cert-checker: only log database errors

[aarongable]

Fixes #7040

[jsha]

Code looks good. The original issue said the expected result was "Don't increment the bad-certs, instead put the errors into their own counters." @jcjones how do you feel about only logging the database errors, and not maintaining a separate counter of database errors?

[jcjones]

Code looks good. The original issue said the expected result was "Don't increment the bad-certs, instead put the errors into their own counters." @jcjones how do you feel about only logging the database errors, and not maintaining a separate counter of database errors?

It looks like when there's a database error, the checker moves forward and ultimately returns a smaller count of good-certs, which I'm realizing this morning I need to have monitoring for (IN-9580). When that fires, we'd notice the database error logs.

Or we could write an mtail alert for the database error logs, but that's not my favorite choice; mtail isn't currently running against these logs.

Anyway, I'd still prefer that the database error count be a metric that we send to the prometheus pushgateway API, but I'm fine with that being a backlogged issue.

[aarongable]

Unfortunately cert-checker is not a long-lived process, so I don't think that exporting metrics from it directly works very well, since it can't be reliably scraped. I now have it output the number of database errors as a separate field in the "report" it logs at the end of its run, but I think that's the best we can do at the moment.