Get traffic logs to appear for Azure apps

[afeld]

User story: As a developer on the Benefits app, I need to see logs appear for the Benefits app to help with troubleshooting.

To Reproduce

There are various places to see (and various ways to configure?) logs in Azure. Click into each of the following:

• Log Analytics workspaces
• Log stream
• (Diagnostic?) logs

All seem to be empty, or at least not showing as much as I would expect.

Expected behavior

I expect to see logs similar to what appears locally when running the server, e.g.

[01/Jun/2022 00:07:43] INFO django.server:161 "GET /abc HTTP/1.1" 200 9414

Additional context

• Possible there are Azure permissions issues at play here.
• One solution may be to send application logs the same way we send errors for Set up error monitoring #448: through OpenCensus to Azure Monitor

[thekaveman]

I'm under the impression this is a permissions thing. I traded a few emails with DevSecOps regarding the dev subscription logs; when we screenshared they were able to see what you're describing using the (Diagnostic?) logs (specifically the AppServiceConsoleLogs option there). But it shows up blank for me.

[thekaveman]

I can query AppServiceHTTPLogs
from the Logs interface and get results for actual app traffic:

AppServiceHTTPLogs 
| where CsUriStem != "/healthcheck" and UserAgent != "AlwaysOn"

I cannot see AppServiceConsoleLogs from the same interface (this should be stdout and stderr from our container, so everything):

AppServiceConsoleLogs

Asked @cal-itp/cdt-devsecops team about this, they are looking into permissions/settings etc.

[thekaveman]

This article talks about Configuring a custom container for Azure App Service (which is our use-case).

The section on Access Diagnostic Logs says:

You can access the console logs generated from inside the container.

First, turn on container logging by running the following command:

az webapp log config --name <app-name> --resource-group <resource-group-name> --docker-container-logging filesystem

Try this configuration next.

[thekaveman]

I don't have permissions to run this command. Sent to @cal-itp/cdt-devsecops team to see if they can run it.