Question

Your network automation platform runs nightly config-compliance jobs. The operations team requires two things: (1) every compliance check result must be persisted to the central rsyslog server for long-term audit retention, and (2) only critical drift events (severity CRITICAL) must instantly page the on-call engineer through the team's Slack channel. You are designing the Python logging configuration. Which approach best satisfies both requirements?

Accepted Answer

Attach a SysLogHandler at level INFO to the logger for all events, and attach a custom HTTP webhook handler with a level filter of CRITICAL that POSTs to the Slack incoming-webhook URL.

Answer

Attach only a SysLogHandler at level CRITICAL, then have rsyslog forward all messages it receives to the Slack webhook via an omhttp output module.

Answer

Attach a single StreamHandler at level DEBUG and rely on the container runtime to split stdout between the syslog collector and the Slack integration.

Answer

Attach a webhook handler at level INFO to Slack and a SysLogHandler at level CRITICAL, so Slack captures the full audit trail and syslog stores only critical events.