Chapter 5. System tags and groups Red Hat Insights for Red Hat Enterprise Linux enables administrators to filter groups of systems in inventory and in individual services using group tags. Groups are identified by the method of system data ingestion to Insights for Red Hat Enterprise Linux. Insights for Red Hat Enterprise Linux enables filtering groups of systems by those running SAP workloads, by Satellite host group, by Microsoft SQL Server workload, and by custom tags that are defined by system administrators with root access to configure the Insights client on the system. Note As of Spring 2022, inventory, advisor, compliance, vulnerability, patch, and policies enable filtering by groups and tags. Other services will follow. Important Unlike the other services that enable tagging, the compliance service sets tags within lists of systems in the compliance service UI. For more information, see the following section Group and tag filters in the compliance service . Use the global, Filter results box to filter by SAP workloads, Satellite host groups, MS SQL Server workloads, or by custom tags added to the Insights client configuration file. Prerequisites The following prerequisites and conditions must be met to use the tagging features in Red Hat Insights for Red Hat Enterprise Linux: The Red Hat Insights client is installed and registered on each system. You must have root permissions, or their equivalent, to create custom tags or change the /etc/insights-client/tags.yaml file. 5.1. Group and tag filters in the compliance service The compliance service enables users to apply tag and group filters to systems reporting compliance data; however, they are not set using the Filter by status dropdown. Unlike most of the other services in the Insights for Red Hat Enterprise Linux application, the compliance service only shows data for systems under the following conditions: The system is associated with a compliance service security policy. The system is reporting compliance data to insights using the insights-client --compliance command. Because of those conditions, compliance-service users have to set tag and group filters using the primary and secondary filters located above lists of systems in the compliance service UI. Tag and group filters above systems list in the compliance service 5.2. SAP workloads As Linux becomes the mandatory operating system for SAP ERP workloads in 2025, Red Hat Enterprise Linux and Red Hat Insights for Red Hat Enterprise Linux are working to make Insights for Red Hat Enterprise Linux the management tool of choice for SAP administrators. As part of this ongoing effort, Insights for Red Hat Enterprise Linux automatically tags systems running SAP workloads and by SAP ID (SID), without any customization needed by administrators. Users can easily filter those workloads throughout the Insights for Red Hat Enterprise Linux application by using the global Filter by tags drop-down menu. 5.3. Satellite host groups Satellite host groups are configured in Satellite and recognized automatically by Insights for Red Hat Enterprise Linux. 5.4. Microsoft SQL Server workloads Using the global Filter by tags feature, Red Hat Insights for Red Hat Enterprise Linux users can select groups of systems running Microsoft SQL Server workloads. In May of 2019, the Red Hat Insights team introduced a new set of Insights for Red Hat Enterprise Linux recommendations for Microsoft SQL Server running on Red Hat Enterprise Linux (RHEL). These rules alert administrators to operating system level configurations that do not conform to the documented recommendations from Microsoft and Red Hat. A limitation of these rules was that they primarily analyzed the operating system and not the database itself. The latest release of Insights for Red Hat Enterprise Linux and RHEL 8.5, introduces Microsoft SQL Assessment API. The SQL Assessment API provides a mechanism to evaluate the database configuration of MS SQL Server for best practices. The API is delivered with a rule set containing best practice rules suggested by the Microsoft SQL Server Team. While this rule set is enhanced with the release of new versions, the API is built with the intent to give a highly customizable and extensible solution, which enables users to tune the default rules and create their own. The SQL Assessment API is supported by PowerShell for Linux (available from Microsoft), and Microsoft has developed a PowerShell script that can be used to call the API and store its results as a JSON formatted file. With RHEL 8.5, the Insights client now uploads this JSON file and presents the results in an easy-to-understand format in the Insights for Red Hat Enterprise Linux UI. For more information about SQL Server assessment in Insights for Red Hat Enterprise Linux, see SQL Server database best practices now available through Red Hat Insights . 5.4.1. Setting up SQL Server assessments To configure the Microsoft SQL Assessment API to provide information to Red Hat Insights, the database administrator needs to take the following steps. Procedure In the database you wish to assess, create a login for SQL Server assessments using SQL Authentication. The following Transact-SQL creates a login. Replace <*PASSWORD*> with a strong password: Store the credentials for login on the system as follows, again replacing <*PASSWORD*> with the password you used in step 1. Secure the credentials used by the assessment tool by ensuring that only the mssql user can access the credentials. Download PowerShell from the microsoft-tools repository. This is the same repository you configured when you installed the mssql-tools and mssqlodbc17 packages as part of SQL Server installation. Install the SQLServer module for PowerShell. This module includes the assessment API. Download the runassessment script