logs {
 			var msg string
 			for _, f := range l.Fields {
-				msg = msg + fmt.Sprintf("    %s: %v", f.Key, f.Value)
+				msg = msg + fmt.Sprintf("    %s: %v", f.Key, f.Value.StripMarkers())
 			}
 			row(d, "%s", msg)
 		}
diff --git a/pkg/util/tracing/span.go b/pkg/util/tracing/span.go
index 6242dffde36f..b8980439b376 100644
--- a/pkg/util/tracing/span.go
+++ b/pkg/util/tracing/span.go
@@ -160,9 +160,7 @@ func (sp *Span) IsVerbose() bool {
 // Record provides a way to record free-form text into verbose spans. Recordings
 // may be dropped due to sizing constraints.
 //
-// TODO(irfansharif): We don't currently have redactability with trace
-// recordings (both here, and using RecordStructured above). We'll want to do this
-// soon.
+// TODO(tbg): make sure `msg` is lint-forced to be const.
 func (sp *Span) Record(msg string) {
 	if sp.done() {
 		return
diff --git a/pkg/util/tracing/span_inner.go b/pkg/util/tracing/span_inner.go
index 6bd5776dca12..9f30d5a734fb 100644
--- a/pkg/util/tracing/span_inner.go
+++ b/pkg/util/tracing/span_inner.go
@@ -11,13 +11,13 @@
 package tracing
 
 import (
-	"fmt"
 	"strings"
 	"time"
 
 	"github.com/cockroachdb/cockroach/pkg/util/timeutil"
 	"github.com/cockroachdb/cockroach/pkg/util/tracing/tracingpb"
 	"github.com/cockroachdb/errors"
+	"github.com/cockroachdb/redact"
 	"github.com/opentracing/opentracing-go"
 	otlog "github.com/opentracing/opentracing-go/log"
 	"golang.org/x/net/trace"
@@ -228,9 +228,13 @@ func (s *spanInner) Recordf(format string, args ...interface{}) {
 	if !s.hasVerboseSink() {
 		return
 	}
-	str := fmt.Sprintf(format, args...)
+	str := redact.Sprintf(format, args...)
 	if s.ot.shadowSpan != nil {
-		s.ot.shadowSpan.LogFields(otlog.String(tracingpb.LogMessageField, str))
+		// TODO(obs-inf): depending on the situation it may be more appropriate to
+		// redact the string here.
+		// See:
+		// https://github.com/cockroachdb/cockroach/issues/58610#issuecomment-926093901
+		s.ot.shadowSpan.LogFields(otlog.String(tracingpb.LogMessageField, str.StripMarkers()))
 	}
 	if s.netTr != nil {
 		s.netTr.LazyPrintf(format, args)
diff --git a/pkg/util/tracing/span_test.go b/pkg/util/tracing/span_test.go
index 14e3fcf85ac1..bf185b5d16ce 100644
--- a/pkg/util/tracing/span_test.go
+++ b/pkg/util/tracing/span_test.go
@@ -308,8 +308,8 @@ func TestSpanRecordLimit(t *testing.T) {
 	first := rec[0].Logs[0]
 	last := rec[0].Logs[len(rec[0].Logs)-1]
 
-	require.Equal(t, first.Fields[0].Value, msg(extra+1))
-	require.Equal(t, last.Fields[0].Value, msg(numLogs+extra))
+	require.Equal(t, first.Fields[0].Value.StripMarkers(), msg(extra+1))
+	require.Equal(t, last.Fields[0].Value.StripMarkers(), msg(numLogs+extra))
 }
 
 // testStructuredImpl is a testing implementation of Structured event.
diff --git a/pkg/util/tracing/test_utils.go b/pkg/util/tracing/test_utils.go
index ae3d67abaa46..e87f486346e8 100644
--- a/pkg/util/tracing/test_utils.go
+++ b/pkg/util/tracing/test_utils.go
@@ -33,7 +33,7 @@ func LogsContainMsg(sp tracingpb.RecordedSpan, msg string) bool {
 		// NOTE: With our logs, each LogRecord has a single field ("event") and
 		// value.
