SupportConsoleDevelopersStart a trialContact

Chapter 5. Minimize data collection and control data privacy

Configure data obfuscation and redaction to minimize data collection and enhance data privacy for RHEL systems. Obfuscate sensitive identifiers such as IP addresses and hostnames, exclude file content or command output, and prevent exposure of personally identifiable information (PII).

5.1. System facts
Copy link

A data collector is an application or service that regularly sends host information, updates, or system profile data to Red Hat Lightspeed inventory. insights-client is a data collector for Red Hat Lightspeed.

System facts are the metadata that data collectors collect about your RHEL systems. These facts describe runtime configuration, system health, and system performance. The insights-client uses the system facts it collects to populate inventory data in Red Hat Lightspeed and to update existing data. Red Hat Lightspeed also uses system facts to analyze system performance and to create recommendations for services such as advisor or remediations.

5.2. Data obfuscation
Copy link

Red Hat Lightspeed provides optional controls to obfuscate IP addresses, MAC addresses, and hostnames in the data archive and the user interface. These controls mask sensitive information before it reaches Red Hat.

Obfuscation capabilities depend on your connection type and client tool configuration. Consider feature level requirements and data privacy when configuring obfuscation.

Several client tools and products from Red Hat work together to provide a full range of functionalities. Depending on your setup, different tools can collect information from your systems at the same time. Some of the tools have built-in features for configuring obfuscation or redaction. To achieve the required state of data privacy, you must take many aspects into consideration, such as the feature-level requirements and how the system consumes the content.

Important

Directly connected systems. You cannot achieve true obfuscation or redaction of system information. The subscription-manager must remain enabled on the system and continues to report data.

This applies regardless of how insights-client or rhc are configured.

You cannot prevent the collection of certain key system information such as the hostname, or IP and MAC addresses. For directly connected systems, even configuring data obfuscation in the insights-client does not achieve the expected results.

Systems connected to a Red Hat Satellite or Capsule. You cannot fully prevent collection of key system information such as hostname, IP, and MAC addresses. However, you can adjust the feature level and configure Satellite so that data is never sent to Red Hat.

5.2.2. Data obfuscation on the system
Copy link

Full data obfuscation requires systems that are registered to Red Hat Satellite with client tools and server settings configured to enable obfuscation.

You can enable the insights-client obfuscation feature to replace the hostname, IP address, or MAC address with preset values in the Red Hat Lightspeed archive. A Python data cleaning process generates the replacement values. The processed archive file is then sent to Red Hat Lightspeed. Obfuscation is disabled by default.

Note
  • The Python data cleaning process automatically generates the masked values. You cannot choose the values for obfuscation.
  • The Red Hat Lightspeed compliance service uses OpenSCAP tools to generate compliance reports based on information from the host system. The compliance service uses OpenSCAP, which prevents complete obfuscation or redaction of hostname and IP address data. Host information is also sent to Red Hat Lightspeed when a compliance data collection job runs on the host system.

5.2.3. Obfuscate IPv4 IP addresses
Copy link

If your hosts use IPv4 IP addresses, enable obfuscation in the insights-client configuration file to mask sensitive data in the archive file before it is sent to Red Hat Lightspeed.

When you enable obfuscation, the original IP address of the host is replaced with a generated value in the archive file. This obfuscated value is used in the Red Hat Hybrid Cloud Console UI, logs, and any archive data files that Red Hat collects. However, you still see the original IP address in the command-line output of some insights-client commands.

Important

The obfuscation process uses a Python data cleaning process to generate a unique value for each host. You cannot configure the value provided for obfuscation. You also cannot obfuscate or select the portion of the host IP address to obfuscate.

Prerequisites

  • If you are using Red Hat Satellite to manage clients and register them on the Red Hat Hybrid Cloud Console, you must also configure the Red Hat Cloud settings before you can enable obfuscation in Red Hat Lightspeed:

    • In the Satellite web UI, navigate to Administer Settings Red Hat Cloud and enable the required obfuscation settings that apply to your environment.

