LOG Meeting Minutes 2019-06-25

Agenda

• Dublin release - made good process for the past couple of weeks but still waiting for the release notes update from 3 teams
• After some effort for the past week or so, logging project (include POMBA) is good for Dublin sign-off
• El Alto will be “Reduce Internal Debt” release, will be grooming the backlog within this week.  
• POMBA Dublin Demos
• use cases to showcase the capability of logging and logging specification (please use the comment section for your ideas)

Attendees

1. Artem Naluzhnyy 
2. Dave Williamson 
3. Lorraine Welch 
4. Sanjay Agraharam
5. Luke Parker 

Notes

• Prudence Au not available today.
• Reviewed Lorraine's analysis of POMBA logs:
  • An encouraging number of attributes populated.
  • InvocationID possibly unset.
  • Looked like the provider config still explicitly specified MDCs by name with %X{name}, so that's a pre-Amsterdam configuration.
• Canonical examples:
  • No truly canonical examples. POMBA is probably among the best.
  • We've had past success identifying flows from SO/APPC/SDNC output:
    • What they execute is of interest in analytics (in a way that SDC, for example, is less interesting). 
    • It took a lot of finessing, though, to allow for differences in naming, missing data, etc.
    • Action on Luke Parker to do a little analysis and summarize at the next meeting.
  • Regarding what canonical looks like:
    
    • The spec:
      • Is still daunting. 
      • Understandably nobody is eager to reopen this issue.
      • But it probably couldn't hurt to separate out and emphasize the 1/3 (~10) or so that are critical.
    • The pipeline:
      • Filebeat was meant to be temporary, in response to:
        • EELF, and no authority to bypass logfiles.
        • Heterogeneous logging provider types and versions.
        • The impossibility of getting fancier transports into the classpath for every provider in every Java runtime in every container. 
      • But if we can reconfigure the pipeline, then:
        • The output format won't necessarily matter, because we can ship logs in a structured format: syslog, logstash, JSON, etc. 
        • Then Filebeat can be optional, and maybe can even cease to be enabled by default.
        • This has a much better ROI than fussing over formats. 
        • (It's noteworthy that we've made it so far without even minimal extension points).
      • Spoke to Borislav Glozman and Mike Elliottand Avi Chapnick from  OOM about this: 
        • About making the Filebeat sidecar optional in deployment manifests. 
        • About allowing provider configuration docs to be replaced (and thereby to enable other transports):
          • Individually. 
          • En masse. 
        • And their response was that they're working on generating manifests, which:
          • Could allow these kinds of changes to be made without nearly so much busy work. 
          • But which also means coordination and delays. 
        • Should try to get Mike Elliott along next time.
• Next meeting: July 9, 2019