K, np.

I did have a question …. you’re probably aware that StarlingX does support running Linux Auditd which also detects and logs security violation events … with configurable auditd.rules.  The logs by default go to  /var/log/audit/audit.log …. i.e. they are not currently forwarded to StarlingX FM.

Does the software that you are thinking of contributing provide different capability than Linux Auditd ?

Greg.

From: Richard Schmitt <richard.schmitt@starlab.io>
Sent: Friday, June 16, 2023 4:28 PM
To: Waines, Greg <Greg.Waines@windriver.com>; starlingx-discuss@lists.starlingx.io
Subject: Re: Question about alarms in StarlingX

Just an FYI.  I kind of figured things out.

There’s an api called ‘fm_api’ that let’s you instantiate a class FaultAPIv2 and call set_fault.  This will add an Event to the Horizon Fault Manager, Event List.

That’s essentially what I want.  So, I figure I’d thank you for looking into this but also let you know that I probably have what I want.

Thanks,

Rich

From: Waines, Greg <Greg.Waines@windriver.com>
Date: Thursday, June 15, 2023 at 8:19 PM
To: Richard Schmitt <richard.schmitt@starlab.io>, starlingx-discuss@lists.starlingx.io <starlingx-discuss@lists.starlingx.io>
Subject: RE: Question about alarms in StarlingX

[EXTERNAL SENDER]

Hey Richard … sorry for the slow reply …

This is the right place to ask.

I am not totally sure what you mean by “We want to create user alarms in OpenStack.”

• What software specifically do you want to generate alarms related to what specific fault conditions ?

Some other background on alarms in StarlingX:

• StarlingX Platform has a Fault Management system of its own

• It is used by StarlingX Platform’s Infrastructure Services to raise alarms and logs related to fault conditions detected by StarlingX Platform’s Infrastructure Services
• These alarms / logs are stored in a historical event (alarm or log) db
• And an active alarm db is maintained to show alarms that are currently present within StarlingX
• The historical event db and the active alarm db can be displayed thru

• the starlingx API/CLI ‘fm’, and
• the starlingx horizon, on the Fault Management page

• There is an internal developer’s API for FM for people coding StarlingX Platform Infrastructure Services code to raise and clear alarms/logs

• Likely not documented well … other than in the code (lol)
• Let me know if this is what you are looking for

• StarlingX OpenStack … i.e. the containerized openstack solution

• You’re right that the only pure openstack alarming that I am aware of is via aodh which does alarm thresholding of statistics collected by openstack telemetry / gnoochi … which StarlingX OpenStack doesn’t fully support anymore … we let it go stale and need to fix it
• …
• However there is a StarlingX OpenStack VIM component that lives in the gray area between the StarlingX Platform on the host and StarlingX OpenStack in containers …

• One of the things VIM does, is watch openstack events and raises FM alarms and logs for many openstack events
• I believe this is still operational and working today

• At one time we were working on cloning FM and having a StarlingX Platform FM and a StarlingX OpenStack FM … but I don’t believe that ever got completed.

Anyways … let me know if this helps,

Greg

From: Richard Schmitt <richard.schmitt@starlab.io>
Sent: Monday, June 12, 2023 5:59 PM
To: starlingx-discuss@lists.starlingx.io
Subject: [Starlingx-discuss] Question about alarms in StarlingX

Sorry if this isn’t the right place to ask this question.

We want to create user alarms in OpenStack.  We are not very knowledgeable of OpenStack.  Ultimately, we’d like to raise alarms and have them appear in the Horizon Fault Management page or via the fm CLI.  It does not appear that StarlingX has anything to do with creating or raising alarms.  There are some references in OpenStack documentation on aodh but that service is not deployed in our configuration.

I’m not entirely sure whether OpenStack supports extensible alarms.  Perhaps that’s why I’m finding so little info on it.  Any pointers on where I should look?

Thanks,

Rich