Procedure

  1. Open the /etc/insights-client/insights-client.conf file with an editor.

  2. Locate the following section: 

    # Specify which will be obfuscated in the data collection,
# empty by default, and supported options are: ipv4, ipv6, hostname, mac
# (comma-separated list)
# obfuscation_list=

  3. Remove the preceding hash (#) character, before obfuscation_list=, and add the following line: 

    obfuscation_list=ipv4

  4. If your configuration file contains the older obfuscate=True or obfuscate=False Red Hat Lightspeed obfuscation setting, remove that line of configuration.

    Important

    Remove deprecated obfuscate and obfuscate_hostname options from the configuration file. If your configuration file contains both obfuscation_list and deprecated options, the obfuscation_list takes precedence and insights-client displays a warning message in the output.

  5. Save and close the /etc/insights-client/insights-client.conf file.

Result

When obfuscation is enabled, the original IPv4 address is masked in the console UI, logs, and archive data files that Red Hat collects.

Important

After you enable obfuscation, you continue to see the original IPv4 address in the command-line output of some insights-client commands.

  • Original host system IP address: 

    192.168.0.24

  • Obfuscated host IP address: 

    10.230.230.1

  • Obfuscated IPv4 IP address in the Red Hat Hybrid Cloud Console UI:

    An example of an obfuscated IPv4 IP address in the Red Hat Hybrid Cloud Console UI

Note

When you enable obfuscation on several systems, the same obfuscated IP address gets generated. Therefore, in the example scenario provided, when you search or filter by IP address in the Red Hat Lightspeed UI on the Hybrid Cloud Console you might see several instances of 10.230.230.1. This is because the Python data cleaning process that the Red Hat Lightspeed obfuscation feature uses, can generate the same obfuscated IP address in the archive file.

5.2.4. Obfuscate IPv6 IP addresses
Copy link

If your hosts use IPv6 IP addresses, enable obfuscation in the insights-client configuration file to mask sensitive data in the archive file before it is sent to Red Hat Lightspeed.

When you enable obfuscation, the original IP address of the host is replaced with a generated value in the archive file. This obfuscated value is used in the Red Hat Hybrid Cloud Console UI, logs, and any archive data files that Red Hat collects. However, you still see the original IP address in the command-line output of some insights-client commands.

Important

The obfuscation process uses a Python data cleaning process to generate a unique value for each host. You cannot configure the value provided for obfuscation. You also cannot obfuscate or select the portion of the host IP address to obfuscate.

Prerequisites

  • If you are using Red Hat Satellite to manage clients and register them on the Red Hat Hybrid Cloud Console, you must also configure the Red Hat Cloud settings before you can enable obfuscation in Red Hat Lightspeed:

    • In the Satellite web UI, navigate to Administer Settings Red Hat Cloud and enable the required obfuscation settings that apply to your environment.

Procedure

  1. Open the /etc/insights-client/insights-client.conf file with an editor.

  2. Locate the following section: 

    # Specify which will be obfuscated in the data collection,
# empty by default, and supported options are: ipv4, ipv6, hostname, mac
# (comma separated list)
# obfuscation_list=

  3. Remove the preceding hash (#) character, before obfuscation_list=, and add the following line: 

    obfuscation_list=ipv6

  4. If your configuration file contains the older obfuscate=True or obfuscate=False Red Hat Lightspeed obfuscation setting, remove that line of configuration.

    Important

    Remove deprecated obfuscate and obfuscate_hostname options from the configuration file. If your configuration file contains both obfuscation_list and deprecated options, the obfuscation_list takes precedence and insights-client displays a warning message in the output.

  5. Save and close the /etc/insights-client/insights-client.conf file.

Result

When obfuscation is enabled, the original IPv6 address is masked in the console UI, logs, and archive data files that Red Hat collects.

Important

After you enable obfuscation, you continue to see the original IP address in the command-line output of some insights-client commands.