 		for _, f := range l.Fields {
-			if strings.Contains(f.Value, msg) {
+			if strings.Contains(f.Value.StripMarkers(), msg) {
 				return true
 			}
 		}
@@ -48,7 +48,7 @@ func CountLogMessages(sp tracingpb.RecordedSpan, msg string) int {
 		// NOTE: With our logs, each LogRecord has a single field ("event") and
 		// value.
 		for _, f := range l.Fields {
-			if strings.Contains(f.Value, msg) {
+			if strings.Contains(f.Value.StripMarkers(), msg) {
 				res++
 			}
 		}
diff --git a/pkg/util/tracing/tracingpb/BUILD.bazel b/pkg/util/tracing/tracingpb/BUILD.bazel
index 9aef9f435530..24ca6a38846b 100644
--- a/pkg/util/tracing/tracingpb/BUILD.bazel
+++ b/pkg/util/tracing/tracingpb/BUILD.bazel
@@ -30,5 +30,8 @@ go_proto_library(
     importpath = "github.com/cockroachdb/cockroach/pkg/util/tracing/tracingpb",
     proto = ":tracingpb_proto",
     visibility = ["//visibility:public"],
-    deps = ["@com_github_gogo_protobuf//gogoproto"],
+    deps = [
+        "@com_github_cockroachdb_redact//:redact",  # keep
+        "@com_github_gogo_protobuf//gogoproto",
+    ],
 )
diff --git a/pkg/util/tracing/tracingpb/recorded_span.go b/pkg/util/tracing/tracingpb/recorded_span.go
index 0a58be11ca1d..bfd24b579f8d 100644
--- a/pkg/util/tracing/tracingpb/recorded_span.go
+++ b/pkg/util/tracing/tracingpb/recorded_span.go
@@ -55,7 +55,7 @@ func (l LogRecord) Msg() string {
 	for _, f := range l.Fields {
 		key := f.Key
 		if key == LogMessageField {
-			return f.Value
+			return f.Value.StripMarkers()
 		}
 		if key == "error" {
 			return fmt.Sprint("error:", f.Value)
diff --git a/pkg/util/tracing/tracingpb/recorded_span.pb.go b/pkg/util/tracing/tracingpb/recorded_span.pb.go
index f554bb383cb6..a4f346ccb853 100644
--- a/pkg/util/tracing/tracingpb/recorded_span.pb.go
+++ b/pkg/util/tracing/tracingpb/recorded_span.pb.go
@@ -5,6 +5,7 @@ package tracingpb
 
 import (
 	fmt "fmt"
+	github_com_cockroachdb_redact "github.com/cockroachdb/redact"
 	_ "github.com/gogo/protobuf/gogoproto"
 	proto "github.com/gogo/protobuf/proto"
 	github_com_gogo_protobuf_sortkeys "github.com/gogo/protobuf/sortkeys"
@@ -66,8 +67,8 @@ func (m *LogRecord) XXX_DiscardUnknown() {
 var xxx_messageInfo_LogRecord proto.InternalMessageInfo
 
 type LogRecord_Field struct {
-	Key   string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	Key   string                                         `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value github_com_cockroachdb_redact.RedactableString `protobuf:"bytes,2,opt,name=value,proto3,customtype=github.com/cockroachdb/redact.RedactableString" json:"value"`
 }
 
 func (m *LogRecord_Field) Reset()         { *m = LogRecord_Field{} }
@@ -162,6 +163,10 @@ type RecordedSpan struct {
 	// have an "unfinished" tag and a `finished` boolean value of false in this
 	// recording.
 	Duration time.Duration `protobuf:"bytes,8,opt,name=duration,proto3,stdduration" json:"duration"`
+	// RedactableLogs determines whether the verbose log messages are redactable.
+	// This field was introduced in the 22.1 cycle. It can be removed in the 22.2
+	// cycle.
+	RedactableLogs bool `protobuf:"varint,15,opt,name=redactable_logs,json=redactableLogs,proto3" json:"redactable_logs,omitempty"`
 	// Events logged in the span.
 	Logs []LogRecord `protobuf:"bytes,9,rep,name=logs,proto3" json:"logs"`
 	// DeprecatedInternalStructured are payloads attached to this Span.
