diff --git a/keystone/assignment/core.py b/keystone/assignment/core.py
index c7ca2ebf8..acf7d43d3 100644
--- a/keystone/assignment/core.py
+++ b/keystone/assignment/core.py
@@ -222,7 +222,7 @@ class Manager(manager.Manager):
                 config.CONF.member_role_id)
         except exception.RoleNotFound:
             LOG.info(_("Creating the default role %s "
-                       "because it does not exist.") %
+                       "because it does not exist."),
                      config.CONF.member_role_id)
             role = {'id': CONF.member_role_id,
                     'name': CONF.member_role_name}
diff --git a/keystone/catalog/backends/templated.py b/keystone/catalog/backends/templated.py
index eb37dbf9e..fee38367e 100644
--- a/keystone/catalog/backends/templated.py
+++ b/keystone/catalog/backends/templated.py
@@ -104,7 +104,7 @@ class TemplatedCatalog(kvs.Catalog):
         try:
             self.templates = parse_templates(open(template_file))
         except IOError:
-            LOG.critical(_('Unable to open template file %s') % template_file)
+            LOG.critical(_('Unable to open template file %s'), template_file)
             raise
 
     def get_catalog(self, user_id, tenant_id, metadata=None):
diff --git a/keystone/catalog/core.py b/keystone/catalog/core.py
index e988d0c41..f37793128 100644
--- a/keystone/catalog/core.py
+++ b/keystone/catalog/core.py
@@ -39,19 +39,19 @@ def format_url(url, data):
     except AttributeError:
         return None
     except KeyError as e:
-        LOG.error(_("Malformed endpoint %(url)s - unknown key %(keyerror)s") %
+        LOG.error(_("Malformed endpoint %(url)s - unknown key %(keyerror)s"),
                   {"url": url,
-                   "keyerror": str(e)})
+                   "keyerror": e})
         raise exception.MalformedEndpoint(endpoint=url)
     except TypeError as e:
         LOG.error(_("Malformed endpoint %(url)s - unknown key %(keyerror)s"
-                    "(are you missing brackets ?)") %
+                    "(are you missing brackets ?)"),
                   {"url": url,
-                   "keyerror": str(e)})
+                   "keyerror": e})
         raise exception.MalformedEndpoint(endpoint=url)
     except ValueError as e:
-        LOG.error(_("Malformed endpoint %s - incomplete format \
-                  (are you missing a type notifier ?)") % url)
+        LOG.error(_("Malformed endpoint %s - incomplete format "
+                    "(are you missing a type notifier ?)"), url)
         raise exception.MalformedEndpoint(endpoint=url)
     return result
 
diff --git a/keystone/common/cache/core.py b/keystone/common/cache/core.py
index 0a8da7071..c95e42009 100644
--- a/keystone/common/cache/core.py
+++ b/keystone/common/cache/core.py
@@ -47,31 +47,31 @@ class DebugProxy(proxy.ProxyBackend):
 
     def get(self, key):
         value = self.proxied.get(key)
-        msg = _('CACHE_GET: Key: "%(key)s" Value: "%(value)s"')
-        LOG.debug(msg % {'key': repr(key), 'value': repr(value)})
+        LOG.debug(_('CACHE_GET: Key: "%(key)r" Value: "%(value)r"'),
+                  {'key': key, 'value': value})
         return value
 
     def get_multi(self, keys):
         values = self.proxied.get_multi(keys)
-        msg = _('CACHE_GET_MULTI: "%(keys)s" Values: "%(values)s"')
-        LOG.debug(msg % {'keys': repr(keys), 'values': repr(values)})
+        LOG.debug(_('CACHE_GET_MULTI: "%(keys)r" Values: "%(values)r"'),
+                  {'keys': keys, 'values': values})
         return values
 
     def set(self, key, value):
-        msg = _('CACHE_SET: Key: "%(key)s" Value: "%(value)s"')
-        LOG.debug(msg % {'key': repr(key), 'value': repr(value)})
+        LOG.debug(_('CACHE_SET: Key: "%(key)r" Value: "%(value)r"'),
+                  {'key': key, 'value': value})
         return self.proxied.set(key, value)
 