  • Original host system IPv6 addresses: 

    ff00:f800:f801:f802::f806
ff00:f800:f801:f802:f00:f803:f804:f805
ff01::f00:f803:f804:f805

  • Obfuscated host IPv6 addresses: 

    fc47:d0f1:5ae7:e4e9::0477,
fc47:d0f1:5ae7:e4e9:fee:3939:5b4a:2c55,
70f1::fee:3939:5b4a:2c55,

  • Obfuscated IPv6 IP addresses in the Red Hat Hybrid Cloud Console UI:

    An example of an obfuscated IP addresses in the Red Hat Hybrid Cloud Console UI

Note

When you enable obfuscation on several systems, the same obfuscated IP address gets generated. Therefore, in the scenario provided, when you search or filter by IP address in the Red Hat Lightspeed UI on the Hybrid Cloud Console, you might see several instances of 70f1::fee:3939:5b4a:2c55. This is because the Python data cleaning process that the Red Hat Lightspeed obfuscation feature uses can generate the same obfuscated IP address in the archive file.

5.2.5. Obfuscate MAC addresses
Copy link

You can mask the Media Access Control (MAC) addresses of your hosts in the archive file before it is sent to Red Hat Lightspeed by enabling obfuscation.

Important

The obfuscation process uses a Python data cleaning process to generate a unique value for each host. You cannot configure the value provided for obfuscation. You also cannot obfuscate or select the portion of the host MAC address to obfuscate.

Prerequisites

  • If you are using Red Hat Satellite to manage clients and register them on the Red Hat Hybrid Cloud Console, you must also configure the Red Hat Cloud settings before you can enable obfuscation in Red Hat Lightspeed:

    • In the Satellite web UI, navigate to Administer Settings Red Hat Cloud and enable the required obfuscation settings that apply to your environment.

Procedure

  1. Open the /etc/insights-client/insights-client.conf file with an editor.

  2. Locate the following section: 

    # Specify which will be obfuscated in the data collection,
# empty by default, and supported options are: ipv4, ipv6, hostname, mac
# (comma separated list)
# obfuscation_list=

  3. Remove the preceding hash (#) character, before obfuscation_list= and add the following line: 

    obfuscation_list=mac

  4. If your configuration file contains the older obfuscate=True or obfuscate=False Red Hat Lightspeed obfuscation setting, remove that line of configuration.

    Important

    Remove deprecated obfuscate and obfuscate_hostname options from the configuration file. If your configuration file contains both obfuscation_list and deprecated options, the obfuscation_list takes precedence and insights-client displays a warning message in the output.

  5. Save and close the /etc/insights-client/insights-client.conf file.

Result

When obfuscation is enabled, the original MAC address is masked in the console UI, logs, and archive data files that Red Hat collects.

Important

After you enable obfuscation, you continue to see the original MAC address in the command-line output of some insights-client commands.

  • Original host system MAC address: 

    08:00:27:7c:fc:0f

  • Obfuscated host MAC address: 

    1e:fb:bc:2e:4a:6d

  • Obfuscated MAC address in the Red Hat Hybrid Cloud Console:

    An example of an obfuscated MAC address in the Red Hat Hybrid Cloud Console UI

Note

When you enable obfuscation on several systems, the same obfuscated MAC address gets generated. Therefore, in the example scenario provided, when you search or filter by MAC address in the Red Hat Lightspeed UI on the Hybrid Cloud Console, you might see several instances of 1e:fb:bc:2e:4a:6d. This is because the Python data cleaning process that the Red Hat Lightspeed obfuscation feature uses can generate the same obfuscated MAC address in the archive file.

5.2.6. Obfuscate hostnames
Copy link

Configure insights-client to obfuscate hostnames by replacing the value in /etc/hostname with an automatically generated UUID before sending data to Red Hat.

During data obfuscation, a Python process generates a 12-character UUID to mask the hostname in the data archive file and Hybrid Cloud Console. The masked data is then sent to Red Hat.

Tip

An obfuscated hostname can be difficult to recognize. Setting a display name can help you to more easily identify your obfuscated hosts. The display name does not get obfuscated and displays in the Red Hat Lightspeed console UI. Only the value of /etc/hostname gets obfuscated.

