They use firehose-to-syslog as ingestor ...

https://github.com/logsearch/logsearch-for-cloudfoundry/blob/master/jobs/ingestor_cloudfoundry-firehose/templates/bin/ingestor_cloudfoundry-firehose_ctl#L71


Firehose to Syslog is pulling every 60s (default) the CC to get application
name and org and space name/.





On Thu, Jan 21, 2016 at 5:37 PM, Rosker, Matthias <matthias.rosker(a)sap.com>
wrote:

Yes – we use logsearch and logsearch-for-cloudfoundry bosh releases



*From:* Gwenn Etourneau [mailto:getourneau(a)pivotal.io]
*Sent:* Donnerstag, 21. Januar 2016 09:25
*To:* Discussions about Cloud Foundry projects and the system overall. <
cf-dev(a)lists.cloudfoundry.org>
*Subject:* [cf-dev] Re: Re: Re: Re: [cf 222] High number of log messages
on cloudcontroller



Are you using logsearch ?? or just normal ELK stack ?



On Thu, Jan 21, 2016 at 4:47 PM, Rosker, Matthias <matthias.rosker(a)sap.com>
wrote:

Hi Gwenn,

We use ELK connected through firehose ingestors for app logs and syslog
ingestors for cf logs. No firehose-to-syslog however.

Thanks



*From:* Gwenn Etourneau [mailto:getourneau(a)pivotal.io]
*Sent:* Donnerstag, 21. Januar 2016 01:37
*To:* Discussions about Cloud Foundry projects and the system overall. <
cf-dev(a)lists.cloudfoundry.org>
*Subject:* [cf-dev] Re: Re: [cf 222] High number of log messages on
cloudcontroller



Hi,



Are you using something like firehose-to-syslog ?



Thanks



On Thu, Jan 21, 2016 at 5:18 AM, Greg Cobb <gregmcobb(a)gmail.com> wrote:

This does not appear to be coming from a CF component or the CF CLI. We
don't see these requests on any of our instances.

For mitigations: You could try rotating your admin credentials and see who
complains.

Would it be useful if we added client ip to the logging?