[11:47:19] <hashar>	 hi, we have a mysterious puppet failure on a WMCS instance:
[11:47:21] <hashar>	 `valuation Error: Unknown function: 'puppetdb_query'. (file: /etc/puppet/modules/wmflib/functions/resource/hosts.pp, line: 33, column: 5)`
[11:47:27] <hashar>	 filed as https://phabricator.wikimedia.org/T311240
[11:48:16] <hashar>	 maybe cause there is no puppetdb
[12:08:51] <hashar>	 well that might be an issue with the WMCS puppetmaster :D
[12:13:34] <XioNoX>	 mutante: https://phabricator.wikimedia.org/T311290 was the reason, should be good now
[17:34:38] <brett>	 Was the hetzner abuse email from 2022-06-18 dealt with? What's the typical SOP for that?
[18:10:59] <mutante>	 XioNoX: ah! thank you. ack
[18:14:55] <mutante>	 brett: the "network-abuse" "portscan detected" ones from Hetzner?
[18:18:11] <mutante>	 back in 2018 Arzhel took the time to tell them that "This seems to be a false positive due to a miss-configuration of your monitoring tool. ..The logs show legitimate return TCP (HTTP) traffic from your users hitting our webserver.".  Then at some point they mayormay not have fixed that configuration.. but that is probably some IP whitelist and this time they get the (new) drmrs IP
[18:20:11] <XioNoX>	 the last one surprisingly matches an alert from fastnetmon "Possible DDoS to irb-611.asw1-b12-drmrs.wikimedia.org 185.15.58.1"
[18:21:16] <XioNoX>	 so either someone spoofed their IPs, or the DDoS comes from some of their servers :)
[18:26:50] <mutante>	 btullis: that message above.. about 'mutante: https://phabricator.wikimedia.org/T311290 was the reason" that should mean you can try the makevm coookbook now