Configure security group logging

Create and manage packet logs to monitor security group traffic flows.

Each log stores data about packet flow events and appends it to a common log file on the instance’s Compute host.

You can associate any instance port with one or more security groups and define one or more rules for each security group. For example, you can create a rule to allow inbound SSH traffic to any virtual machine in a security group. You can create another rule in the same security group to allow virtual machines in that group to initiate and respond to ICMP (ping) messages.

Then you can create logs to record combinations of packet flow events. For example, the following command creates a log to capture all ACCEPT events in the security group, security-group1.

$ openstack network log create my-log1 \
--resource-type security_group \
--resource security-group1 \
--event ACCEPT

You can create multiple logs to capture data about specific combinations of security groups and packet flow events.

You can configure the following parameters:

--resource-type
You must set this required parameter to security_group.
--resource <security_group_name|security_group_ID>
Optional: limit the log to a specific security group. If you do not specify a resource, the log will capture events from all security groups on the specified ports in the project.
--target <port_ID|port_name>
Optional: limit the log to a specific port in the security group. If you do not specify a target, the log will capture events from all ports in the security group in the project.
--event (types of events to log)

You can choose to log the following packet flow events:

  • DROP: Log one DROP log entry for each incoming or outgoing session that is dropped. Note

    If you log dropped traffic on one or more security groups, the Networking service logs dropped traffic on all security groups.

  • ACCEPT: Log one ACCEPT log entry for each new session that is allowed by the security group.
  • ALL (drop and accept): Log all DROP and ACCEPT events. If you do not set –event ACCEPT or –event DROP, the Networking service defaults to ALL.
Note

The Networking service writes all log data to the same file on every Compute node: /var/log/containers/openvswitch/ovn-controller.log.

Sample security group log content
Copy link

Security group log content includes information such as timestamp, status, source, and other relevant data..

Security group log content includes:

  • A timestamp of the packet flow.
  • A status of the flow: ACCEPT or DROP.
  • An indication of the originator of the flow. For example, which project or log resource generated the events.
  • An identifier of the associated instance interface (Neutron port ID).
  • Layer 2, 3 and 4 information such as MAC, address, port, and protocol.
    Example: logged data from an ACCEPT event
    2022-11-30T03:29:12.868Z|00111|acl_log(ovn_pinctrl1)|INFO|name="neutron-bc53f8df-2318-4d08-8e12-89e92b08deec", verdict=allow, severity=info, direction=from-lport: udp,vlan_tci=0x0000,dl_src=fa:16:3e:70:c4:45,dl_dst=fa:16:3e:66:8b:18,nw_src=192.168.100.59,nw_dst=192.168.100.1,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=68,tp_dst=67

Share security groups across projects
Copy link

Share a security group across projects by using RBAC policies.

Before you begin
Copy link

  • You have at least two RHOSO projects that you want to share.
  • In one of the projects, the current project, you have created a security group that you want to share with another project, the target project.

    In this example, the ping_ssh security group is created:

    Example
    $ openstack security group create ping_ssh
  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.

About this task
Copy link

You can apply a security group directly to an instance during instance creation, or to a port on the running instance.

Note

You cannot apply a role-based access control (RBAC)-shared security group directly to an instance during instance creation. To apply an RBAC-shared security group to an instance you must first create the port, apply the shared security group to that port, and then assign that port to the instance. See Add a security group to a port.

Procedure
Copy link

  1. Access the remote shell for the OpenStackClient pod from your workstation: 
    $ oc rsh -n openstack openstackclient
  2. Obtain the names or IDs of the project that contains the security group and the target project. 
    $ openstack project list
  3. Obtain the name or ID of the security group that you want to share between RHOSO projects. 
    $ openstack security group list
  4. Using the identifiers from the previous steps, create an RBAC policy using the openstack network rbac create command.

    In this example, the ID of the target project is 32016615de5d43bb88de99e7f2e26a1e. The ID of the security group is 5ba835b7-22b0-4be6-bdbe-e0722d1b5f24:

    Example
    $ openstack network rbac create --target-project \
32016615de5d43bb88de99e7f2e26a1e --action access_as_shared \
--type security_group 5ba835b7-22b0-4be6-bdbe-e0722d1b5f24
    --target-project

    specifies the project that requires access to the security group.