     def set_multi(self, keys):
-        LOG.debug(_('CACHE_SET_MULTI: "%s"') % repr(keys))
+        LOG.debug(_('CACHE_SET_MULTI: "%r"'), keys)
         self.proxied.set_multi(keys)
 
     def delete(self, key):
         self.proxied.delete(key)
-        LOG.debug(_('CACHE_DELETE: "%s"') % repr(key))
+        LOG.debug(_('CACHE_DELETE: "%r"'), key)
 
     def delete_multi(self, keys):
-        LOG.debug(_('CACHE_DELETE_MULTI: "%s"') % repr(keys))
+        LOG.debug(_('CACHE_DELETE_MULTI: "%r"'), keys)
         self.proxied.delete_multi(keys)
 
 
@@ -145,7 +145,7 @@ def configure_cache_region(region):
             # ProxyBackends work, see the dogpile.cache documents on
             # "changing-backend-behavior"
             cls = importutils.import_class(class_path)
-            LOG.debug(_('Adding cache-proxy \'%s\' to backend.') % class_path)
+            LOG.debug(_("Adding cache-proxy '%s' to backend."), class_path)
             region.wrap(cls)
 
     return region
diff --git a/keystone/common/cms.py b/keystone/common/cms.py
index d9973c834..048292632 100644
--- a/keystone/common/cms.py
+++ b/keystone/common/cms.py
@@ -39,7 +39,7 @@ def cms_verify(formatted, signing_cert_file_name, ca_file_name):
     output, err = process.communicate(formatted)
     retcode = process.poll()
     if retcode:
-        LOG.error(_('Verify error: %s') % err)
+        LOG.error(_('Verify error: %s'), err)
         raise environment.subprocess.CalledProcessError(retcode,
                                                         "openssl", output=err)
     return output
@@ -135,7 +135,7 @@ def cms_sign_text(text, signing_cert_file_name, signing_key_file_name):
                       "ensure you've configured PKI with "
                       "'keystone-manage pki_setup'"))
         else:
-            LOG.error(_('Signing error: %s') % err)
+            LOG.error(_('Signing error: %s'), err)
         raise environment.subprocess.CalledProcessError(retcode, "openssl")
     return output
 
diff --git a/keystone/common/controller.py b/keystone/common/controller.py
index 9c0f5b0c9..f3b59787f 100644
--- a/keystone/common/controller.py
+++ b/keystone/common/controller.py
@@ -30,7 +30,7 @@ DEFAULT_DOMAIN_ID = CONF.identity.default_domain_id
 
 
 def _build_policy_check_credentials(self, action, context, kwargs):
-    LOG.debug(_('RBAC: Authorizing %(action)s(%(kwargs)s)') % {
+    LOG.debug(_('RBAC: Authorizing %(action)s(%(kwargs)s)'), {
         'action': action,
         'kwargs': ', '.join(['%s=%s' % (k, kwargs[k]) for k in kwargs])})
 
@@ -184,7 +184,7 @@ def filterprotected(*filters):
                         if item in context['query_string']:
                             target[item] = context['query_string'][item]
 
-                    LOG.debug(_('RBAC: Adding query filter params (%s)') % (
+                    LOG.debug(_('RBAC: Adding query filter params (%s)'), (
                         ', '.join(['%s=%s' % (item, target[item])
                                   for item in target])))
 
@@ -262,11 +262,10 @@ class V2Controller(wsgi.Application):
                         target = _('Domain (%s)') % assignment['domain_id']
                     else:
                         target = _('Unknown Target')
-                    msg = (_('Group (%(group)s), referenced in assignment '
-                             'for %(target)s, not found - ignoring.') % {
-                                 'group': assignment['group_id'],
-                                 'target': target})
-                    LOG.debug(msg)
+                    msg = _('Group (%(group)s), referenced in assignment '
+                            'for %(target)s, not found - ignoring.')
+                    LOG.debug(msg, {'group': assignment['group_id'],
+                                    'target': target})
                     continue
 