Prerequisites

  • If you are using Red Hat Satellite to manage clients and register them on the Red Hat Hybrid Cloud Console, you must also configure the Red Hat Cloud settings before you can enable obfuscation in Red Hat Lightspeed:

    • In the Satellite web UI, navigate to Administer Settings Red Hat Cloud and enable the required obfuscation settings that apply to your environment.

Procedure

  1. Open the /etc/insights-client/insights-client.conf file with an editor.

  2. Locate the following section: 

    obfuscation_list=

  3. Add the following line to the obfuscation_list section to enable hostname obfuscation: 

    obfuscation_list=hostname
    Note

    To add multiple obfuscation options, separate them with commas. For example, to obfuscate the hostname and an IPv6 IP address, add: 

    obfuscation_list=hostname,ipv6

  4. If your configuration file contains the older obfuscate_hostname=True or obfuscate_hostname=False Red Hat Lightspeed obfuscation setting, remove that line of configuration.

    Important

    Remove deprecated obfuscate and obfuscate_hostname options from the configuration file. If your configuration file contains both obfuscation_list and deprecated options, the obfuscation_list takes precedence and insights-client displays a warning message in the output.

  5. Optional: Assign a display name to your system so that you can more easily find and manage your obfuscated hosts in the Red Hat Lightspeed console UI by adding the following line: 

    display_name=example-display-name
    Note

    You can also set a display name by using the following command: 

    [root@rhlightspeed]# insights-client --display-name ITC-4
  6. Save and close the /etc/insights-client/insights-client.conf file.

Result

  • When obfuscation is successfully enabled, the hostname gets masked in the Red Hat Lightspeed console UI, logs, and any archive data files that Red Hat collects.
  • If you configure hostname obfuscation on more than one system, you might see multiple systems with the same hostname in the Red Hat Lightspeed GUI as a result of obfuscation.
  • After you enable obfuscation, there might be instances where the original hostname displays in the command-line output of some insights-client commands.

  • The original hostname of the system in /etc/hostname: 

    RTP.data.center.01

  • Obfuscated /etc/hostname as displayed in Red Hat Lightspeed: 

    90f4a9365ce0.example.com

  • Obfuscated hostname and IP address in the Red Hat Hybrid Cloud Console:

    An example of an obfuscated hostname in the Red Hat Hybrid Cloud Console UI

5.2.7. Obfuscation in Red Hat Satellite
Copy link

For Red Hat Satellite-managed systems, obfuscation must be enabled in the Satellite web interface before configuring clients to prevent double-obfuscation.

5.3. Data redaction
Copy link

You can configure data redaction to remove specific content such as files, command output, or keyword patterns from the collected archive. Data redaction can be used to exclude data containing personally identifiable information (PII).

To prevent hostname, IP, and MAC addresses from being collected or sent to Red Hat, implement the obfuscation feature in combination with a Red Hat Satellite Server in your environment.

Important

Directly connected systems. You cannot achieve true obfuscation or redaction of system information. The subscription-manager client must remain enabled and continues to report data from the system.

This applies regardless of how insights-client or rhc are configured.

You cannot prevent the collection of certain key system information such as the hostname, IP, and MAC addresses, and having that information sent to Red Hat. For directly connected systems, even configuring data obfuscation within the insights-client does not achieve the expected results.

Systems connected to a Red Hat Satellite or Capsule. You cannot fully prevent collection of key system information such as hostname, IP, and MAC addresses. However, you can adjust the feature level and configure Satellite so that data is never sent to Red Hat.

5.3.2. Data collection rules and redaction
Copy link

Manage data collection and redaction by using YAML configuration files and the insights-core datasource catalog.

5.3.3. YAML files for redaction
Copy link

To redact data in Red Hat Lightspeed, you need insights-client 3.0 and the following YAML configuration files to control the redaction actions:

  • file-redaction.yaml
  • file-content-redaction.yaml

You can use one or both files, depending on the content you want to redact.