@@ -270,55 +275,59 @@ func init() {
 }
 
 var fileDescriptor_e9b7b35ae7ab4ca8 = []byte{
-	// 767 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x54, 0xcf, 0x4f, 0xdb, 0x48,
-	0x14, 0x8e, 0x13, 0x27, 0x76, 0xc6, 0x59, 0x36, 0x3b, 0xe2, 0x60, 0x22, 0x64, 0x47, 0x59, 0x69,
-	0x85, 0x16, 0xc9, 0xd9, 0xcd, 0x4a, 0x5b, 0x94, 0x1e, 0xaa, 0xa6, 0xa1, 0x55, 0x2a, 0x44, 0x2b,
-	0x43, 0x2f, 0x5c, 0xa2, 0x89, 0x3d, 0x18, 0x0b, 0xe3, 0xb1, 0xc6, 0x93, 0x4a, 0xa9, 0xfa, 0x47,
-	0x70, 0xe4, 0xd8, 0x7f, 0xa3, 0xc7, 0x9e, 0xca, 0x91, 0x23, 0xa7, 0xb4, 0x35, 0xff, 0x48, 0xe5,
-	0xf1, 0x8f, 0x40, 0x40, 0x4a, 0xd3, 0xf4, 0x64, 0xcf, 0x7b, 0xdf, 0xf7, 0xcd, 0x9b, 0x79, 0xdf,
-	0x1b, 0xf0, 0xf7, 0x98, 0xb9, 0x5e, 0x9b, 0x51, 0x64, 0xb9, 0xbe, 0x93, 0x7d, 0x83, 0x51, 0x9b,
-	0x62, 0x8b, 0x50, 0x1b, 0xdb, 0xc3, 0x30, 0x40, 0xbe, 0x11, 0x50, 0xc2, 0x08, 0x6c, 0x5a, 0xc4,
-	0x3a, 0xa5, 0x04, 0x59, 0x27, 0x46, 0xcc, 0x32, 0x52, 0xb4, 0x91, 0xb3, 0x1a, 0xeb, 0x0e, 0x71,
-	0x08, 0x07, 0xb7, 0xe3, 0xbf, 0x84, 0xd7, 0xd8, 0x70, 0x08, 0x71, 0x3c, 0xdc, 0xe6, 0xab, 0xd1,
-	0xf8, 0xb8, 0x8d, 0xfc, 0x49, 0x9a, 0xd2, 0xe7, 0x53, 0xcc, 0x3d, 0xc3, 0x21, 0x43, 0x67, 0x41,
-	0x0a, 0xd0, 0xe6, 0x01, 0xf6, 0x98, 0x22, 0xe6, 0x92, 0xb4, 0xa6, 0xd6, 0x67, 0x01, 0x54, 0xf7,
-	0x88, 0x63, 0xf2, 0x72, 0xe1, 0x0e, 0x10, 0x63, 0x01, 0x55, 0x68, 0x0a, 0x5b, 0x4a, 0xa7, 0x61,
-	0x24, 0x64, 0x23, 0x23, 0x1b, 0x87, 0x99, 0x7a, 0x4f, 0xbe, 0x9c, 0xea, 0x85, 0xf3, 0x2f, 0xba,
-	0x60, 0x72, 0x06, 0x7c, 0x05, 0x2a, 0xc7, 0x2e, 0xf6, 0xec, 0x50, 0x2d, 0x36, 0x4b, 0x5b, 0x4a,
-	0xe7, 0x5f, 0x63, 0xd1, 0x61, 0x8d, 0x7c, 0x5b, 0xe3, 0x79, 0xcc, 0xec, 0x89, 0xb1, 0xa4, 0x99,
-	0xca, 0x34, 0xda, 0xa0, 0xcc, 0xc3, 0xb0, 0x0e, 0x4a, 0xa7, 0x78, 0xc2, 0x4b, 0xaa, 0x9a, 0xf1,
-	0x2f, 0x5c, 0x07, 0xe5, 0xb7, 0xc8, 0x1b, 0x63, 0xb5, 0xc8, 0x63, 0xc9, 0xa2, 0xf5, 0x1e, 0xd4,
-	0x0f, 0x18, 0x1d, 0x5b, 0x6c, 0x4c, 0xb1, 0xbd, 0xf2, 0x79, 0x0c, 0x20, 0x05, 0x68, 0xe2, 0x11,
-	0x64, 0xf3, 0x5d, 0x94, 0xce, 0xfa, 0x3d, 0xf2, 0x53, 0x7f, 0x62, 0x66, 0xa0, 0xd6, 0x47, 0x09,
