We'd like to understand where IP actors can get created from. We should be careful not to overwhelm the logs.
First figure out:
Then implement the logging and agree a strategy for monitoring the data with @jwang.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Log when an IP actor is created if temporary accounts are enabled | mediawiki/core | master | +6 -0 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 [Epic] Update features for temporary accounts | |||
| Open | None | T331637 Update features in MediaWiki core for IP Masking | |||
| Resolved | Tchanders | T336187 [S] Investigate: Creating temp user on non-EditPage actions | |||
| Resolved | Dreamy_Jazz | T349219 [M] Investigate: Which workflows create an IP actor? | |||
| Resolved | Tchanders | T349891 [S] Add some kind of logging when an actor is created with an IP address |
Change 969796 had a related patch set uploaded (by Tchanders; author: Tchanders):
[mediawiki/core@master] Log when an IP actor is created if temporary accounts are enabled
- What to log
We need the IP address and the stack trace. Logging a warning to logstash with a bit of context should be enough.
- How to log it
Via ActorStore::validateActorForInsertion should catch all cases where an actor is being made properly. We can do some direct searches for 'actor' to see if anyone is inserting not via ActorStore.
- What proportion of the time to log (is 100% OK?)
For now, with temp accounts only being enabled on some beta wikis, this should be fine (the log only gets made if temp accounts are enabled).
Change 969796 merged by jenkins-bot:
[mediawiki/core@master] Log when an IP actor is created if temporary accounts are enabled