On the week of March 21, Wikimedia engineering is planning to fail over to CODFW for 48 hours. EventLogging needs to remain available, and there need to be instructions on Wikitech which document any manual steps (if any) required for shifting EventLogging to codfw.
UDP traffic can get from codfw to eqiad in general — the two DCs are interconnected (although keep in mind that the fibers may be wiretapped and thus no expectations of privacy should exist).
ACLs is something we should check, let me know of the specific flows you're referring so I can check that. Also, is this multicast? If it is, it /should/ work, but I'd like to test it as it's a little bit more complicated (PIM is involved).
As for "eqiad being up while this exercise takes place"… we have tentative plans of bringing it down in parts (e.g. row by row) to do network maintenance such as switch/router upgrades, so ideally we shouldn't count on that.
Traffic is not multicast, it is direct from app servers -> eventlog1001.
Hitting the beacon/event.gif endpoint from app servers is not a bad idea, and would simplify configuration and processes on the eventlog server side. It doesn't help with the codfw failover, but it does eliminate one more special case.
All varnishkafkas produce to the analytics-eqiad Kafka cluster. If that is not reachable, then we will lose all eventlogging and webrequest messages.
[error]  /w/index.php?title=Main_Page&action=submit ErrorException from line 63 of /vagrant/mediawiki/extensions/EventLogging/includes/EventLogging.php: PHP Notice: Undefined variable: wgDBname
Ah, I see it was removed in https://gerrit.wikimedia.org/r/#/c/273008/1/includes/EventLogging.php and then re-added in response to a comment in a later patch., but without the global declaration.