Chapter 8. Logging security group actions

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

2. Enter the following command:

   $ openstack extension list --network --max-width=72 | grep logging

   If the Networking service has loaded the logging service plug-in and extension, the output includes the following:

   | Logging API          | logging              | Provides a logging API |

3. If the openstack extension list output does not include the Logging API Extension, update the control plane:

   1. Create a YAML file and add the following content:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: openstack-control-plane
      spec:
        neutron:
          template:
            customServiceConfig: |
              [DEFAULT]
              service_plugins=log

   2. Apply the updated OpenStackControlPlane CR configuration:

      $ oc apply -f <control_plane_update.yaml>

      • Replace <control_plane_updates.yaml> with the name of the YAML file that contains your update.

4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Check the status of the control plane deployment:

   $ oc get openstackcontrolplane -n openstack

   Sample output

   NAME                      STATUS    MESSAGE
   openstack-control-plane   Unknown   Setup started

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the get command to track deployment progress.

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a log by using the openstack network log create command with the appropriate set of arguments.

   Example 1: Log ACCEPT events from the security group sg1 on all ports

   $ openstack network log create my-log1 \
   --resource-type security_group \
   --resource sg1 \
   –event ACCEPT

   Example 2: Log ACCEPT events from all security groups on all ports

   openstack network log create my-log3 \
   --resource-type security_group \
   –event ACCEPT

   Verification

   Confirm that the that the log was created:

   $ openstack network log list

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. To list all log objects in a project:

   $ openstack network log list

3. To view details of a log object:

   $ openstack network log show <log_object_name>

   • Replace <log_object_name> with the name of the log object.

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. To disable a log object, enter the following command:

   $ openstack network log set --disable <log_object_name>

   • Replace <log_object_name> with the name of the log object.

3. To enable a log object, enter the following command:

   $ openstack network log set --enable <log_object_name>

   • Replace <log_object_name> with the name of the log object.

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. To rename a log object, enter the following command:

   $ openstack network log set --name <new_log_object_name> <object>

   • Replace <new_log_object_name> with the new name of the log object.
   • Replace <object> with the old name or ID of the log object.

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. To delete one or more log objects, enter the following command:

   $ openstack network log delete <log_object_name> [<log_object_name> ...]

   Replace <log_object_name> with the name of the log object to delete. To delete multiple log objects, enter a list of log object names, separated by spaces.

Procedure

1. Create a YAML file and add the following content:

   apiVersion: core.openstack.org/v1beta1
   kind: OpenStackControlPlane
   metadata:
     name: openstack-control-plane
   spec:
     neutron:
       template:
         customServiceConfig: |
           [network_log]
           rate_limit: <logged_packets>
           burst_limit: <queued_packets>

   • Replace <logged_packets> with the maximum number of packets that can be logged per second.
   • Replace <queued_packets> with the maximum number of packets that can be placed in the queue to be logged per second.

2. Apply the updated OpenStackControlPlane CR configuration:

   $ oc apply -f <control_plane_update.yaml>

   • Replace <control_plane_update.yaml> with the name of the YAML file that contains your update.

3. Wait until Red Hat OpenShift Container Platform (RHOCP) creates the resources related to the OpenStackControlPlane CR. Check the status of the control plane deployment:

   $ oc get openstackcontrolplane -n OPENSTACK

   Sample output

   NAME                      STATUS    MESSAGE
   openstack-control-plane   Unknown   Setup started

   The OpenStackControlPlane resources are created when the status is "Setup complete".

   Tip

   Append the -w option to the get command to track deployment progress.