                 if 'project_id' in assignment:
diff --git a/keystone/common/environment/eventlet_server.py b/keystone/common/environment/eventlet_server.py
index 02879b08e..b0c08c9d3 100644
--- a/keystone/common/environment/eventlet_server.py
+++ b/keystone/common/environment/eventlet_server.py
@@ -47,7 +47,7 @@ class Server(object):
 
     def start(self, key=None, backlog=128):
         """Run a WSGI server with the given application."""
-        LOG.info(_('Starting %(arg0)s on %(host)s:%(port)s') %
+        LOG.info(_('Starting %(arg0)s on %(host)s:%(port)s'),
                  {'arg0': sys.argv[0],
                   'host': self.host,
                   'port': self.port})
diff --git a/keystone/common/ldap/core.py b/keystone/common/ldap/core.py
index 6ff2fa8c1..8856f65b8 100644
--- a/keystone/common/ldap/core.py
+++ b/keystone/common/ldap/core.py
@@ -212,12 +212,12 @@ class BaseLdap(object):
             except Exception:
                 LOG.warn(_(
                     'Invalid additional attribute mapping: "%s". '
-                    'Format must be <ldap_attribute>:<keystone_attribute>')
-                    % item)
+                    'Format must be <ldap_attribute>:<keystone_attribute>'),
+                    item)
                 continue
             if attr_map not in self.attribute_mapping:
                 LOG.warn(_('Invalid additional attribute mapping: "%(item)s". '
-                           'Value "%(attr_map)s" must use one of %(keys)s.') %
+                           'Value "%(attr_map)s" must use one of %(keys)s.'),
                          {'item': item, 'attr_map': attr_map,
                           'keys': ', '.join(self.attribute_mapping.keys())})
                 continue
@@ -486,7 +486,7 @@ class LdapWrapper(object):
                   'tls_cacertfile=%(tls_cacertfile)s\n'
                   'tls_cacertdir=%(tls_cacertdir)s\n'
                   'tls_req_cert=%(tls_req_cert)s\n'
-                  'tls_avail=%(tls_avail)s\n') %
+                  'tls_avail=%(tls_avail)s\n'),
                   {'use_tls': use_tls,
                    'tls_cacertfile': tls_cacertfile,
                    'tls_cacertdir': tls_cacertdir,
@@ -562,7 +562,7 @@ class LdapWrapper(object):
                        if kind != 'userPassword'
                        else ['****'])
                       for kind, values in ldap_attrs]
-        LOG.debug(_('LDAP add: dn=%(dn)s, attrs=%(attrs)s') % {
+        LOG.debug(_('LDAP add: dn=%(dn)s, attrs=%(attrs)s'), {
             'dn': dn, 'attrs': sane_attrs})
         return self.conn.add_s(dn, ldap_attrs)
 
@@ -575,7 +575,7 @@ class LdapWrapper(object):
             attrlist = [attr for attr in attrlist if attr is not None]
         LOG.debug(_(
             'LDAP search: dn=%(dn)s, scope=%(scope)s, query=%(query)s, '
-            'attrs=%(attrlist)s') % {
+            'attrs=%(attrlist)s'), {
                 'dn': dn,
                 'scope': scope,
                 'query': query,
@@ -642,7 +642,7 @@ class LdapWrapper(object):
         sane_modlist = [(op, kind, (values if kind != 'userPassword'
                                     else ['****']))
                         for op, kind, values in ldap_modlist]
-        LOG.debug(_('LDAP modify: dn=%(dn)s, modlist=%(modlist)s') % {
+        LOG.debug(_('LDAP modify: dn=%(dn)s, modlist=%(modlist)s'), {
             'dn': dn, 'modlist': sane_modlist})
 
         return self.conn.modify_s(dn, ldap_modlist)
@@ -653,7 +653,7 @@ class LdapWrapper(object):
 
     def delete_ext_s(self, dn, serverctrls):
         LOG.debug(
-            _('LDAP delete_ext: dn=%(dn)s, serverctrls=%(serverctrls)s') % {
+            _('LDAP delete_ext: dn=%(dn)s, serverctrls=%(serverctrls)s'), {
                 'dn': dn, 'serverctrls': serverctrls})
         return self.conn.delete_ext_s(dn, serverctrls)
 
