Chapter 20. Using the administration events page
You can view administration event information in a single interface with Red Hat Advanced Cluster Security for Kubernetes (RHACS). You can use this interface to help you understand and interpret important event details.
20.1. Accessing the event logs in different domains
By viewing the administration events page, you can access various event logs in different domains.
Procedure
-
In the RHACS platform, go to Platform Configuration
Administration Events.
20.2. Administration events page overview
The administration events page organizes event information by domain, resource type, severity level, timestamp, and occurrence count to help you understand and diagnose issues.
The page organizes this information into the following groups:
Domain: Categorizes events by the specific area or domain within RHACS in which the event occurred. This classification helps organize and understand the context of events.
RHACS includes the following domains:
-
Authentication -
General -
Image Scanning -
Integrations
-
Resource type: Classifies events based on the resource or component type involved.
RHACS includes the following resource types:
-
API Token -
Cluster -
Image -
Node -
Notifier
-
Level: Indicates the severity or importance of an event.
RHACS includes the following levels:
-
Error -
Warning -
Success -
Info -
Unknown
-
- Event last occurred at: Provides information about the timestamp and date when an event occurred. It helps track the timing of events, which is essential for diagnosing issues and understanding the sequence of actions or incidents.
- Count: Indicates the number of times a particular event occurred. This number is useful in assessing the frequency of an issue. An event that has occurred many times indicates a persistent issue that you need to fix.
Each event also shows you what you need to do to fix the error.
20.3. Getting information about the events in a particular domain
By viewing the details of an administration event, you can better understand the context and details of the events in that particular domain.
Procedure
- In the Administration Events page, click the domain to view its details.
20.4. Administration event details overview
The administration event details page provides log information about errors and events, including resource details, timestamps, and occurrence counts to help you diagnose and fix issues.
The logs offer the following information:
- Context of the event
- Steps to take to fix the error
The administration event page organizes information in the following groups:
Resource type: Classifies events based on the resource or component type involved.
RHACS includes the following resource types:
-
API Token -
Cluster -
Image -
Node -
Notifier
-
- Resource name: Specifies the name of the resource or component to which the event refers. It identifies the specific instance within the domain where the event occurred.
- Event type: Specifies the source of the event. Central generates log events that correspond to administration events created from log statements.
- Event ID: A unique identifier composed of alphanumeric characters that RHACS assigns to each event. Event IDs can be useful in identifying, tracking, and managing events over time.
- Created at: Indicates the timestamp and date when the event was originally created or recorded.
- Last occurred at: Specifies the timestamp and date when the event last occurred. This tracks the timing of the event, which can be critical for diagnosing and fixing recurring issues.
- Count: Indicates the number of times a particular event occurred. This number is useful in assessing the frequency of an issue. An event that has occurred many times indicates a persistent issue that you need to fix.
20.5. Setting the expiration of the administration events
By specifying the number of days, you can control when the administration events expire. This is important for managing your events and ensuring that you retain the information for the required duration.
By default, RHACS retains administration events for 4 days. The retention period for these events depends on the time of the last occurrence and not the time of creation. This means that RHACS expires and deletes an event only if the time of the last occurrence exceeds the specified retention period.
Procedure
In the RHACS portal, go to Platform Configuration
System Configuration. You can configure the following setting for administration events: - Administration events retention days: The number of days to retain your administration events.
- To change this value, click Edit, make your changes, and then click Save.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}