from the Microsoft examples GitHub repository. Ensure it is owned and executable by mssql. Create the directory that will store the log file used by Red Hat Insights. Again, make sure it is owned and executable by mssql. You can now create your first assessment, but be sure to do so as the user mssql so that subsequent assessments can be run automatically via cron or systemd more securely as the mssql user. Insights for Red Hat Enterprise Linux will automatically include the assessment time it runs, or you can initiate Insights client by running this command: 5.4.1.1. Setting up the SQL Assessment on a timer Because SQL Server Assessments can take 10 minutes or more to complete, it may or may not make sense for you to run the assessment process automatically every day. If you would like to run them automatically, the Red Hat SQL Server community has created systemd service and timer files to use with the assessment tool. Procedure Download the following files from Red Hat public SQL Server Community of Practice GitHub site . mssql-runassessment.service mssql-runassessment.timer Install both files in the directory /etc/systemd/system/ : Enable the timer with: 5.5. Custom system tagging By applying custom grouping and tagging to your systems, you can add contextual markers to individual systems, filter by those tags in the Insights for Red Hat Enterprise Linux application, and more easily focus on related systems. This functionality can be especially valuable when deploying Insights for Red Hat Enterprise Linux at scale, with many hundreds or thousands of systems under management. In addition to the ability to add custom tags to several Insights for Red Hat Enterprise Linux services, you can add predefined tags. The advisor service can use those tags to create targeted recommendations for your systems that might require more attention, such as those systems that require a higher level of security. Note To create custom and predefined tags, you must have root permissions, or their equivalent, to add to, or change the /etc/insights-client/tags.yaml file. 5.5.1. Tag structure Tags use a namespace/key=value paired structure. Namespace. The namespace is the name of the ingestion point, insights-client , and cannot be changed. The tags.yaml file is abstracted from the namespace, which is injected by the Insights client before upload. Key. The key can be a user-chosen key or a predefined key from the system. You can use a mix of capitalization, letters, numbers, symbols and whitespace. Value. Define your own descriptive string value. You can use a mix of capitalization, letters, numbers, symbols and whitespace. Note The advisor service includes Red Hat-supported predefined tags. 5.5.2. Creating a tags.yaml file and adding a custom group Create and add tags to /etc/insights-client/tags.yaml simply by using insights-client --group=<name-you-choose> , which performs the following actions: Creates the etc/insights-client/tags.yaml file Adds the group= key and <name-you-choose> value to tags.yaml Uploads a fresh archive from the system to the Insights for Red Hat Enterprise Linux application so the new tag is immediately visible along with your latest results After creating the initial group tag, add additional tags as needed by editing the /etc/insights-client/tags.yaml file. The following procedure shows how to create the /etc/insights-client/tags.yaml file and the initial group, then verify the tag exists in the Insights for Red Hat Enterprise Linux inventory. Procedure to create new group Run the following command as root, adding your custom group name after --group= : Example of tags.yaml format The following example of a tags.yaml file shows an example of file format and additional tags added for the new group: Procedure to verify your custom group was created Navigate to Red Hat Insights > RHEL > Inventory and log in if necessary. Click the Filter results dropdown menu. Scroll through the list or use the search function to locate the tag. Click the tag to filter by it. Verify that your system is among the results on the advisor systems list. Procedure to verify that the system is tagged Navigate to Red Hat Insights > RHEL > Inventory and log in if necessary. Activate the Name filter and begin typing the system name until you see your system, then select it. Verify that, to the system name, the tag symbol is darkened and shows a number representing the correct number of tags applied. 5.5.3. Editing tags.yaml to add or change tags After creating the group filter, edit the contents of /etc/insights-client/tags.yaml as needed to add or modify tags. Procedure Using the command line, open the tag configuration file for editing. [root@server ~]# vi /etc/insights-client/tags.yaml Edit content or add additional values as needed. The following example shows how you can organize tags.yaml when adding multiple tags to a system. Note Add as many key=value pairs as you need. Use a mix of capitalization, letters, numbers, symbols, and whitespace. Save your changes and close the editor. Optionally, generate an upload to Insights for Red Hat Enterprise Linux. 