cfn-push-stats shoud not log to /var/log by default (or should at least be configureable)

[Lars Kellogg-Stedman]

Attempting to run `cfn-push-stats` as a non-root user invariably results in:

    IOError: [Errno 13] Permission denied: '/var/log/cfn-push-stats.log'

A command line tool like cfn-push-stats should probably *not* be logging into /var/log by default...this prohibits running the command from anything other than the root account. At the very least, running "cfn-push-stats --help" ought to succeed even absent write access to the log file.

cfn-push-stats should probably just log to stderr by default, and should support a --log-file option for directing that output to a file.

[Qiming Teng (tengqim)]

Don't fully agree with this assessment. We may need to consider that a non-root may use this tool to fake metrics or even launch a DOS attack. If only a root can do this, then the logging in /var/log directory won't be a problem.

On the other hand, making the log output configurable is acceptable. But if that is the reported issue, we may need to change the subject of this report.

[Lars Kellogg-Stedman (larsks)]

I don't think making cfn-push-stats root-excutable only is going to buy you anything in terms of security. If I want to fake metrics or launch a DOS attack, I can use 'curl'. Or 'python'.

With regard to logging: because cfn-push-stats is a command line tool, not a background server, I think it makes much more sense to make the default log destination be stderr. As it is, failures can be hard to diagnose...is it hanging because it can't connect? Because it's retrying after an error? Having immediate feedback on things like this would make problems more obvious.

I have updated the subject to something that I hope is more accurate.