There is interest in adding support for message filter hooks that just log when a pattern is detected but otherwise do not interfere with the operation. Neither throwing or closing the connection. This is primarily for cases where a pattern is "suspicious" but not a clear exploit, and we want to know how common it is before we consider rejecting.

Proposal: Use negative values of hook returns to signify that the plugin deems some case worthy of logging but not rejecting. We already treat zero as the fast-path "this message looks fine" signal, and >0 will be used for the initial batch of connection-fatal patterns. However, if we ever have a mix of fatal and non-fatal patterns, the plugin will need to be careful to not let a non-fatal pattern suppress the emission of a fatal signal if both patterns are present in some message. We should design the plugin to make that bug difficult to do accidentally (if that proves difficult, we should at least add a very clear comment warning about the issue).