topic Re: OneView syslog in HPE OneView

OneView syslog

adamcole — Fri, 15 Mar 2019 13:46:16 GMT

Does OneView have the ability to forward its logs to a syslog server? There is a "Enable-HPOVRemoteSyslog" powershell command but the documentation is pretty vague on actual usage.

Re: OneView syslog

PeterWolfe — Mon, 18 Mar 2019 19:12:25 GMT

Yes, starting the new V4.20 release (which just started shipping within the last several weeks). The feature allows you to forward the OneView audit logs to a remote syslog server.

The powershell command is for a older feature that's has been in OneView from early on. That feature configures specific managed devices (e..g. iLO, OAs, some ICMs) to forward their syslogs to a remote syslog server.

Re: OneView syslog

Daniel-L — Tue, 19 Mar 2019 10:22:55 GMT

Hello Peter,

thanks for sharing this interesting news.

Any plans to implement forwarding of all events and activities and not audit logs only?

Having auditing events captured externaly is a good start from a compliance point of view but having OneView's deep integration into the HPE hardware environment as source for getting hardware events into syslog would be really great.

Regards,

Daniel

Re: OneView syslog

PeterWolfe — Tue, 19 Mar 2019 17:07:38 GMT

Most all HW events are forward today as SNMP traps (not via syslog). Those are the specific events from the managed devices. For the OneView alerts in general, there is the State Change Message Bus (and AMPQ-based message bus). You'd need a 'connector' to listen on the bus and place the data in syslog (or splunk or whatever). You could check in the OneView section of HPE's github to see if anyone has developed a canned integration for that. For example, https://github.com/HewlettPackard/oneview-redfish-toolkit look like it does some of what you are after.

Re: OneView syslog

Daniel-L — Wed, 20 Mar 2019 15:11:24 GMT

Hello Peter,

thanks for your sugestion - will have a look into this.

A native syslog implementation would still be highly apreciated.

Regards,

Daniel

Re: OneView syslog

Kamalji — Tue, 26 Mar 2019 09:23:23 GMT

You May check online help of Oneview

Title "Manage audit log forwarding"

You should have Privileges: Infrastructure administrator.

From the main menu, select Settings > Security.

Click the Edit icon in the Security panel or select Actions > Edit.

On the Edit Security screen, under Audit Log, enable Audit log forwarding

For more details refer OneView Online help

Re: OneView syslog

adamcole — Tue, 28 May 2019 14:39:42 GMT

Am I wrong or are the audit logs not in proper syslog format? I can forward to our syslog server but because the hostname is not included with each log it does not know how to classify it. Any way to add the name of the oneview appliance to the audit log?

Re: OneView syslog

adamcole — Tue, 28 May 2019 15:38:16 GMT

Is there a place I need to enter the hostname in order for the audit log to pick it up properly?

Re: OneView syslog

PeterWolfe — Tue, 28 May 2019 18:02:34 GMT

Looks like the forwarded syslog entry is using the appliance's internal hostname (ci-<appliance MAC address>) and not the user-configured appliance hostname.

Re: OneView syslog

adamcole — Tue, 28 May 2019 20:57:29 GMT

Can this be modified in any way? I'm not seeing any name in my logs.

Re: OneView syslog

PeterWolfe — Fri, 31 May 2019 22:59:07 GMT

What logger are you using for your consolidated logging?

The only short term workaround is to fix it the server-side. For eample, if using rsyslog as the consolidated logger, add a stanza for the appliance that changes the message to use the FQDN. For example:

$template appliance1, "%TIMESTAMP% myappliance.example.com %syslogtag%%msg:::sp\
-if-no-1st-sp% %msg:::drop-last-lf%\n"
:hostname, isequal, "ci-005056bf4078" /var/log/messages;appliance1
& ~

There would be an equivalent technique for syslog-ng. It's not pretty, but could tide you over until a fix is avaialble.

Re: OneView syslog

adamcole — Tue, 12 Nov 2019 14:23:40 GMT

There is no appliance name to modify off of server side as there is no appliance name in the logs.

Re: OneView syslog

adamcole — Mon, 03 Jun 2019 16:22:54 GMT

OK - see my issue. I was forwarding to a TCP port. Updated to a UDP port and I am now seeing the logs with the ci-MAC format.

Re: OneView syslog

Darren_Matthews — Thu, 15 Aug 2019 07:58:58 GMT

Finding similar, appreciate the short term workaround but is there a fix going in to make FQDN configurable (or default) for Audit Log Forwarding? I'm assuming this has been captured and being fed in to the enhancement process?

Thanks

Re: OneView syslog

BhaskarV — Fri, 16 Aug 2019 06:06:00 GMT

Hi @Darren_Matthews

The input has been taken.
This issue is being addressed in an upcoming / future patch / release.
Will update this thread once a publicly available release that contains the fix has been announced.

Regards,
Bhaskar