Ah ok …

 

Yeah in StarlingX / Kubernetes environment, it is the StarlingX Infrastructure / Flock Services that is responsible for management of the baremetal servers and platform software running on it.  

 

So it would make sense for the software that you are proposing to use StarlingX FM APIs to generate these alarms/logs.  They would then be visible to the end user thru StarlingX Horizon GUI, StarlingX FM CLI/API and optionally SNMP.

 

 

 

Although, you’re probably aware that StarlingX does support running Linux Auditd which also detects and logs security violation events … with configurable auditd.rules.  The logs by default go to  /var/log/audit/audit.log …. i.e. they are not currently forwarded to StarlingX FM.

 

Does the software that you are thinking of contributing provide different capability than Linux Auditd ?

 

Greg.

 

 

From: Richard Schmitt <richard.schmitt@starlab.io>
Sent: Friday, June 16, 2023 10:11 AM
To: Waines, Greg <Greg.Waines@windriver.com>; starlingx-discuss@lists.starlingx.io
Subject: Re: Question about alarms in StarlingX

 

Thanks for the detailed answer.

 

Let me answer the question, “What software specifically do you want to generate alarms?”

 

We have software that monitors security events associated with the Linux kernel that we would like to expose to the cloud platform.  These security events get logged to journald which in turn is picked up by syslog.  We would make a syslog rule that selects these specific audit events and outputs them to a named pipe.  We’d run a service on each node that would read from this pipe, massage the syslog message, and, our hope, would be to create an alarm within StarlingX that represents that security event.

 

That’s really the crux of my question.  I’ve read that Kubernetes generally does not handle platform events yet we are exploring a requirement that these security alarms be exposed to the cloud admin through the Horizon web GUI.  I’m trying to understand if this is possible.

 

Again, thanks for taking the time to read my question and help.

 

Rich

 

From: Waines, Greg <Greg.Waines@windriver.com>
Date: Thursday, June 15, 2023 at 8:19 PM
To: Richard Schmitt <richard.schmitt@starlab.io>, starlingx-discuss@lists.starlingx.io <starlingx-discuss@lists.starlingx.io>
Subject: RE: Question about alarms in StarlingX

[EXTERNAL SENDER]

Hey Richard … sorry for the slow reply …

This is the right place to ask.

 

I am not totally sure what you mean by “We want to create user alarms in OpenStack.”

 

Some other background on alarms in StarlingX:

 

Anyways … let me know if this helps,

Greg

 

 

From: Richard Schmitt <richard.schmitt@starlab.io>
Sent: Monday, June 12, 2023 5:59 PM
To: starlingx-discuss@lists.starlingx.io
Subject: [Starlingx-discuss] Question about alarms in StarlingX

 

Sorry if this isn’t the right place to ask this question.

 

We want to create user alarms in OpenStack.  We are not very knowledgeable of OpenStack.  Ultimately, we’d like to raise alarms and have them appear in the Horizon Fault Management page or via the fm CLI.  It does not appear that StarlingX has anything to do with creating or raising alarms.  There are some references in OpenStack documentation on aodh but that service is not deployed in our configuration.

 

I’m not entirely sure whether OpenStack supports extensible alarms.  Perhaps that’s why I’m finding so little info on it.  Any pointers on where I should look?

Thanks,

Rich