-	0xd4, 0xcc, 0xb4, 0xe7, 0x07, 0x01, 0xf2, 0xe1, 0x5f, 0x40, 0x8e, 0x8f, 0x8a, 0x87, 0xae, 0xcd,
-	0xb7, 0x17, 0x7b, 0x4a, 0x34, 0xd5, 0xa5, 0xc3, 0x38, 0x36, 0xe8, 0x9b, 0x12, 0x4f, 0x0e, 0x6c,
-	0xf8, 0x27, 0x90, 0x62, 0x8b, 0xc4, 0xb0, 0x22, 0x87, 0x81, 0x68, 0xaa, 0x57, 0x62, 0x89, 0x41,
-	0xdf, 0xac, 0xc4, 0xa9, 0x81, 0x0d, 0xff, 0x07, 0x6b, 0x01, 0xa2, 0xd8, 0x67, 0xc3, 0x0c, 0x5b,
-	0xe2, 0xd8, 0x7a, 0x34, 0xd5, 0x6b, 0xaf, 0x79, 0x26, 0x65, 0xd4, 0x82, 0xd9, 0xca, 0x86, 0x9b,
-	0xa0, 0x4a, 0x02, 0x9c, 0x34, 0x5c, 0x15, 0xf9, 0x6d, 0xcd, 0x02, 0xf0, 0x0d, 0x90, 0x46, 0xc8,
-	0x71, 0x90, 0x83, 0xd5, 0x32, 0x6f, 0xda, 0xe3, 0xc5, 0x4d, 0xbb, 0x7d, 0x46, 0xa3, 0x97, 0xb0,
-	0x77, 0x7d, 0x46, 0x27, 0x66, 0xa6, 0x05, 0xf7, 0x80, 0xc8, 0x90, 0x13, 0xaa, 0x15, 0xae, 0xb9,
-	0xb3, 0xa4, 0xe6, 0x21, 0x72, 0xc2, 0x44, 0x90, 0xab, 0xc0, 0x67, 0x00, 0x84, 0x0c, 0x51, 0x36,
-	0xe4, 0x8d, 0x94, 0x96, 0x68, 0x64, 0x95, 0xf3, 0xe2, 0x0c, 0x7c, 0x02, 0xe4, 0xcc, 0xf7, 0xaa,
-	0xcc, 0x25, 0x36, 0xee, 0x49, 0xf4, 0x53, 0x40, 0xa2, 0x70, 0x11, 0x2b, 0xe4, 0x24, 0xb8, 0x0b,
-	0x44, 0x8f, 0x38, 0xa1, 0x5a, 0xe5, 0x67, 0xda, 0x5e, 0xc2, 0xdc, 0xa9, 0xad, 0x39, 0x1d, 0x1e,
-	0x01, 0xcd, 0xc6, 0x01, 0xc5, 0x16, 0x62, 0xd8, 0x1e, 0xba, 0x3e, 0xc3, 0xd4, 0x47, 0xde, 0x30,
-	0xcc, 0x7d, 0xab, 0x2a, 0x7c, 0x83, 0x87, 0xcd, 0xb6, 0x39, 0xe3, 0x0e, 0x52, 0xea, 0xcc, 0xf1,
-	0xb0, 0x03, 0x6a, 0x0e, 0xa1, 0x64, 0xcc, 0x5c, 0x9f, 0x9b, 0xae, 0xc6, 0x1d, 0xf2, 0x7b, 0x34,
-	0xd5, 0x95, 0x17, 0x59, 0x7c, 0xd0, 0x37, 0x95, 0x1c, 0x34, 0xb0, 0x61, 0x03, 0xc8, 0xc7, 0xae,
-	0xef, 0x86, 0x27, 0xd8, 0x56, 0x7f, 0x6b, 0x0a, 0x5b, 0xb2, 0x99, 0xaf, 0xa1, 0x03, 0xe0, 0xac,
-	0xae, 0x61, 0xf2, 0x9e, 0x85, 0xea, 0x1a, 0xaf, 0xaf, 0xb3, 0xf8, 0x02, 0xe6, 0x67, 0x31, 0xbd,
-	0x87, 0x3f, 0xc2, 0xb9, 0x78, 0xd8, 0xe8, 0x82, 0xda, 0x6d, 0x23, 0xfd, 0xe8, 0xc0, 0x77, 0x8b,
-	0x3b, 0x42, 0xe3, 0x11, 0xa8, 0xe6, 0x86, 0x59, 0x86, 0xd8, 0x15, 0x2f, 0x3e, 0xe8, 0x85, 0x97,
-	0xa2, 0x0c, 0xea, 0x4a, 0xeb, 0x93, 0x08, 0xd6, 0xf6, 0x09, 0x3d, 0x43, 0x9e, 0xfb, 0x2e, 0x9d,
