1205722 - fix cef logging on balrog's public facing app

Status: RESOLVED INVALID

(Release Engineering Graveyard :: Applications: Balrog (backend), defect)

Description

[[e-mail] (:bhearsum)]

I noticed today that one of the balrog dev apps is busted because the cef logging is misconfigured. I'm pretty sure cef is a dead system, can we just rip it out?

Comment 1

[Guillaume Destuynder [:kang] [this account is no longer active]]

by dead system do you mean the dev apps are no longer used and will also be removed?
otherwise, do you have a link to the cef code? we do convert and alert on cef, with the code i can check what message it is and if we're actively alerting/getting it and so on

Comment 2

[[e-mail] (:bhearsum)]

(In reply to Guillaume Destuynder [:kang] from comment #1)
> by dead system do you mean the dev apps are no longer used and will also be
> removed?

No...I meant that the CEF alert system was dead. Someone (I forgot who) told me this may be the case...

> otherwise, do you have a link to the cef code? we do convert and alert on
> cef, with the code i can check what message it is and if we're actively
> alerting/getting it and so on

https://github.com/mozilla/balrog/blob/master/auslib/log.py

Comment 3

[Guillaume Destuynder [:kang] [this account is no longer active]]

I had a look at the past 2 days and we don't seem to have gotten any event from it.
CEF still works - we have removed ArcSight (which uses CEF) and replaced it by MozDef (which uses everything including CEF, albeit the native format is JSON).

For reference, thats the mozdef python lib for sending events (but again, CEF works fine too): https://github.com/gdestuynder/mozdef_client

Should the system be sending msgs right now?

Comment 4

[[e-mail] (:bhearsum)]

(In reply to Guillaume Destuynder [:kang] from comment #3)
> I had a look at the past 2 days and we don't seem to have gotten any event
> from it.
> CEF still works - we have removed ArcSight (which uses CEF) and replaced it
> by MozDef (which uses everything including CEF, albeit the native format is
> JSON).
> 
> For reference, thats the mozdef python lib for sending events (but again,
> CEF works fine too): https://github.com/gdestuynder/mozdef_client
> 
> Should the system be sending msgs right now?

I wouldn't expect it to be sending them regularly. Most of the alerts would come from someone submitting bad data to the system, which isn't a terribly common occurence.

In any case, if cef isn't dead it sounds like we shouldn't rip it from Balrog :).

Comment 5

[[e-mail] (:bhearsum)]

cef logging is gone as of bug 1251355