Page MenuHomePhabricator

Grant Access to logstash for Jeremyb
Closed, DeclinedPublic

Description

  • The username of your existing account on wikitech.wikimedia.org: Jeremyb
  • Do you currently have shell access? no
  • Purpose (Specify which service you need to get access to, e.g. Icinga, Grafana, Superset etc): logstash
  • The specific LDAP group that you want to be added to (optional):

I had logstash access before, didn't sign revised NDA in time, I thought I later signed it but just checked L2 and phab thinks I didn't. So I need to sign something new with @KFrancis?

anyway now I have a specific use for logstash, so I can detect when I am spamming the logs before I disrupt the deployment train. see T374394

Event Timeline

It first needs a sponsor from a wmf staff.

FWIW, This access is quite sensitive.

Hi @jeremyb Thanks for checking in. We have sunsetted the L2 form. I am happy to facilitate an NDA from my end though. Please send your full name, email address, mailing address, and a few details about the access you'll need to kfrancis@wikimedia.org and I'll process an NDA for you to sign.

so I can detect when I am spamming the logs before I disrupt the deployment train

The logspam checker script comes to mind when reading this.

Are you aware of https://gerrit.wikimedia.org/g/operations/puppet/+/refs/changes/21/1056221/3/modules/role/files/logging/logspam.pl already?

This could be a fix for this that only requires one of the following shell groups to get to mwlog1002.

profile::admin::groups:
  - deployment
  - restricted
  - mw-log-readers

Since you say "before I disrupt the deployment train" it sounds like you already have deployment access and this should come with it.

It first needs a sponsor from a wmf staff.

ok, I had some ideas of people to ask but I'm still trying to figure out what the criteria are exactly besides "wmf staff". I started with @Dzahn for continuity because he was involved with my NDA last time.

Since you say "before I disrupt the deployment train" it sounds like you already have deployment access and this should come with it.

No, I don't have shell access currently. maybe logstash wasn't exactly the right request but it came to mind since I had access to it previously and because that's where @Jdlrobson copied the stack trace from.

That was a reference to when I disrupted the train yesterday documented in T374394: TypeError: tests.values().toArray is not a function (Wikicurious_beat_en).

put this on hold for now. Will come back if I have a more solid plan for how I would use it regularly.