NET-3876 Fix S6667 FN: Logging should pass exception not raised in IDE for Serilog

[MelDommer]

Description

When our CI analysis runs we get the issues reported from SonarCloud for S6667 and the Visual Studio plugin seem to catch it.

However the Rider SonarQube for IDE plugin and the NuGet package seem to miss this.

Reproducer

using Serilog;
// ....
// ....
  catch (OperationCanceledException)
  {
      _logger.Warning("...");
  }

When CI runs, the issue is flagged in the CI analysis, and in SonarQube for Visual Studio it is caught immediately too.

It seems to not work with SonarQube for IDE (Rider 12.2.084584) or just the NuGet package. I installed the nuget package into the project and it didn't show up in Rider or Visual Studio. Then when installing the pluging for visual studio it did show up. I don't use Visual Studio but I setup visual studio to test it out.

Product and Version

SonarCloud, SonarAnalyzer.CSharp (10.25.0.139117), SonarQube for IDE (Rider 12.2.084584) & SonarQube for Visual Studio (VS2026, 10.2.0.16704)

[github-actions]

Internal ticket NET-3876

[martin-strecker-sonarsource]

Hi @MelDommer, thanks for the detailed report!

We tracked this down — the rule's compilation guard in ExceptionsShouldBeLogged.cs only subscribes when the project references one of Microsoft.Extensions.Logging.Abstractions, Castle.Core, Common.Logging.Core, log4net, or NLog — Serilog was missing from that list, even though the underlying walker already knows how to detect Serilog calls. So if a project references only Serilog (no transitive Microsoft.Extensions.Logging.Abstractions), S6667 never registers and never fires.

That's why you see the split between CI / Visual Studio (where the larger build context likely pulls in Microsoft.Extensions.Logging.Abstractions transitively) and your minimal IDE / NuGet-only repro (where it doesn't). It's not actually IDE-specific — adding a Serilog-only unit test reproduces the FN deterministically.

Fix is a one-liner adding KnownAssembly.Serilog to the guard; tracked internally as NET-3876 and going up for review now. Once merged it will roll out with the next analyzer release across all channels (NuGet, IDE plugins, server).

One related note: you might also be interested in #9798, which requests S6667 to not flag expected exceptions like OperationCanceledException. That's a separate, still-open discussion — your snippet happens to hit both, but the two are independent.

Thanks again!