To find the items to redact, insights-client uses the default configuration of the insights-client.conf configuration file to call the file-redaction.yaml and file-content-redaction.yaml files. The following example shows the default redaction configuration in the insights-client.conf file: 

# Location of the redaction file for commands, files, and components
#redaction_file=/etc/insights-client/file-redaction.yaml

# Location of the redaction file for patterns and keywords
#content_redaction_file=/etc/insights-client/file-content-redaction.yaml

You do not need to change the configuration of the insights-client.conf file, but you do need to create the YAML files.

/etc/insights-client/file-redaction.yaml
Lists commands and files that you want to redact. A Python data cleaning process runs on the file-redaction.yaml file and redacts the listed commands and files. When the Python data cleaning process runs, it redacts the specified content before adding it to the archive file.
/etc/insights-client/file-content-redaction.yaml
Defines pattern redaction and keyword replacement. For pattern redaction, the process redacts patterns or regular expressions that match those specified in the YAML file. For keyword replacement, the process replaces the specified keywords with generic identifiers.

5.3.4. Configure file redaction
Copy link

You can create the /etc/insights-client/file-redaction.yaml file and include a list of commands and system files that you want redacted. When the data redaction takes place, a Python data cleaning process runs, and analyzes the contents of the YAML file.

Note

The output of the listed commands or files does not get included in the uploaded archive file.

Prerequisites

  • You must be familiar with the basics of YAML syntax. For more information about YAML, see yaml.org.
  • You must have root-level access to the system.

Procedure

  1. Use an editor to create the /etc/insights-client/file-redaction.yaml file.

  2. Enter the strings, files: and commands:, on separate lines in the YAML file. 

    files:


commands:

  3. Specify the files and commands you want to redact:

    1. On the line following files:, enter the files that you want to redact. Use the information in the Datasources catalog to identify which files and commands to specify. For example, if you want to redact the auditd.conf file, this is how it would look: 

      files:
  - /etc/audit/auditd.conf

    2. On the line following commands:, enter the commands that you want to redact. Use the information in the Datasources catalog to identify which commands to specify. For example, if you want to redact the ethtool -i command, this is how it would look: 

      commands:
  - ethtool_i
  4. Save the YAML file in /etc/insights-client/.

  5. On the command line, run ll file-redaction.yaml as root to verify that the file-redaction.yaml file permissions are root owner only. 

    [root@rhlightspeed]# ll file-redaction.yaml
-rw-------. 1 root root 145 Sep 25 17:39 file-redaction.yaml

    The following example shows a sample file-redaction.yaml file that includes commands and files to redact. Comments, which are lines preceded by a hash symbol (#), also offer guidance to help you configure the YAML file. 

    # file-redaction.yaml
---
# Redact the entire output of commands
# Specify commands with the full command or with a "symbolic_name" such as “ethtool_i.”
# Refer to the “Datasource Catalog” and “General Datasources” at https://insights-core.readthedocs.io/en/latest/specs_catalog.html#general-datasource for a full list of available symbolic_names, and the commands and files they correspond to.

 commands:
- /bin/rpm -qa
- /bin/ls
- ethtool_i

# Redact the entire output of files
# Specify files either by full filename or
by the "symbolic_name" for example, “cluster_conf.”
# Refer to the “Datasource Catalog” and “General Datasources” at https://insights-core.readthedocs.io/en/latest/specs_catalog.html#general-datasource for a full list of available symbolic_names, and the commands and files they correspond to.

files:
- /etc/audit/auditd.conf
- cluster_conf

Verification

To verify that your redaction file is working, you can run the insights-client command with the --no-upload option, then review the output messages on your console or terminal.

  1. On the command line, enter the insights-client command with the --no-upload option, and press Return. 

    [root@rhlightspeed]# insights-client --no-upload

  2. The command runs and displays informational messages. The following example shows the redaction of the dmesg command and the cluster.conf file. 

    WARNING: Excluding data from files
Starting to collect Red Hat Lightspeed data for ITC-4
WARNING: Skipping command /bin/dmesg
WARNING: Skipping file /etc/cluster/cluster.conf
Archive saved at /var/tmp/qsINM9/rhlightspeed-ITC-4-20190925180232.tar.gz

    The generated archive file gets saved to /var/tmp but the file is not uploaded to Red Hat.

