Logfile gets spammed with Unauthorized errors

[jugmac00]

In an attempt to move forward to Zope 4 / Python 3, I replaced the existing authentication stack (CookieCrumbler/SimpleUserFolder/CMFCore) with PluggableAuthService.

It works as expected, but since then Zope's event log gets spammed with following error messages:

2019-09-09T00:22:36 ERROR Zope.SiteErrorLog 1567981356.420.711694499813 https://xxx.xxx.de/index_html
Traceback (innermost last):
  Module ZPublisher.Publish, line 127, in publish
  Module ZPublisher.BaseRequest, line 623, in traverse
  Module ZPublisher.HTTPResponse, line 756, in unauthorized
Unauthorized: You are not authorized to access this resource.

There are three main "causers" for these log entries:

• pingdom check
• nagios check
• regular users which are logged out

I can and did update the url for the uptime checks to something like: https://xxx.xxx.de/acl_users/cookie_auth/login_form which then throws no more error.

Obviously, I cannot tell my users to type that long url - they usually just enter the domain.

Why do unauthorized exceptions now get logged? And is there anything I can do to prevent these messages?

Configuration:

• PluggableAuthService
• challenge chooser -- browser => cookie_auth -- xml-rpc => http auth / basic auth

[dataflake]

Just go to the error_log object and add Unauthorized to the list of ignored exceptions.

[jugmac00]

@dataflake Thanks a lot for this quick and obviously perfect answer.

I just updated the error_log object and I see no more new Unauthorized errors in my log file.

I'd like to wait a couple of hours, and if no more occurrences appear, I'll close this ticket.

P.S.: I will have a look at the documentation and maybe add a paragraph about how to silence the log entries.

[dataflake]

By the way, the reason you see those now and not before is simply a difference in processing when an Unauthorized is being hit. The other code simply swallowed those and never let them propagate. There's no right or wrong here and nothing to worry about, it's just different.

I have never found any good reason to not ignore Unauthorized in the error log. And if you need to debug them just take them out of that ignore list for a time.

[jugmac00]

• no more entries in my log file
• I updated Zope's documentation about SiteErrorLog, as it did not mention that you can silence unwanted exceptions - see https://github.com/zopefoundation/Zope/pull/697
• once again, thank you very much for your quick answer, also especially for your follow up