Current logging in Keystone does not enable operators to determine what is happening

[Henry Nash]

Our current logging is meant to provide different levels so that operators can enable a suitable level (e.g. INFO) without going full DEBUG (which operators consider potentially risky). INFO doesn't, however, give you anything consistent.

Keystone should follow the OpenStack standard: https://wiki.openstack.org/wiki/LoggingStandards

Examples of things we might like to have at INFO level:
- How is this keystone doing?
- % of requests success/failed
- % of failures at the backend (e.g. to SQL/LDAP etc.)
- % of requests that return validation error (e.g. indicative of an attack/bad clients)

[Morgan Fainberg (mdrnstm)]

Since keystone is run in a webserver (apache in most cases), a lot of this information is already available, but needs log processing to work. The failures to the backend (SQL/LDAP) is the biggest place we can improve and the validation errors can be emitted.

I am against trying to track % of failures, that is a log processing tool's job, and we are running across multiple processes that will occasionally be cycled, keeping that data coherent is difficult on a good day and there are tools (ELK, Splunk, Hadoop) that can all be leveraged to bundle all these lines up into something that is much more readable/usable.

Unfortunately we will be the odd-one-out in that we will be logging things twice -- Once at the apache layer (aka access.log) and once that is the actual log from keystone. Both of these are useful as they indicate different things in different ways.

So in short:

Not % of requests [that isn't part of the linked logging standard].

If we make it so that the "Security Exception" is more verbose to the log (it needs to be opaque when rendered to the end-user) we can make keystone much more useful logging wise for operators immediately. Most of the security exception stripping is only important rendering to the end user.

[Morgan Fainberg (mdrnstm)]

Can we split this out into actionable things instead of a "this isn't useful like it is"?

I'm going to mark this as incomplete - lets update this with clear actionable changes so we know what we're aiming for.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]