diff --git a/keystone/common/utils.py b/keystone/common/utils.py
index c52b243ad..d723deab6 100644
--- a/keystone/common/utils.py
+++ b/keystone/common/utils.py
@@ -73,7 +73,7 @@ def trunc_password(password):
     try:
         if len(password) > max_length:
             LOG.warning(
-                _('Truncating user password to %s characters.') % max_length)
+                _('Truncating user password to %s characters.'), max_length)
         return password[:max_length]
     except TypeError:
         raise exception.ValidationError(attribute='string', target='password')
diff --git a/keystone/common/wsgi.py b/keystone/common/wsgi.py
index ce87522ee..eb66da35f 100644
--- a/keystone/common/wsgi.py
+++ b/keystone/common/wsgi.py
@@ -235,7 +235,7 @@ class Application(BaseApplication):
             result = method(context, **params)
         except exception.Unauthorized as e:
             LOG.warning(
-                _('Authorization failed. %(exception)s from %(remote_addr)s') %
+                _('Authorization failed. %(exception)s from %(remote_addr)s'),
                 {'exception': e, 'remote_addr': req.environ['REMOTE_ADDR']})
             return render_exception(e, user_locale=req.best_match_language())
         except exception.Error as e:
diff --git a/keystone/contrib/access/core.py b/keystone/contrib/access/core.py
index 09573ad66..869a666cf 100644
--- a/keystone/contrib/access/core.py
+++ b/keystone/contrib/access/core.py
@@ -56,5 +56,5 @@ class AccessLogMiddleware(wsgi.Middleware):
             data['datetime'] = '%s %s' % (now.strftime(APACHE_TIME_FORMAT),
                                           now.strftime('%z') or '+0000')
 
-            LOG.info(APACHE_LOG_FORMAT % data)
+            LOG.info(APACHE_LOG_FORMAT, data)
         return response
diff --git a/keystone/identity/backends/ldap.py b/keystone/identity/backends/ldap.py
index 2c20591b0..fbf91d5fb 100644
--- a/keystone/identity/backends/ldap.py
+++ b/keystone/identity/backends/ldap.py
@@ -160,7 +160,7 @@ class Identity(identity.Driver):
             except exception.UserNotFound:
                 LOG.debug(_("Group member '%(user_dn)s' not found in"
                             " '%(group_id)s'. The user should be removed"
-                            " from the group. The user will be ignored.") %
+                            " from the group. The user will be ignored."),
                           dict(user_dn=user_dn, group_id=group_id))
         return users
 
diff --git a/keystone/identity/controllers.py b/keystone/identity/controllers.py
index 158eecb56..2ffe97503 100644
--- a/keystone/identity/controllers.py
+++ b/keystone/identity/controllers.py
@@ -60,7 +60,7 @@ class Tenant(controller.V2Controller):
         try:
             token_ref = self.token_api.get_token(context['token_id'])
         except exception.NotFound as e:
-            LOG.warning(_('Authentication failed: %s') % e)
+            LOG.warning(_('Authentication failed: %s'), e)
             raise exception.Unauthorized(e)
 
         user_ref = token_ref['user']
@@ -1120,7 +1120,7 @@ class RoleAssignmentV3(controller.V3Controller):
                     target = 'Unknown'
                 LOG.warning(
                     _('Group %(group)s not found for role-assignment - '
-                      '%(target)s with Role: %(role)s') % {
+                      '%(target)s with Role: %(role)s'), {
                           'group': ref['group_id'], 'target': target,
                           'role': ref.get('role_id')})
             return members
diff --git a/keystone/identity/core.py b/keystone/identity/core.py
index fbdde1663..3e40eb47c 100644
--- a/keystone/identity/core.py
+++ b/keystone/identity/core.py
@@ -91,9 +91,9 @@ class DomainConfigs(dict):
         try:
             domain_ref = assignment_api.get_domain_by_name(domain_name)
         except exception.DomainNotFound:
-            msg = (_('Invalid domain name (%s) found in config file name')
-                   % domain_name)
-            LOG.warning(msg)
+            LOG.warning(
+                _('Invalid domain name (%s) found in config file name'),
+                domain_name)
 
