Last modified: 2014-04-21 18:47:11 UTC
Although requests from ssl terminators are visible in the udp2log stream when consuming directly, and also in the edit tsvs [1], none are visible in the sampled-1000 tsv [2] or the mobile-sampled-100 tsvs [3]. Due to the numbers exposed by the edit tsv we'd expect >1000 lines/day from ssl terminators in the sampled-1000 tsvs, and >500 lines/day in the mobile-sampled-100 tsvs due to the edit requests alone. Are those two streams suffering the same problem as edit tsvs suffered before 2014-01-14 (bug 60314)? Let's get the ssl requests into the sampled-1000 and mobile-sampled-100 tsvs! (I've been told sampled-1000 is collected independently on two different hosts. Is the one that does not get mirrored to stat1002 also affected? Not sure which those hosts are. The udp2log filters live in https://git.wikimedia.org/tree/operations%2Fpuppet/production/templates%2Fudp2log ) [1] ___________________________________________________________ qchris@stat1002 // 0 // 00:36:41 cwd: ~ zgrep -c '^ssl' /a/squid/archive/edits/edits.tsv.log-20140121.gz 1358968 [2] ___________________________________________________________ qchris@stat1002 // 0 // 22:14:02 cwd: ~ zgrep -c '^ssl' /a/squid/archive/sampled/sampled-1000.tsv.log-201401*.gz /a/squid/archive/sampled/sampled-1000.tsv.log-20140101.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140102.gz:0 [...] /a/squid/archive/sampled/sampled-1000.tsv.log-20140113.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140114.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140115.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140116.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140117.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140118.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140119.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140120.gz:0 /a/squid/archive/sampled/sampled-1000.tsv.log-20140121.gz:0 [3] ___________________________________________________________ qchris@stat1002 // 0 // 22:47:06 cwd: ~ zgrep -c '^ssl' /a/squid/archive/mobile/mobile-sampled-100.tsv.log-201401*.gz /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140101.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140102.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140103.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140104.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140105.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140107.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140108.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140109.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140110.gz:1 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140111.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140112.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140113.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140114.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140115.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140116.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140117.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140118.gz:0 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140119.gz:1 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140120.gz:2 /a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140121.gz:0 The four matches from the 201401{10,19,20} files are artifacts from an ssl terminator request line being too long and getting messed up with a subsequent mobile request line.
ottomata said that nginx might log only to gadolinium, while sampled-1000 gets written only on emery.
Prioritization and scheduling of this bug is tracked on Mingle card https://wikimedia.mingle.thoughtworks.com/projects/analytics/cards/cards/1399