-	0xde, 0x3b, 0x83, 0x23, 0xcc, 0x0f, 0xce, 0x7e, 0xea, 0xf0, 0xe4, 0xa9, 0xeb, 0x2e, 0xbe, 0x8c,
-	0xbb, 0xea, 0x0b, 0x3c, 0x5e, 0x5a, 0xdd, 0xe3, 0xe2, 0x2a, 0x1e, 0x2f, 0xaf, 0xe6, 0xf1, 0x87,
-	0x7d, 0x23, 0xfd, 0x72, 0xdf, 0x40, 0x13, 0xc8, 0xd6, 0x89, 0xeb, 0xd9, 0x14, 0xfb, 0xe9, 0x5b,
-	0xf3, 0xcf, 0xb2, 0x9d, 0x48, 0xc5, 0x73, 0x9d, 0x9f, 0xf6, 0x53, 0x6f, 0xfb, 0xf2, 0x9b, 0x56,
-	0xb8, 0x8c, 0x34, 0xe1, 0x2a, 0xd2, 0x84, 0xeb, 0x48, 0x13, 0xbe, 0x46, 0x9a, 0x70, 0x7e, 0xa3,
-	0x15, 0xae, 0x6e, 0xb4, 0xc2, 0xf5, 0x8d, 0x56, 0x38, 0xaa, 0xe6, 0x45, 0x8c, 0x2a, 0xbc, 0x21,
-	0xff, 0x7d, 0x0f, 0x00, 0x00, 0xff, 0xff, 0x95, 0x4d, 0x31, 0x78, 0x3d, 0x08, 0x00, 0x00,
+	// 828 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x54, 0x41, 0x6f, 0xe4, 0x34,
+	0x14, 0x9e, 0xb4, 0xe9, 0x24, 0xe3, 0x0c, 0x6d, 0xb1, 0x7a, 0xc8, 0x8e, 0x56, 0x49, 0x55, 0x24,
+	0xa8, 0x58, 0x29, 0x03, 0x83, 0xb4, 0x54, 0xe5, 0x80, 0x18, 0xba, 0xa0, 0x41, 0xd5, 0x82, 0xd2,
+	0x72, 0xd9, 0x4b, 0xe4, 0x89, 0x5d, 0x37, 0xda, 0x34, 0x8e, 0x1c, 0x07, 0x69, 0x10, 0x3f, 0x62,
+	0x8f, 0x7b, 0xe4, 0xaf, 0x70, 0xeb, 0x71, 0x8f, 0x2b, 0x0e, 0x03, 0xa4, 0x3f, 0x04, 0x64, 0xc7,
+	0xc9, 0x6c, 0x67, 0x2b, 0x8d, 0xa6, 0xe5, 0x94, 0xf8, 0xbd, 0xf7, 0x7d, 0x7e, 0xf6, 0xfb, 0x3e,
+	0x83, 0x4f, 0x4b, 0x91, 0xa4, 0x43, 0xc1, 0x51, 0x9c, 0x64, 0xb4, 0xf9, 0xe6, 0xd3, 0x21, 0x27,
+	0x31, 0xe3, 0x98, 0xe0, 0xa8, 0xc8, 0x51, 0x16, 0xe4, 0x9c, 0x09, 0x06, 0xf7, 0x63, 0x16, 0xbf,
+	0xe4, 0x0c, 0xc5, 0x97, 0x81, 0x44, 0x05, 0xba, 0x3a, 0x68, 0x51, 0x83, 0x3d, 0xca, 0x28, 0x53,
+	0xc5, 0x43, 0xf9, 0x57, 0xe3, 0x06, 0x8f, 0x28, 0x63, 0x34, 0x25, 0x43, 0xb5, 0x9a, 0x96, 0x17,
+	0x43, 0x94, 0xcd, 0x74, 0xca, 0x5f, 0x4e, 0x89, 0xe4, 0x8a, 0x14, 0x02, 0x5d, 0xe5, 0xba, 0xc0,
+	0x5b, 0x2e, 0xc0, 0x25, 0x47, 0x22, 0x61, 0xba, 0xa7, 0x83, 0x7f, 0x0d, 0xd0, 0x3b, 0x65, 0x34,
+	0x54, 0xed, 0xc2, 0x23, 0x60, 0x4a, 0x02, 0xd7, 0xd8, 0x37, 0x0e, 0x9d, 0xd1, 0x20, 0xa8, 0xc1,