         if domain_ref:
             # Create a new entry in the domain config dict, which contains
@@ -116,8 +116,8 @@ class DomainConfigs(dict):
 
         conf_dir = CONF.identity.domain_config_dir
         if not os.path.exists(conf_dir):
-            msg = _('Unable to locate domain config directory: %s') % conf_dir
-            LOG.warning(msg)
+            LOG.warning(_('Unable to locate domain config directory: %s'),
+                        conf_dir)
             return
 
         for r, d, f in os.walk(conf_dir):
@@ -129,9 +129,9 @@ class DomainConfigs(dict):
                                           [os.path.join(r, fname)],
                                           names[1])
                     else:
-                        msg = (_('Ignoring file (%s) while scanning domain '
-                                 'config directory') % fname)
-                        LOG.debug(msg)
+                        LOG.debug(_('Ignoring file (%s) while scanning domain '
+                                    'config directory'),
+                                  fname)
 
     def get_domain_driver(self, domain_id):
         if domain_id in self:
diff --git a/keystone/notifications.py b/keystone/notifications.py
index 5cfa14dcf..a6f95222e 100644
--- a/keystone/notifications.py
+++ b/keystone/notifications.py
@@ -93,6 +93,6 @@ def _send_notification(operation, resource_type, resource_id, host=None):
         notifier_api.notify(
             context, publisher_id, event_type, notifier_api.INFO, payload)
     except Exception:
-        msg = (_('Failed to send %(res_id)s %(event_type)s notification') %
-               {'res_id': resource_id, 'event_type': event_type})
-        LOG.exception(msg)
+        LOG.exception(
+            _('Failed to send %(res_id)s %(event_type)s notification'),
+            {'res_id': resource_id, 'event_type': event_type})
diff --git a/keystone/policy/backends/rules.py b/keystone/policy/backends/rules.py
index 3b20d48d1..1f37e8502 100644
--- a/keystone/policy/backends/rules.py
+++ b/keystone/policy/backends/rules.py
@@ -97,7 +97,7 @@ def enforce(credentials, action, target, do_raise=True):
 
 class Policy(policy.Driver):
     def enforce(self, credentials, action, target):
-        LOG.debug(_('enforce %(action)s: %(credentials)s') % {
+        LOG.debug(_('enforce %(action)s: %(credentials)s'), {
             'action': action,
             'credentials': credentials})
         enforce(credentials, action, target)
diff --git a/keystone/tests/fakeldap.py b/keystone/tests/fakeldap.py
index 28a02a992..c74df052e 100644
--- a/keystone/tests/fakeldap.py
+++ b/keystone/tests/fakeldap.py
@@ -190,7 +190,7 @@ class FakeLdap(object):
 
         if not utils.ldap_check_password(password, db_password):
             LOG.debug(_('FakeLdap bind fail: password for dn=%s does'
-                      ' not match') % dn)
+                      ' not match'), dn)
             raise ldap.INVALID_CREDENTIALS
 
     def unbind_s(self):
@@ -209,7 +209,7 @@ class FakeLdap(object):
                 raise TypeError('must be string, not None. attrs=%s' % attrs)
 
         key = '%s%s' % (self.__prefix, dn)
-        LOG.debug(_('FakeLdap add item: dn=%(dn)s, attrs=%(attrs)s') % {
+        LOG.debug(_('FakeLdap add item: dn=%(dn)s, attrs=%(attrs)s'), {
             'dn': dn, 'attrs': attrs})
         if key in self.db:
             LOG.debug(_('FakeLdap add item failed: dn=%s is'
@@ -259,7 +259,7 @@ class FakeLdap(object):
             raise ldap.SERVER_DOWN
 
