MINOR: Add DEBUG level logs for successful/failed authentications wit…#5856
MINOR: Add DEBUG level logs for successful/failed authentications wit…#5856ijuma merged 3 commits intoapache:trunkfrom stanislavkozlovski:log-auth-failure-ips
Conversation
…h socket information
|
I think failed authentications should be |
|
Related JIRA for server side logging: https://issues.apache.org/jira/browse/KAFKA-5810 |
| channel.prepare(); | ||
| } catch (AuthenticationException e) { | ||
| if (channel.successfulAuthentications() == 0) | ||
| boolean isReAuthentication = channel.successfulAuthentications() > 0; |
There was a problem hiding this comment.
Nit: capitalization isn't quite right, see reauthenticationLatencyMs for example.
| sensors.failedAuthentication.record(); | ||
| else | ||
| sensors.failedReauthentication.record(); | ||
| log.debug("Address {} failed {}authentication ({})", |
There was a problem hiding this comment.
As per my PR comment, I think this should be info.
There was a problem hiding this comment.
Sorry, I must have missed it. As I stated originally, I was hesitant on what it should be. I'll change it to info
|
@omkreddy thanks for sharing that JIRA. It has the very reasonable suggestion of splitting the auth logs in log4j for configuration. |
| if (!isReauthentication) | ||
| sensors.failedAuthentication.record(); | ||
| else | ||
| sensors.failedReauthentication.record(); |
There was a problem hiding this comment.
Can we swap the if/else so that we don't have to negate the first if? That seems unnecessarily confusing.
…pache#5856) Use `info` for failed authentications and `debug` for successful ones. Reviewers: Rajini Sivaram <rajinisivaram@googlemail.com>, Ismael Juma <ismael@juma.me.uk>
3 participants
I believe that it'll be useful for debugging purposes to know which IP addresses are consistently failing authentication.
Applications that consistently fail authentication can introduce CPU pressure to the broker and as such, I think it is useful for Ops teams to have the needed information to quickly block.
I've left these logs on
DEBUGlevel since I presume that most common cases won't require to know this information. I'm sure we shouldn't log successful auths inINFObut I'm hesitant about unsuccessful authscc @rajinisivaram @ijuma @rondagostino