5.5.4. Using predefined system tags to get more accurate Red Hat Insights advisor service recommendations and enhanced security Red Hat Insights advisor service recommendations treat every system equally. However, some systems might require more security than others, or require different networking performance levels. In addition to the ability to add custom tags, Red Hat Insights for Red Hat Enterprise Linux provides predefined tags that the advisor service can use to create targeted recommendations for your systems that might require more attention. To opt in and get the extended security hardening and enhanced detection and remediation capabilities offered by predefined tags, you need to configure the tags. After configuration, the advisor service provides recommendations based on tailored severity levels, and preferred network performance that apply to your systems. To configure the tags, use the /etc/insights-client/tags.yaml file to tag systems with predefined tags in a similar way that you might use it to tag systems in the inventory service. The predefined tags are configured using the same key=value structure used to create custom tags. Details about the Red Hat-predefined tags are in the following table. Table 5.1. List of Supported Predefined Tags Key Value Note security normal (default) / strict With the normal (default) value, the advisor service compares the system's risk profile to a baseline derived from the default configuration of the most recent version of RHEL and from often-used usage patterns. This keeps recommendations focused, actionable, and low in numbers. With the strict value, the advisor service considers the system to be security-sensitive, causing specific recommendations to use a stricter baseline, potentially showing recommendations even on fresh up-to-date RHEL installations. network_performance null (default) / latency / throughput The preferred network performance (either latency or throughput according to your business requirement) would affect the severity of an advisor service recommendation to a system. Note The predefined tag keys names are reserved. If you already use the key security , with a value that differs from one of the predefined values, you will not see a change in your recommendations. You will only see a change in recommendations if your existing key=value is the same as one of the predefined keys. For example, if you have a key=value of security: high , your recommendations will not change because of the Red Hat-predefined tags. If you currently have a key=value pair of security: strict , you will see a change in the recommendations for your systems. Additional resources Using system tags to enable extended security hardening recommendations Leverage tags to make Red Hat Insights Advisor recommendations understand your environment better System tags and groups 5.5.5. Configuring predefined tags You can use the Red Hat Insights for Red Hat Enterprise Linux advisor service's predefined tags to adjust the behavior of recommendations for your systems to gain extended security hardening and enhanced detection and remediation capabilities. You can configure the predefined tags by following this procedure. Prerequisites You have root-level access to your system You have Insights client installed You have systems registered within the Insights client You have created the tags.yaml file. For information about creating the tags.yaml file, see Creating a tags.yaml file and adding a custom group . Procedure Using the command line, and your preferred editor, open /etc/insights-client/tags.yaml . (The following example uses Vim.) Edit the /etc/insights-client/tags.yaml file to add the predefined key=value pair for the tags. This example shows how to add security: strict and network_performance: latency tags. Save your changes. Close the editor. Optional: Run the insights-client command to generate an upload to Red Hat Insights for Red Hat Enterprise Linux, or wait until the scheduled Red Hat Insights upload. Confirming that predefined tags are in your production area After generating an upload to Red Hat Insights (or waiting for the scheduled Insights upload), you can find out whether the tags are in the production environment by accessing Red Hat Insights > RHEL > Inventory . Find your system and look for the newly created tags. You see a table that shows: Name Value Tag Source (for example, insights-client). The following image shows an example of what you see in inventory after creating the tag. Example of recommendations after applying a predefined tag The following image of the advisor service shows a system with the network_performance: latency tag configured. The system shows a recommendation with a higher Total Risk level of Important. The system without the network_performance: latency tag has a Total Risk of Moderate. You can make decisions about prioritizing the system with higher Total Risk.

Commands:
USE [master] GO CREATE LOGIN [assessmentLogin] with PASSWORD= N'<*PASSWORD*>' ALTER SERVER ROLE [sysadmin] ADD MEMBER [assessmentLogin] GO
echo "assessmentLogin" > /var/opt/mssql/secrets/assessment echo "<*PASSWORD*>" >> /var/opt/mssql/secrets/assessment
chmod 0600 /var/opt/mssql/secrets/assessment chown mssql:mssql /var/opt/mssql/secrets/assessment
yum -y install powershell
su mssql -c "/usr/bin/pwsh -Command Install-Module SqlServer"
/bin/curl -LJ0 -o /opt/mssql/bin/runassessment.ps1 https://raw.githubusercontent.com/microsoft/sql-server-samples/master/samples/manage/sql-assessment-api/RHEL/runassessment.ps1 chown mssql:mssql /opt/mssql/bin/runassessment.ps1 chmod 0700 /opt/mssql/bin/runassessment.ps1
mkdir /var/opt/mssql/log/assessments/ chown mssql:mssql /var/opt/mssql/log/assessments/ chmod 0700 /var/opt/mssql/log/assessments/
su mssql -c "pwsh -File /opt/mssql/bin/runassessment.ps1"
insights-client
cp mssql-runassessment.service /etc/systemd/system/ cp mssql-runassessment.timer /etc/systemd/system/ chmod 644 /etc/systemd/system/
systemctl enable --now mssql-runassessment.timer
insights-client --group=<name-you-choose>
tags --- group: eastern-sap name: Jane Example contact: jexample@corporate.com Zone: eastern time zone Location: - gray_rack - basement Application: SAP
tags --- group: eastern-sap location: Boston description: - RHEL8 - SAP key 4: value
insights-client
vi /etc/insights-client/tags.yaml
cat /etc/insights-client/tags.yaml group: redhat location: Brisbane/Australia description: - RHEL8 - SAP security: strict network_performance: latency
insights-client