         key = '%s%s' % (self.__prefix, dn)
-        LOG.debug(_('FakeLdap modify item: dn=%(dn)s attrs=%(attrs)s') % {
+        LOG.debug(_('FakeLdap modify item: dn=%(dn)s attrs=%(attrs)s'), {
             'dn': dn, 'attrs': attrs})
         try:
             entry = self.db[key]
@@ -291,7 +291,7 @@ class FakeLdap(object):
                         except ValueError:
                             LOG.debug(_('FakeLdap modify item failed: '
                                       'item has no attribute "%(k)s" with '
-                                      'value "%(v)s" to delete') % {
+                                      'value "%(v)s" to delete'), {
                                           'k': k, 'v': val})
                             raise ldap.NO_SUCH_ATTRIBUTE
             else:
@@ -316,7 +316,7 @@ class FakeLdap(object):
             raise ldap.SERVER_DOWN
 
         LOG.debug(
-            _('FakeLdap search at dn=%(dn)s scope=%(scope)s query=%(query)s') %
+            _('FakeLdap search at dn=%(dn)s scope=%(scope)s query=%(query)s'),
             {'dn': dn, 'scope': SCOPE_NAMES.get(scope, scope), 'query': query})
         if scope == ldap.SCOPE_BASE:
             try:
diff --git a/keystone/token/core.py b/keystone/token/core.py
index 8d83c526a..16765415d 100644
--- a/keystone/token/core.py
+++ b/keystone/token/core.py
@@ -65,7 +65,7 @@ def validate_auth_info(self, user_ref, tenant_ref):
     """
     # If the user is disabled don't allow them to authenticate
     if not user_ref.get('enabled', True):
-        msg = 'User is disabled: %s' % user_ref['id']
+        msg = _('User is disabled: %s') % user_ref['id']
         LOG.warning(msg)
         raise exception.Unauthorized(msg)
 
@@ -73,14 +73,14 @@ def validate_auth_info(self, user_ref, tenant_ref):
     user_domain_ref = self.identity_api.get_domain(
         user_ref['domain_id'])
     if user_domain_ref and not user_domain_ref.get('enabled', True):
-        msg = 'Domain is disabled: %s' % user_domain_ref['id']
+        msg = _('Domain is disabled: %s') % user_domain_ref['id']
         LOG.warning(msg)
         raise exception.Unauthorized(msg)
 
     if tenant_ref:
         # If the project is disabled don't allow them to authenticate
         if not tenant_ref.get('enabled', True):
-            msg = 'Tenant is disabled: %s' % tenant_ref['id']
+            msg = _('Tenant is disabled: %s') % tenant_ref['id']
             LOG.warning(msg)
             raise exception.Unauthorized(msg)
 
@@ -89,7 +89,7 @@ def validate_auth_info(self, user_ref, tenant_ref):
             tenant_ref['domain_id'])
         if (project_domain_ref and
                 not project_domain_ref.get('enabled', True)):
-            msg = 'Domain is disabled: %s' % project_domain_ref['id']
+            msg = _('Domain is disabled: %s') % project_domain_ref['id']
             LOG.warning(msg)
             raise exception.Unauthorized(msg)
 
diff --git a/keystone/token/provider.py b/keystone/token/provider.py
index a9c9e923e..15bccfba0 100644
--- a/keystone/token/provider.py
+++ b/keystone/token/provider.py
@@ -188,7 +188,7 @@ class Manager(manager.Manager):
                 return None
         except Exception:
             LOG.exception(_('Unexpected error or malformed token determining '
-                            'token expiry: %s') % token)
+                            'token expiry: %s'), token)
 
         # FIXME(morganfainberg): This error message needs to be updated to
         # reflect the token couldn't be found, but this change needs to wait
diff --git a/keystone/token/providers/pki.py b/keystone/token/providers/pki.py
index 21078df87..7fc677ba2 100644
--- a/keystone/token/providers/pki.py
+++ b/keystone/token/providers/pki.py
@@ -39,6 +39,6 @@ class Provider(uuid.Provider):
                                           CONF.signing.keyfile)
             return token_id
         except environment.subprocess.CalledProcessError:
-            LOG.exception('Unable to sign token')
+            LOG.exception(_('Unable to sign token'))
             raise exception.UnexpectedError(_(
                 'Unable to sign token.'))