Page MenuHomePhabricator

Configure logstash error checks for automated supervision of Pretrain deployments
Open, HighPublicFeature

Description

With the introduction of a new testwiki-targeted httpbb test suite in sibling task T428972, we'll now have active probes to evaluate health of the Pretrain environment during deployments. The other half of our automated supervision plan is to introduce logstash checks for the canaries and production deployment stages.

Specifically, we will need to add:

  • Two new logstash checks with error thresholds appropriate for testwiki during the canaries and production stages, respectively. These values will need to be inferred from historical data for errors with wiki: testwiki in some way (i.e., presumably requiring some modifications to scap analyze-logstash in order to support filtering on the wiki field).
    • Note: Unlike scope: train, where canaries capacity (and thus share of traffic) is ~ 3% of total production-stage capacity, expect that scope: pretrain will instead be up to 25% in the near term.
  • A new logstash check targeting scope: train during the scope: pretrain production stage, using the same production-stage threshold as used elsewhere (150 errors). This will function as our backstop "system-wide health" signal.

See also TODOs in https://gerrit.wikimedia.org/r/1327168.

Open question: As a separate matter that we may want to keep in mind (but does not block this work), we may want to assess whether a canary_wait_time of 20s is appropriate / viable for Pretrain given the modest amount of traffic testwiki receives. This is primarily relevant to unattended deployments (i.e., timers) which are a bit less latency sensitive than human-attended ones (e.g., backports).

Details

Related Changes in Gerrit:
Related Changes in GitLab:
TitleReferenceAuthorSource BranchDest Branch
scap analyze-logstash: Make output more informativerepos/releng/scap!1339dancymaster-Ib993fd6f66dc8766bfbdffbc0905167cf0cab07cmaster
logstash: Match the fields of a query exactlyrepos/releng/scap!1313dancymaster-I308f9e5853d3583d43c38ae4ccd403bacb61b392master
logstash_checker.py: Do not update the release repositoryrepos/releng/scap!1278dancymaster-I35355f3d7c18161f2d313c1ecf9735eca02b7f0emaster
logstash_checker.py: Add --wiki and --scope to scap analyze-logstashrepos/releng/scap!1276dancymaster-I13b41f075dc725b8c49e4f9238851eb2fea56cebmaster
Customize query in GitLab

Event Timeline

• Scott_French changed the subtype of this task from "Task" to "Feature Request".

dancy merged https://gitlab.wikimedia.org/repos/releng/scap/-/merge_requests/1276

logstash_checker.py: Add --wiki and --scope to scap analyze-logstash

dancy@deploy1003:~$ scap analyze-logstash --scope pretrain canaries
14:55:32 Analyzing logstash history for scope: pretrain, stage: canaries, wiki: (all)
14:55:35 Initial                : #samples: 34855, min: 1, mean: 8.91, stdev: 151.69, max: 4421
14:55:35 After removing outliers: #samples: 34783, min: 1, mean: 2.32, stdev: 7.88, max: 435
14:55:35 Suggested alert threshold for stage canaries: 26 (zscore=3.00)
14:55:35 That would trigger for 507 of 34855 samples (1.45%)
dancy@deploy1003:~$ scap analyze-logstash --scope pretrain production
21:57:48 Analyzing logstash history for scope: pretrain, stage: production, wiki: (all)
21:57:56 Initial                : #samples: 322826, min: 1, mean: 8.20, stdev: 89.29, max: 24153
21:57:57 After removing outliers: #samples: 322140, min: 1, mean: 6.07, stdev: 16.10, max: 276
21:57:57 Suggested alert threshold for stage production: 55 (zscore=3.00)
21:57:57 That would trigger for 6571 of 322826 samples (2.04%)

I think the work left here is putting the thresholds @dancy computed above into the config. Is that a patch you can prepare @dancy?

• bd808 raised the priority of this task from Medium to High.Aug 28 2026, 11:38 PM

Change #1333296 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):

[operations/puppet@production] kubernetes.yaml: Add logstash_check settings to mw_deployments

https://gerrit.wikimedia.org/r/1333296

I think the work left here is putting the thresholds @dancy computed above into the config. Is that a patch you can prepare @dancy?

https://gerrit.wikimedia.org/r/c/operations/puppet/+/1333296 has been prepared.

