[18:11:52] <Southparkfan>	 hi, Cole has merged https://gerrit.wikimedia.org/r/c/operations/puppet/+/876248 (many thanks) and I'm planning to use it in Cloud VPS. Wondering if said setting is of any use in the production realm. What kind of applications/systems in production do log directly to centrallogXXXX:6514?
[18:15:07] <Southparkfan>	 I know there is a netdev kafka relay on 10514/tcp for syslog clients that cannot forward to kafka-logging (e.g. network equipment). Systems using rsyslog should forward to kafka via omkafka. Are there syslog clients running rsyslog that forward to 6514/tcp?
[20:24:45] <cwhite>	 Southparkfan: Most, if not all hosts in production forward their host syslog to centrallog servers.
[20:36:47] <Southparkfan>	 cwhite: right, what do they log to 6514/tcp? given that lookup_table_output.json contains either kafka or local for a given programname, is anything tagged with 'local' logged to disk AND centrallog (as long as a given message matches ($syslogseverity-text == 'info' and    $syslogfacility-text != 'cron' and    $syslogfacility-text != 'authpriv' and    $syslogfacility-text != 'mail))?
[20:52:52] <cwhite>	 All logs get forwarded except those matching those filters.  The 'local' tag only controls the logs that get written out locally.
[20:58:43] <Southparkfan>	 yep, I see it now. finally, 10514/tcp unconditionally uses omkafka (forward to kafka-logging) and 6514/tcp will only write to disk