s3api doesn't log internal requests

Bug #1853884 reported by clayg
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Object Storage (swift)
New
Undecided
Unassigned

Bug Description

We have an option that you can turn on in the [filter:s3api] section:

# By default, Swift reports only S3 style access log.
# (e.g. PUT /bucket/object) If set force_swift_request_proxy_log
# to be 'true', Swift will become to output Swift style log
# (e.g. PUT /v1/account/container/object) in addition to S3 style log.
# Note that they will be reported twice (i.e. s3api doesn't care about
# the duplication) and Swift style log will includes also various subrequests
# to achieve S3 compatibilities when force_swift_request_proxy_log is set to
# 'true'
# force_swift_request_proxy_log = false

But the name doesn't match the implementation well.

In s3request:S3AclRequest.authenticate we make a odd little subrequest and tell a white lie unconditionally:

        sw_req = self.to_swift_req('TEST', None, None, body='')
        # don't show log message of this request
        sw_req.environ['swift.proxy_access_log_made'] = True

And then later when it was realized this had the side-effect of supressing ALL subrequests based on this environ, we added a odd kludge in s3request:S3Request.to_swift_req:

        if self.force_request_log:
            env['swift.proxy_access_log_made'] = False

Which allows us to still suppress the logging for TEST requests, but still get to see the REST of the subrequests again.

It's really confusing to operate and difficult to develop s3api without proper logging of swift sub-requests. There's a lot of potential to mask and miss problems. We already default this option to True on the clusters we deploy - I think the upstream default should definitely change.

But perhaps better would be to flip the option around, something more like:

# By default Swift will not log s3api authenticate TEST subrequests to keep
# chatter down for a better signal to noise ratio, but if you happen to be
# developing/operating on an auth middleware that interacts with s3api ACLs
# you can turn this off for better logging visibility.
# suppress_authenticate_test_request_logging = true

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.