+	0x41, 0x03, 0x0e, 0xce, 0x1b, 0xf6, 0xb1, 0x7d, 0x3d, 0xf7, 0x3b, 0xaf, 0xfe, 0xf2, 0x8d, 0x50,
+	0x21, 0xe0, 0x8f, 0xa0, 0x7b, 0x91, 0x90, 0x14, 0x17, 0xee, 0xc6, 0xfe, 0xe6, 0xa1, 0x33, 0xfa,
+	0x3c, 0x58, 0x75, 0xd8, 0xa0, 0xdd, 0x36, 0xf8, 0x4e, 0x22, 0xc7, 0xa6, 0xa4, 0x0c, 0x35, 0xcd,
+	0x80, 0x82, 0x2d, 0x15, 0x86, 0xbb, 0x60, 0xf3, 0x25, 0x99, 0xa9, 0x96, 0x7a, 0xa1, 0xfc, 0x85,
+	0xa7, 0x60, 0xeb, 0x17, 0x94, 0x96, 0xc4, 0xdd, 0x90, 0xb1, 0xf1, 0x53, 0x89, 0xfb, 0x73, 0xee,
+	0x07, 0x34, 0x11, 0x97, 0xe5, 0x34, 0x88, 0xd9, 0xd5, 0xb0, 0xdd, 0x1c, 0xcb, 0x51, 0x60, 0x14,
+	0x8b, 0x20, 0x54, 0x1f, 0x34, 0x4d, 0xc9, 0x99, 0xe0, 0x49, 0x46, 0xc3, 0x9a, 0xe4, 0xe0, 0x37,
+	0xb0, 0x7b, 0x26, 0x78, 0x19, 0x8b, 0x92, 0x13, 0xfc, 0xe0, 0x7b, 0x08, 0x80, 0x95, 0xa3, 0x59,
+	0xca, 0x10, 0x56, 0xdd, 0x39, 0xa3, 0xbd, 0xf7, 0xc0, 0xdf, 0x64, 0xb3, 0xb0, 0x29, 0x3a, 0xa8,
+	0x2c, 0xd0, 0x0f, 0xb5, 0x56, 0xce, 0x72, 0x94, 0xc1, 0x8f, 0x81, 0x2d, 0xaf, 0x88, 0x44, 0x09,
+	0x56, 0xdb, 0x9b, 0x63, 0xa7, 0x9a, 0xfb, 0xd6, 0xb9, 0x8c, 0x4d, 0x4e, 0x42, 0x4b, 0x25, 0x27,
+	0x18, 0x7e, 0x04, 0x2c, 0x29, 0x2d, 0x59, 0xb6, 0xa1, 0xca, 0x40, 0x35, 0xf7, 0xbb, 0x92, 0x62,
+	0x72, 0x12, 0x76, 0x65, 0x6a, 0x82, 0xe1, 0x53, 0xb0, 0x9d, 0x23, 0x4e, 0x32, 0x11, 0x35, 0xb5,
+	0x9b, 0xaa, 0x76, 0xb7, 0x9a, 0xfb, 0xfd, 0x9f, 0x54, 0x46, 0x23, 0xfa, 0xf9, 0x62, 0x85, 0xe1,
+	0x63, 0xd0, 0x63, 0x39, 0xa9, 0x85, 0xe2, 0x9a, 0xea, 0xe6, 0x17, 0x01, 0xf8, 0x33, 0xb0, 0xa6,
+	0x88, 0x52, 0x44, 0x89, 0xbb, 0xa5, 0x86, 0xfd, 0xd5, 0xea, 0x61, 0xbf, 0x7b, 0xc6, 0x60, 0x5c,
+	0xa3, 0x9f, 0x65, 0x82, 0xcf, 0xc2, 0x86, 0x0b, 0x9e, 0x02, 0x53, 0x20, 0x5a, 0xb8, 0x5d, 0xc5,
+	0x79, 0xb4, 0x26, 0xe7, 0x39, 0xa2, 0x45, 0x4d, 0xa8, 0x58, 0xe0, 0xb7, 0x00, 0x14, 0x02, 0x71,
+	0x11, 0xa9, 0x41, 0x5a, 0x6b, 0x0c, 0xb2, 0xa7, 0x70, 0x32, 0x03, 0xbf, 0x06, 0x76, 0xe3, 0x17,
+	0xd7, 0x56, 0x14, 0x8f, 0xde, 0xa3, 0x38, 0xd1, 0x05, 0x35, 0xc3, 0x6b, 0xc9, 0xd0, 0x82, 0xe0,
+	0x27, 0x60, 0x87, 0xb7, 0xba, 0x8b, 0x52, 0x46, 0x0b, 0x77, 0x67, 0xdf, 0x38, 0xb4, 0xc3, 0xed,