Configure the file-content-redaction.yaml file to redact data by using pattern redaction and keyword replacement methods.

Pattern redaction uses either a pattern match or regular expression match. In keyword replacement, a Python data cleaning process replaces the keyword with a generic identifier.

Prerequisites

  • You must be familiar with the basics of YAML syntax. Explaining YAML is beyond the scope of this procedure.
  • You have root-level access to the system.

Procedure

  1. Use an editor to create the /etc/insights-client/file-content-redaction.yaml file. 

    # file-content-redaction.yaml
---
# Pattern redaction per matching line
#  Lines that match a pattern are excluded from files and command output.
#  Patterns are processed in the order that they are listed.
# Example

patterns:
 - "a_string_1"
 - "a_string_2"

# Regular expression pattern redaction per line
#  Use "regex:" to wrap patterns with regular expressions"
# Example

patterns:
 regex:
 - "abc.*def"
 - "localhost[[:digit:]]"


# Keyword replacement redaction
#  Replace keywords in files and command output with generic identifiers
#  Keyword does not support regex
# Example

keywords:
- "1.1.1.1"
- "My Name"
- "a_name"

  2. Ensure the file-content-redaction.yaml file permissions are set for root owner only. 

    [root@rhlightspeed]# ll file-content-redaction.yaml
-rw-------. 1 root root 145 Sep 25 17:39 file-content-redaction.yaml

5.4. The insights-client archive
Copy link

To confirm what data the archive file sends to Red Hat, inspect the archive file. If you use obfuscation or redaction, you can inspect the archive before it uploads. If you want to preserve the archive file, you can keep it on your system.

5.4.1. Verify the archive before uploading
Copy link

Use insights-client --no-upload to save the archive locally. You can view the information that the client sends to Red Hat Lightspeed, and verify your obfuscation or redaction settings.

Prerequisites

  • You have a root user access to your system

Procedure

  1. Enter the insights-client command with the --no-upload option. 

    [root@rhlightspeed]# insights-client --no-upload

    The command displays informational messages when redaction or obfuscation is applied. 

    WARNING: Excluding data from files
Starting to collect Red Hat Lightspeed data for ITC-4
WARNING: Skipping patterns found in remove.conf
WARNING: Skipping command /bin/dmesg
WARNING: Skipping command /bin/hostname
WARNING: Skipping file /etc/cluster/cluster.conf
WARNING: Skipping file /etc/hosts
Archive saved at /var/tmp/qsINM9/rhlightspeed-ITC-4-20190925180232.tar.gz

  2. Navigate to the temporary storage directory as shown in the Archive saved at message. 

    [root@rhlightspeed]# cd /var/tmp/qsINM9/

  3. Unpack the compressed tar.gz file. 

    [root@rhlightspeed]# tar -xzf rhlightspeed-ITC-4-20190925180232.tar.gz

    The tar command extracts the archive contents into a new directory.

5.4.2. Verify the archive after uploading
Copy link

After the archive uploads to Red Hat Lightspeed, use the --keep-archive option to retain a local copy for inspection. You can then verify your obfuscation or redaction settings.

Prerequisites

  • You have root user access to your system

Procedure

  1. Enter the insights-client command with the --keep-archive option as a root user: 

    [root@rhlightspeed]# insights-client --keep-archive

    The command displays informational messages. 

    Starting to collect Red Hat Lightspeed data for ITC-4
Uploading Red Hat Lightspeed data.
Successfully uploaded report from ITC-4 to account 6229994.
Red Hat Lightspeed archive retained in /var/tmp/ozM8bY/rhlightspeed-ITC-4-20190925181622.tar.gz

  2. Navigate to the temporary storage directory displayed in the Red Hat Lightspeed archive retained in message. 

    [root@rhlightspeed]# cd /var/tmp/ozM8bY/

  3. Unpack the compressed tar.gz file. 

    [root@rhlightspeed]# tar -xzf rhlightspeed-ITC-4-20190925181622.tar.gz

    The tar command extracts the archive contents into a new directory.

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top