I'm not sure when this stopped working but right now keystone isn't logging to ELK. This may have to do with shifts in the wsgi setup.
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| P:rsyslog: Update Keystone unit file names | operations/puppet | production | +2 -3 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | Andrew | T379550 openstack: keystone may be failing to add users to the bastion project in Keystone and/or LDAP | |||
| Open | Andrew | T421911 Keystone logs no longer appearing in logstash |
Event Timeline
Comment Actions
The root of this seems to be that keystone has stopped logging with the name 'keystone,' instead using the name '<frozen importlib._bootstrap>'
Apr 10 20:59:53 cloudcontrol2010-dev uwsgi_python3[2914150]: <frozen importlib._bootstrap>: 2026-04-10 20:59:53.175 2914150 WARNING oslo_policy.policy [None req-654a5261-4eb5-4528-af6b-0e8a4667d53e novaobserver observer - - default default] Policy Rules ['identity:list_domains_for_user', 'identity:list_projects_for_user'] specified in policy files are the same as the defaults provided by the service. You can remove these rules from policy files which will make maintenance easier. You can detect these redundant rules by ``oslopolicy-list-redundant`` tool also.
why, keystone?
Comment Actions
There isn't very much more info though I opened T422830: Openstack uwsgi logging to '<frozen importlib._bootstrap>.log'
Comment Actions
Change #1270452 had a related patch set uploaded (by Majavah; author: Majavah):
[operations/puppet@production] P:rsyslog: Update Keystone unit file names
Comment Actions
Change #1270452 merged by Andrew Bogott:
[operations/puppet@production] P:rsyslog: Update Keystone unit file names