+	0x45, 0xf8, 0x94, 0xd1, 0x02, 0x3e, 0x03, 0xa6, 0xca, 0xf6, 0xd4, 0xe1, 0x9f, 0xac, 0xe1, 0x1e,
+	0xed, 0x1b, 0x05, 0x87, 0x2f, 0x80, 0x87, 0x49, 0xce, 0x49, 0x8c, 0x04, 0xc1, 0x51, 0x92, 0x09,
+	0xc2, 0x33, 0x94, 0x46, 0x45, 0x2b, 0x70, 0xd7, 0x51, 0x1b, 0xdc, 0xad, 0xca, 0xc7, 0x0b, 0xec,
+	0x44, 0x43, 0x17, 0xd6, 0x80, 0x23, 0xd0, 0xa7, 0x8c, 0xb3, 0x52, 0x24, 0x99, 0x52, 0x67, 0x5f,
+	0x49, 0x69, 0xa7, 0x9a, 0xfb, 0xce, 0xf7, 0x4d, 0x7c, 0x72, 0x12, 0x3a, 0x6d, 0xd1, 0x04, 0xc3,
+	0x01, 0xb0, 0x2f, 0x92, 0x2c, 0x29, 0x2e, 0x09, 0x76, 0x3f, 0x50, 0x07, 0x6f, 0xd7, 0x90, 0x02,
+	0xb8, 0xe8, 0x2b, 0xaa, 0x1f, 0xcc, 0xc2, 0xdd, 0x56, 0xfd, 0x8d, 0x56, 0x5f, 0xc0, 0xb2, 0x69,
+	0xf5, 0x3d, 0x7c, 0x58, 0x2c, 0xc5, 0x8b, 0xc1, 0x31, 0xe8, 0xbf, 0xab, 0xb8, 0x3b, 0x5e, 0x94,
+	0xbd, 0x5b, 0x2f, 0x8a, 0x7e, 0x19, 0x8e, 0x37, 0x8e, 0x8c, 0xc1, 0x97, 0xa0, 0xd7, 0x2a, 0x6b,
+	0x1d, 0xe0, 0xb1, 0xf9, 0xfa, 0x77, 0xbf, 0xf3, 0x83, 0x69, 0x83, 0x5d, 0xe7, 0xe0, 0x0f, 0x13,
+	0x6c, 0x3f, 0x67, 0xfc, 0x0a, 0xa5, 0xc9, 0xaf, 0xda, 0xe6, 0xb7, 0x1c, 0x66, 0x2c, 0x3b, 0xec,
+	0xb9, 0xb6, 0x42, 0xfd, 0x96, 0x1e, 0xaf, 0xbe, 0x8c, 0xdb, 0xec, 0x2b, 0xcc, 0xb0, 0xf9, 0x70,
+	0x33, 0x98, 0xf7, 0x31, 0x43, 0xa3, 0xf1, 0xad, 0x87, 0x69, 0xfc, 0x6e, 0xdd, 0x58, 0xff, 0xbb,
+	0x6e, 0x60, 0x08, 0xec, 0xf8, 0x32, 0x49, 0x31, 0x27, 0x99, 0x7e, 0x94, 0x3e, 0x5b, 0x77, 0x12,
+	0x9a, 0xbc, 0xe5, 0xb9, 0xb7, 0x9e, 0xc6, 0x4f, 0xae, 0xff, 0xf1, 0x3a, 0xd7, 0x95, 0x67, 0xbc,
+	0xa9, 0x3c, 0xe3, 0x6d, 0xe5, 0x19, 0x7f, 0x57, 0x9e, 0xf1, 0xea, 0xc6, 0xeb, 0xbc, 0xb9, 0xf1,
+	0x3a, 0x6f, 0x6f, 0xbc, 0xce, 0x8b, 0x5e, 0xdb, 0xc4, 0xb4, 0xab, 0x06, 0xf2, 0xc5, 0x7f, 0x01,
+	0x00, 0x00, 0xff, 0xff, 0xc8, 0x21, 0x07, 0xaa, 0x9e, 0x08, 0x00, 0x00,
 }
 
 func (m *LogRecord) Marshal() (dAtA []byte, err error) {
@@ -466,6 +475,16 @@ func (m *RecordedSpan) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.RedactableLogs {
+		i--
+		if m.RedactableLogs {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x78
+	}
 	if len(m.StructuredRecords) > 0 {
