uwsgi (via service::uwsgi) logs both to file and to logstash (json over udp) over the network with logger=logstash socket:logstash.svc.eqiad.wmnet:11514, we should move to logging to localhost instead (via profile::rsyslog::udp_json_logback_compat) or syslog directly, and from there onto the logging pipeline
@fgiunchedi what's the current best practice here? Debmonitor is just using service::uwsgi that automatically logs to /srv/log/debmonitor/main.log and AFAIK doesn't log to the local syslog normal connections but just restarts of the daemon.
I guess we would like to use a shared solution for all the uwsgi servers we have.
Essentially two options: json to syslog/journald (works best on Buster, before that journald has max 2k line length limitation) or json to local udp syslog (via rsyslog and '::profile::rsyslog::udp_json_logback_compat'). For a standard solution that applies to all uwsgi servers I'm thinking probably the latter is the easiest ATM (alternatively wait for Buster migration), what do you think ?
I suggest that we implement the logic in service::uwsgi allowing for an easy opt-in from all the users of that define, that I bet is used on WMCS too.
For the implementation between the option if we have time probably nicer to implement directly the buster solution and apply it while migrating to it.
But if we want/need to push for a quicker migration then let's do the interim local udp that is compatible with stretch too.
Agreed, I'll send out patches to add switches to service::uwsgi for logging pipeline. I agree the optimal would be journald although I suspect the full Buster migration isn't imminent at this point, will try with rsyslog first.