848882 - marketplace-dev, -altdev, -stage and -prod are missing CEF configuration for metlog

Status: RESOLVED FIXED

(Marketplace Graveyard :: General, defect)

Description

[Victor Ng [:vng] [:crankycoder]]

Marketplace in all enviroments is missing sufficient configuration for metlog-cef

The metlog_cef plugin should look like this:

'plugins': {'cef': ('metlog_cef_cef_plugin:config_plugin', {
  'syslog_facility': 'LOCAL4',
  'syslog_ident': CEF_PRODUCT,
  'syslog_priority': 'INFO',
})}

The production configuration works properly because it is still using logstash which puts in a default facility of LOCAL4 if one is not found and applies the default facility to create a valid syslog priority.

heka-0.1.1-2 currently doesn't use a default, and doesn't try to decode the client supplied facility - thus it creates an invalid syslog priority value.

Comment 1

[Victor Ng [:vng] [:crankycoder]]

:jason- I've updated the configuration for marketplace-altdev, can we get a push out to -altdev after the new hekad has been pushed out to logstash1, logstash2 (bug 849915).

Comment 2

[Victor Ng [:vng] [:crankycoder]]

marketplace-altdev is routing messages correctly into arcsight now.  

If you need to view the messages yourself, you need to be provisioned in arcsight with the "Phx Logger - Marketplace group" setting.

Comment 3

[Victor Ng [:vng] [:crankycoder]]

final patch for zamboni production landed in f2e2b361c499837d3710e2b61e5318e6e5dfb812