Chapter 8. Logging security group actions In Red Hat OpenStack Services on OpenShift (RHOSO) environments, to monitor traffic flows into and out of a virtual machine (VM) instance, you can create packet logs for security groups. Each log generates a stream of data about packet flow events and appends it to a common log file on the Compute host from which the VM instance was launched. You can associate any instance port with one or more security groups and define one or more rules for each security group. For example, you can create a rule to allow inbound SSH traffic to any virtual machine in a security group. You can create another rule in the same security group to allow virtual machines in that group to initiate and respond to ICMP (ping) messages. Then you can create logs to record combinations of packet flow events. For example, the following command creates a log to capture all ACCEPT events in the security group, security-group1 . USD openstack network log create my-log1 \ --resource-type security_group \ --resource security-group1 \ --event ACCEPT You can create multiple logs to capture data about specific combinations of security groups and packet flow events. You can configure the following parameters: --resource-type You must set this required parameter to security_group . --resource <security_group_name|security_group_ID> Optional: limit the log to a specific security group. If you do not specify a resource, the log will capture events from all security groups on the specified ports in the project. --target <port_ID|port_name> Optional: limit the log to a specific port in the security group. If you do not specify a target, the log will capture events from all ports in the security group in the project. --event (types of events to log) You can choose to log the following packet flow events: DROP : Log one DROP log entry for each incoming or outgoing session that is dropped. Note If you log dropped traffic on one or more security groups, the Networking service logs dropped traffic on all security groups. ACCEPT : Log one ACCEPT log entry for each new session that is allowed by the security group. ALL (drop and accept): Log all DROP and ACCEPT events. If you do not set -event ACCEPT or -event DROP , the Networking service defaults to ALL . Note The Networking service writes all log data to the same file on every Compute node: /var/log/containers/openvswitch/ovn-controller.log . This section contains the following topics: Section 8.1, "Verifying that security group logging is enabled" Section 8.2, "Creating log objects for security groups" Section 8.3, "Listing and viewing log objects for security groups" Section 8.4, "Enabling and disabling log objects for security groups" Section 8.5, "Renaming a log object for security groups" Section 8.6, "Deleting a log object for security groups" Section 8.7, "Accessing security group log content" Section 8.8, "Sample security group log content" Section 8.9, "Adjusting rate and burst limits for security group logging" 8.1. Verifying that security group logging is enabled To prepare your Red Hat OpenStack Services on OpenShift (RHOSO) environment for network packet logging, ensure that the Networking service (neutron) has loaded the logging service plug-in and the logging extension. Prerequisites You have the oc command line tool installed on your workstation. You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges. Procedure Access the remote shell for the OpenStackClient pod from your workstation: Enter the following command: USD openstack extension list --network --max-width=72 | grep logging If the Networking service has loaded the logging service plug-in and extension, the output includes the following: | Logging API | logging | Provides a logging API | If the openstack extension list output does not include the Logging API Extension , update the control plane: Create a YAML file and add the following content: apiVersion: core.openstack.org/v1beta1 kind: OpenStackControlPlane metadata: name: openstack-control-plane spec: neutron: template: customServiceConfig: | [DEFAULT] service_plugins=log Apply the updated OpenStackControlPlane CR configuration: USD oc apply -f <control_plane_update.yaml> Replace <control_plane_updates.yaml> with the name of the YAML file that contains your update. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Check the status of the control plane deployment: USD oc get openstackcontrolplane -n openstack Sample output NAME STATUS MESSAGE openstack-control-plane Unknown Setup started The OpenStackControlPlane resources are created when the status is "Setup complete". Tip Append the -w option to the get command to track deployment progress. Verification Confirm that the Networking service has successfully loaded the Logging API Extension by repeating step 1. Additional resources extension list in the Command line interface reference 8.2. Creating log objects for security groups In Red Hat OpenStack Services on OpenShift (RHOSO) environments, you create log objects with the resource type security_group . Prerequisites The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud. The python-openstackclient package resides on your workstation. You have created security groups. You have created security group rules for the security groups. You have assigned ports to the security groups. Procedure Confirm that the system OS_CLOUD variable is set for your cloud: USD echo USDOS_CLOUD my_cloud Reset the variable if necessary: USD export OS_CLOUD=my_other_cloud As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command. Create a log by using the