MediaWiki UDP logging

Logstash

Some logs are being sent over UDP to the rsyslog process. The rsyslog process runs in a sidecar (Kubernetes) or on the host itself. rsyslog may or may not forward the logs to Logstash.

udp2log

See also: Logs#mwlog:/srv/mw-log/ and Mwlog

Most logs are sent over UDP to the udp2log aggregator. The udp2log aggregator is an mwlog host, which will write the log files to `/srv/mw-log`. See this page for an overview of the directory. See this page for the technical setup of the ud2plog aggregator on mwlog hosts.

The udp2log aggregator is configured per realm in the udp2log in the "Services" configuration file:

Production: in wmf-config/ProductionServices.php, with a dedicated host per data center;
Beta Cluster: in wmf-config/LabsServices.php.