Change #1333296 merged by Scott French:

[operations/puppet@production] kubernetes.yaml: Add logstash_check settings to mw_deployments

https://gerrit.wikimedia.org/r/1333296

Mentioned in SAL (#wikimedia-operations) [2026-09-03T19:16:47Z] <swfrench@deploy1003> Started scap sync-world: Noop deployment to validate pretrain logstash check configuration - T435419

Mentioned in SAL (#wikimedia-operations) [2026-09-03T19:19:46Z] <swfrench@deploy1003> Finished scap sync-world: Noop deployment to validate pretrain logstash check configuration - T435419 (duration: 02m 59s)

No issues encountered during a test deployment that exercised the new checks. Thanks for those!

One oddity I'm having a hard time explaining, though:

19:19:24 Finished production-check-commands (duration: 00m 04s)
19:19:24 Waiting 20 seconds for production traffic...
19:19:44 Logstash checker counted 8 error(s) in the last 20 seconds. OK.
19:19:44 Logstash checker counted 7 error(s) in the last 20 seconds. OK.
19:19:44 Running purgeMessageBlobStore.php

I was a bit surprised when I saw that only two check results were reported in the production stage, when there's really 3 checks ostensibly configured.

I then realized that 2 of 3 have exactly the same parameters, and thus resolve to LogstashCheck instances that would compare identically and be deduplicated. That's WAI.

I was happy with that explanation until I realized that both check results report non-zero errors. The pretrain-targeted check should observe zero errors, since there's no organic traffic there, and the synthetic workload from the production httpbb check is known-good. Further:

  1. There's nothing in logstash.
  2. The numbers are close enough to suggest they're running the same query, albeit sampling slightly different time windows.

@dancy - Is it possible something odd is happening with the logstash query construction here?

Huh ... Odd. Yeah, if I'm understanding these scap logs correctly, it looks like this query is producing this result, which clearly contains mw-web entries.

Fresh figures:

(scap-venv) dancy@deploy1003:~/src/scap$ bin/run-dev-scap analyze-logstash canaries --wiki testwiki
21:16:46 Analyzing logstash history for scope: (all), stage: canaries, wiki: testwiki
21:16:46 Initial                : #samples: 111, min: 1, mean: 6.90, stdev: 7.33, max: 35
21:16:46 After removing outliers: #samples: 109, min: 1, mean: 6.42, stdev: 6.46, max: 26
21:16:46 Suggested alert threshold for stage canaries: 26 (zscore=3.00)
21:16:46 That would trigger for 3 of 111 samples (2.70%)


(scap-venv) dancy@deploy1003:~/src/scap$ bin/run-dev-scap analyze-logstash production --wiki testwiki
21:16:52 Analyzing logstash history for scope: (all), stage: production, wiki: testwiki
21:16:52 Initial                : #samples: 1224, min: 1, mean: 5.89, stdev: 20.95, max: 128
21:16:52 After removing outliers: #samples: 1190, min: 1, mean: 2.45, stdev: 4.70, max: 60
21:16:52 Suggested alert threshold for stage production: 17 (zscore=3.00)
21:16:52 That would trigger for 60 of 1224 samples (4.90%)
thcipriani subscribed.

Assigning to @dancy as he's been preparing changes for @Scott_French 's review.

Change #1345206 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):

[operations/puppet@production] kubernetes.yaml: Revise pretrain logstash thresholds

https://gerrit.wikimedia.org/r/1345206

@dancy - Thanks for performing this analysis, fixing the logstash query filter, and preparing the patch to update the thresholds.

A couple of thoughts:

First, it's surprising that the threshold computed for canaries-phase releases, which serve ~ 3% of traffic for the relevant services, is much higher than that computed for the production-phase releases (~ 97% of traffic served). Is it possible that the computation somehow excludes time buckets with zero error counts, thus biasing the resulting stats? [0] That would also explain why the sample counts are off by a factor of 10.

If so, I realize this may have always been true, but only becomes apparent when using --wiki (i.e., errors are nearly always happening, but across wikis).

Second, the thresholds computed here will implicitly reflect those fractions of traffic - i.e., roughly 3% and 97% - given where testwiki currently serves. What we'll want to do is scale those thresholds in a way that makes sense given the fractions we'll have in Pretrain - those aren't set in stone yet, but they're likely to be in the range of ~ 20% and 80%.

[0] Of course, a canaries-phase threshold that's higher than production-phase would also happen if we frequently detect noisy regressions in canaries, and revert them before reaching production. That's not the case, AFAIK.