 		for iNdEx := len(m.StructuredRecords) - 1; iNdEx >= 0; iNdEx-- {
 			{
@@ -847,6 +866,9 @@ func (m *RecordedSpan) Size() (n int) {
 			n += 1 + l + sovRecordedSpan(uint64(l))
 		}
 	}
+	if m.RedactableLogs {
+		n += 2
+	}
 	return n
 }
 
@@ -1107,7 +1129,7 @@ func (m *LogRecord_Field) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Value = string(dAtA[iNdEx:postIndex])
+			m.Value = github_com_cockroachdb_redact.RedactableString(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -1828,6 +1850,26 @@ func (m *RecordedSpan) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 15:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RedactableLogs", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRecordedSpan
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.RedactableLogs = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipRecordedSpan(dAtA[iNdEx:])
diff --git a/pkg/util/tracing/tracingpb/recorded_span.proto b/pkg/util/tracing/tracingpb/recorded_span.proto
index deb3643f3ead..8ca9697031b0 100644
--- a/pkg/util/tracing/tracingpb/recorded_span.proto
+++ b/pkg/util/tracing/tracingpb/recorded_span.proto
@@ -24,7 +24,7 @@ message LogRecord {
                                      (gogoproto.stdtime) = true];
   message Field {
     string key = 1;
-    string value = 2;
+    string value = 2 [(gogoproto.nullable) = false, (gogoproto.customtype) = "github.com/cockroachdb/redact.RedactableString"];
   }
   // Fields with values converted to strings.
   repeated Field fields = 2 [(gogoproto.nullable) = false];
@@ -70,6 +70,10 @@ message RecordedSpan {
   google.protobuf.Duration duration = 8 [(gogoproto.nullable) = false,
                                          (gogoproto.stdduration) = true];
 
+  // RedactableLogs determines whether the verbose log messages are redactable.
+  // This field was introduced in the 22.1 cycle. It can be removed in the 22.2
+  // cycle.
+  bool redactable_logs = 15;
   // Events logged in the span.
   repeated LogRecord logs = 9 [(gogoproto.nullable) = false];