openstack network log create command with the appropriate set of arguments. Example 1: Log ACCEPT events from the security group sg1 on all ports USD openstack network log create my-log1 \ --resource-type security_group \ --resource sg1 \ -event ACCEPT Example 2: Log ACCEPT events from all security groups on all ports openstack network log create my-log3 \ --resource-type security_group \ -event ACCEPT Verification Confirm that the that the log was created: USD openstack network log list Additional resources Configuring security groups network log create in the Command line interface reference network log list in the Command line interface reference 8.3. Listing and viewing log objects for security groups In Red Hat OpenStack Services on OpenShift (RHOSO) environments, you can list and view security group log objects. Prerequisites The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud. The python-openstackclient package resides on your workstation. You have created security groups. You have created security group rules for the security groups. You have assigned ports to the security groups. Procedure Confirm that the system OS_CLOUD variable is set for your cloud: USD echo USDOS_CLOUD my_cloud Reset the variable if necessary: USD export OS_CLOUD=my_other_cloud As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command. To list all log objects in a project: USD openstack network log list To view details of a log object: USD openstack network log show <log_object_name> Replace <log_object_name> with the name of the log object. Additional resources network log list in the Command line interface reference network log show in the Command line interface reference 8.4. Enabling and disabling log objects for security groups In Red Hat OpenStack Services on OpenShift (RHOSO) environments, when you create a log object, it is enabled by default. You can disable or enable a log object. Prerequisites The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud. The python-openstackclient package resides on your workstation. You have created security groups. You have created security group rules for the security groups. You have assigned ports to the security groups. Procedure Confirm that the system OS_CLOUD variable is set for your cloud: USD echo USDOS_CLOUD my_cloud Reset the variable if necessary: USD export OS_CLOUD=my_other_cloud As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command. To disable a log object, enter the following command: USD openstack network log set --disable <log_object_name> Replace <log_object_name> with the name of the log object. To enable a log object, enter the following command: USD openstack network log set --enable <log_object_name> Replace <log_object_name> with the name of the log object. Additional resources network log set in the Command line interface reference 8.5. Renaming a log object for security groups In Red Hat OpenStack Services on OpenShift (RHOSO) environments, you can change the name of a log object. Prerequisites The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud. The python-openstackclient package resides on your workstation. You have created security groups. You have created security group rules for the security groups. You have assigned ports to the security groups. Procedure Confirm that the system OS_CLOUD variable is set for your cloud: USD echo USDOS_CLOUD my_cloud Reset the variable if necessary: USD export OS_CLOUD=my_other_cloud As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command. To rename a log object, enter the following command: USD openstack network log set --name <new_log_object_name> <object> Replace <new_log_object_name> with the new name of the log object. Replace <object> with the old name or ID of the log object. Additional resources network log set in the Command line interface reference 8.6. Deleting a log object for security groups In Red Hat OpenStack Services on OpenShift (RHOSO) environments, you can delete log objects. Prerequisites The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud. The python-openstackclient package resides on your workstation. You have created security groups. You have created security group rules for the security groups. You have assigned ports to the security groups. Procedure Confirm that the system OS_CLOUD variable is set for your cloud: USD echo USDOS_CLOUD my_cloud Reset the variable if necessary: USD export OS_CLOUD=my_other_cloud As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command. To delete one or more log objects, enter the following command: USD openstack network log delete <log_object_name> [<log_object_name> ...] Replace <log_object_name> with the name of the log object to delete. To delete multiple log objects, enter a list of log object names, separated by spaces. Additional resources network log delete in the Command line interface reference 8.7. Accessing security group log content The {rhos-long} Networking service (neutron) aggregates security group logs from all instances on a Compute node in one location: /var/log/containers/openvswitch/ovn-controller.log . The log file contains other log objects. Security group log entries include the string acl_log . 