We spent some time looking into this yesterday and we came away with a few thoughts that I'll summarize:

  • canary error rate > production error rate -- no longer true when we ran the same check from Sep 9 on Sep 29. Some bucket skewing the mean/stddev must've aged out.
  • numbers funky -- we're asking logstash for 90d of 20s buckets, but getting back a smaller number, and the number logstash gives us is different than the number scap gives us @dancy to investigate
  • canary vs. a control -- since we deploy to canary release before main release, main release can act as a control, but we need to compare ratios of errors/traffic for each environment vs. absolute thresholds.
  • static backstop -- the spikes in error rates scap currently uses are still useful and should be kept.
  • seek outside expertise -- detecting rises in error rates is tricky, and we may be reinventing the wheel here. Maybe there are existing detection mechanisms in our o11y stack.

Tagging in SRE Observability for a question: SRE Observability, is there something that exists in our alerting infrastructure that can detect spikes in error rates (beyond just a static threshold we set)?

We're trying to detect a spike in error rate following a deployment and we wonder if we're re-inventing the wheel. Is there anything in our o11y infrastructure that can detect anomalies in the rate of a subset of log messages (without writing custom code that lives in scap)?

Any thoughts/opinions ya'll have about this would be welcome and helpful. We can get you more specifics if you need; I describe the high-level below for convenience.


Context for this question (so you don't have to read this whole task):

  • Scap tries to detect error rate spikes on canaries during deployment
  • We do this by:
    • deploy canaries
    • wait 20 seconds
    • ask logstash for MediaWiki errors over the last 20 seconds
    • fail deploy if (error rate last 20 seconds > static threshold)
  • Static threshold = mean 20 second error rate + 3σ 20 second error rate
    • Derived from: ask logstash for MediaWiki errors over last 90 days in 20 second buckets, take mean/stddev of the non-empty buckets, static_threshold=mean+3σ.

Problems:

  • This catches big changes in error rate, but the same process on a single, low-traffic wiki (this task) has resulted in numbers we're unsure about.
  • Mean + 3σ assumes a normal distribution of errors. But the 90d window is bursty (especially for a single wiki) and can be skewed by an incident within the window.

Update analysis below. It still works the same as before. It just reports more information. The numbers have changed since time has passed.

(scap-venv) dancy@deploy1003:~/src/scap$ bin/run-dev-scap analyze-logstash canaries --wiki testwiki
20:03:53 Analyzing logstash history for scope: (all), stage: canaries, wiki: testwiki
20:03:54 Percentiles of every window with an error: 50th: 1, 75th: 1, 90th: 5, 95th: 5, 99th: 7, max: 7
20:03:54 Windows with 0 or more errors: 388800, over 90 days, 20 seconds each
20:03:54 Windows with 1 or more errors:     51
20:03:54 Windows with 5 or more errors:      7
20:03:54 Windows with 7 or more errors:      1
20:03:54 Initial                : #error-windows: 51, mean: 1.71, stdev: 1.53, max: 7
20:03:54 Outliers               : 1 error-windows at or above 6.29 (zscore=3.00), max: 7
20:03:54 After removing outliers: #error-windows: 50, mean: 1.60, stdev: 1.34, max: 5
20:03:54 Suggested alert threshold for stage canaries: 6 (zscore=3.00)
20:03:54 That would trigger for 1 of 51 error-windows, or 1 of 388800 windows


(scap-venv) dancy@deploy1003:~/src/scap$ bin/run-dev-scap analyze-logstash production --wiki testwiki
20:04:02 Analyzing logstash history for scope: (all), stage: production, wiki: testwiki
20:04:03 Percentiles of every window with an error: 50th: 1, 75th: 2, 90th: 5, 95th: 15, 99th: 128, max: 128
20:04:03 Windows with   0 or more errors: 388800, over 90 days, 20 seconds each
20:04:03 Windows with   1 or more errors:   1324
20:04:03 Windows with   2 or more errors:    407
20:04:03 Windows with   5 or more errors:    168
20:04:03 Windows with  15 or more errors:     72
20:04:03 Windows with 128 or more errors:     33
20:04:03 Initial                : #error-windows: 1324, mean: 5.55, stdev: 20.18, max: 128
20:04:03 Outliers               : 34 error-windows at or above 66.08 (zscore=3.00), max: 128
20:04:03 After removing outliers: #error-windows: 1290, mean: 2.37, stdev: 4.54, max: 60
20:04:03 Suggested alert threshold for stage production: 16 (zscore=3.00)
20:04:03 That would trigger for 64 of 1324 error-windows, or 64 of 388800 windows

Change #1345206 merged by Scott French:

[operations/puppet@production] kubernetes.yaml: Revise pretrain logstash thresholds

https://gerrit.wikimedia.org/r/1345206