1140250 - find a new destination for local7.* syslogs from supportadm.private.phx1

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: WebOps: Other, task)

Description

[:Atoll]

supportadm.private.phx1 is configured, via webapp::admin::support, to forward local7.* syslogs over the network to the abandoned host syslog1.webapp.scl3. (See bug 1079116 for investigation.)

Where should these syslogs go instead? Local disk? Nowhere?

Comment 1

[Shyam Mani [:fox2mike]]

I'm guessing we need to find out who uses these logs and then act accordingly.

Comment 2

[:Atoll]

The last two people who might have cared about those logs to login to the host were:

jbryner  pts/0        10.22.248.26     Fri Jul 25 09:50 - 13:29  (03:38)    
jthomas  pts/1        10.22.248.118    Wed Jan 15 13:25 - 13:28  (00:02)    

Setting needinfo? on both of those folks, so we can try to find someone who knows what these logs from supportadm are all about.

Comment 3

[Jason Thomas [:jason]]

django logs are sent to local7 syslog facility. These are probably used by the SUMO team for debugging purposes. I think this should be updated to point to the same syslog location as the webnodes, looks like syslog1.webapp.phx1.mozilla.com.

Comment 4

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

We do not inject these logs (assuming mean httpd) into mozdef, so webnode destination sounds right to me.

Comment 5

[Michael Cooper [:mythmon]]

SUMO isn't using these logs in their current state. That being said, I've long wished we had access to django logs, so if these could go somewhere we could access them, that would be pretty cool.

Comment 6

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

any idea of the volume (logs/day, MB/day) ?

Comment 7

[:Atoll]

0 bytes/day, as far as I can tell right now. The hosts were never configured to log local7.* properly, so I dug around in /var/log/messages and there's nothing at all from the other servers. We probably also lack various ACLs that would permit this at all, anyways. So, no idea yet, we'll see once we start logging it someday :)

Comment 8

[:Atoll]

Alright. I removed the syslog forwarder for supportadm, and we'll defer to local logs on disk to see what's up there.