8.8. Sample security group log content In Red Hat OpenStack Services on OpenShift (RHOSO) environments, security group log content includes the following data: A timestamp of the packet flow. A status of the flow: ACCEPT or DROP . An indication of the originator of the flow. For example, which project or log resource generated the events. An identifier of the associated instance interface (Neutron port ID). Layer 2, 3 and 4 information such as MAC, address, port, and protocol. Example: logged data from an ACCEPT event 2022-11-30T03:29:12.868Z|00111|acl_log(ovn_pinctrl1)|INFO|name="neutron-bc53f8df-2318-4d08-8e12-89e92b08deec", verdict=allow, severity=info, direction=from-lport: udp,vlan_tci=0x0000,dl_src=fa:16:3e:70:c4:45,dl_dst=fa:16:3e:66:8b:18,nw_src=192.168.100.59,nw_dst=192.168.100.1,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=68,tp_dst=67 8.9. Adjusting rate and burst limits for security group logging In Red Hat OpenStack Services on OpenShift (RHOSO) environments, to avoid overwhelming the control plane with the transmission of logging data, the Networking service (neutron) limits on the maximum number of packets that it logs per second with the rate_limit_interval parameter. The default value is 100 packets per second. When the number of packets the Networking service logs reaches the rate limit, the Networking service queues the excess packets to be logged with the rate_limit_burst parameter. The default value is 25 packets in the log queue. You can modify the values of these parameters to meet the logging requirements of your networks. Logging rate and burst limits do not limit control of data traffic. They limit only the transmission of logging data. Prerequisites You have the oc command line tool installed on your workstation. You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges. The Networking service (neutron) has loaded the logging service plug-in and the logging extension. For more information, see Section 8.1, "Verifying that security group logging is enabled" . Procedure Create a YAML file and add the following content: apiVersion: core.openstack.org/v1beta1 kind: OpenStackControlPlane metadata: name: openstack-control-plane spec: neutron: template: customServiceConfig: | [network_log] rate_limit: <logged_packets> burst_limit: <queued_packets> Replace <logged_packets> with the maximum number of packets that can be logged per second. Replace <queued_packets> with the maximum number of packets that can be placed in the queue to be logged per second. Apply the updated OpenStackControlPlane CR configuration: USD oc apply -f <control_plane_update.yaml> Replace <control_plane_update.yaml> with the name of the YAML file that contains your update. Wait until Red Hat OpenShift Container Platform (RHOCP) creates the resources related to the OpenStackControlPlane CR. Check the status of the control plane deployment: USD oc get openstackcontrolplane -n OPENSTACK Sample output NAME STATUS MESSAGE openstack-control-plane Unknown Setup started The OpenStackControlPlane resources are created when the status is "Setup complete". Tip Append the -w option to the get command to track deployment progress. Verification Confirm that your rate and burst configuration changes are updated. Create one log object, and verify the meter band entry: USD oc rsh -n openstack ovsdbserver-nb-0 ovn-nbctl --no-leader list meter-band Additional resources Section 8.1, "Verifying that security group logging is enabled" Section 8.2, "Creating log objects for security groups"

Commands:
openstack network log create my-log1 --resource-type security_group --resource security-group1 --event ACCEPT
oc rsh -n openstack openstackclient
openstack extension list --network --max-width=72 | grep logging
| Logging API | logging | Provides a logging API |
apiVersion: core.openstack.org/v1beta1 kind: OpenStackControlPlane metadata: name: openstack-control-plane spec: neutron: template: customServiceConfig: | [DEFAULT] service_plugins=log
oc apply -f <control_plane_update.yaml>
oc get openstackcontrolplane -n openstack
NAME STATUS MESSAGE openstack-control-plane Unknown Setup started
dnf list installed python-openstackclient
echo USDOS_CLOUD my_cloud
export OS_CLOUD=my_other_cloud
openstack network log create my-log1 --resource-type security_group --resource sg1 -event ACCEPT
openstack network log create my-log3 --resource-type security_group -event ACCEPT
openstack network log list
dnf list installed python-openstackclient
echo USDOS_CLOUD my_cloud
export OS_CLOUD=my_other_cloud
openstack network log list
openstack network log show <log_object_name>
dnf list installed python-openstackclient
echo USDOS_CLOUD my_cloud
export OS_CLOUD=my_other_cloud
openstack network log set --disable <log_object_name>
openstack network log set --enable <log_object_name>
dnf list installed python-openstackclient
echo USDOS_CLOUD my_cloud
export OS_CLOUD=my_other_cloud
openstack network log set --name <new_log_object_name> <object>
dnf list installed python-openstackclient
echo USDOS_CLOUD my_cloud
export OS_CLOUD=my_other_cloud
openstack network log delete <log_object_name> [<log_object_name> ...]
2022-11-30T03:29:12.868Z|00111|acl_log(ovn_pinctrl1)|INFO|name="neutron-bc53f8df-2318-4d08-8e12-89e92b08deec", verdict=allow, severity=info, direction=from-lport: udp,vlan_tci=0x0000,dl_src=fa:16:3e:70:c4:45,dl_dst=fa:16:3e:66:8b:18,nw_src=192.168.100.59,nw_dst=192.168.100.1,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=68,tp_dst=67
apiVersion: core.openstack.org/v1beta1 kind: OpenStackControlPlane metadata: name: openstack-control-plane spec: neutron: template: customServiceConfig: | [network_log] rate_limit: <logged_packets> burst_limit: <queued_packets>
oc apply -f <control_plane_update.yaml>
oc get openstackcontrolplane -n OPENSTACK
NAME STATUS MESSAGE openstack-control-plane Unknown Setup started
oc rsh -n openstack ovsdbserver-nb-0 ovn-nbctl --no-leader list meter-band
_uuid : 721334bc-8e45-417a-a523-9e4d56dd97c3 action : drop burst_size : 55 external_ids : {} rate : 132