    Tip

    You can share data between all projects by using the --target-all-projects argument instead of --target-project <target_project>. By default, only the admin user has this privilege.
    --action access_as_shared
    specifies what the project is allowed to do.
    --type
    indicates that the target object is a security group.
    5ba835b7-22b0-4be6-bdbe-e0722d1b5f24

    is the ID of the particular security group which is being granted access to.

    The target project is able to access the security group when running the OpenStack Client security group commands, in addition to being able to bind to its ports. No other users (other than administrators and the owner) are able to access the security group.

    Tip

    To remove access for the target project, delete the RBAC policy that allows it using the openstack network rbac delete command.
  5. Exit the openstackclient pod: 
    $ exit

Verify security group logging is enabled
Copy link

Verify that the Networking service has loaded the logging service plugin and extension.

Before you begin
Copy link

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.

Procedure
Copy link

  1. Access the remote shell for the OpenStackClient pod from your workstation: 
    $ oc rsh -n openstack openstackclient
  2. Enter the following command: 
    $ openstack extension list --network --max-width=72 | grep logging

    If the Networking service has loaded the logging service plugin and extension, the output includes the following:

    | Logging API          | logging              | Provides a logging API |
  3. If the openstack extension list output does not include the Logging API Extension, update the control plane:
    1. Create a YAML file and add the following content: 
      apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: openstack-control-plane
spec:
  neutron:
    template:
      customServiceConfig: |
        [DEFAULT]
        service_plugins=log
    2. Apply the updated OpenStackControlPlane CR configuration: 
      $ oc apply -f <control_plane_update.yaml>
      • Replace <control_plane_updates.yaml> with the name of the YAML file that contains your update.
  4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Check the status of the control plane deployment: 
    $ oc get openstackcontrolplane -n openstack
    Sample output
    NAME                      STATUS    MESSAGE
openstack-control-plane   Unknown   Setup started

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip

    Append the -w option to the get command to track deployment progress.

Results
Copy link

  • Confirm that the Networking service has successfully loaded the Logging API Extension by repeating step 1.

Monitor security group traffic with log objects
Copy link

Create log objects with the resource type security_group.

Before you begin
Copy link

  • The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud.
  • The python-openstackclient package is on your workstation. 
    $ dnf list installed python-openstackclient
  • You have created security groups.
  • You have created security group rules for the security groups.
  • You have assigned ports to the security groups.

Procedure
Copy link

  1. Confirm that the system OS_CLOUD variable is set for your cloud: 
    $ echo $OS_CLOUD
my_cloud

    Reset the variable if necessary:

    $ export OS_CLOUD=my_other_cloud

    As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

  2. Create a log by using the openstack network log create command with the appropriate set of arguments.
    Example 1: Log ACCEPT events from the security group sg1 on all ports
    $ openstack network log create my-log1 \
--resource-type security_group \
--resource sg1 \
–event ACCEPT
    Example 2: Log ACCEPT events from all security groups on all ports
    openstack network log create my-log3 \
--resource-type security_group \
–event ACCEPT

    Verification

    Confirm that the that the log was created:

    $ openstack network log list

List and view security group log objects
Copy link

List and view security group log objects to monitor network traffic and verify security configurations.

Before you begin
Copy link

  • The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud.
  • The python-openstackclient package is on your workstation. 
    $ dnf list installed python-openstackclient
  • You have created security groups.
  • You have created security group rules for the security groups.
  • You have assigned ports to the security groups.

Procedure
Copy link

  1. Confirm that the system OS_CLOUD variable is set for your cloud: 
    $ echo $OS_CLOUD
my_cloud

    Reset the variable if necessary:

    $ export OS_CLOUD=my_other_cloud

    As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

  2. To list all log objects in a project: 
    $ openstack network log list
  3. To view details of a log object: 
    $ openstack network log show <log_object_name>
    • Replace <log_object_name> with the name of the log object.

Control security group logging activity
Copy link

Enable or disable security group log objects to control logging activity and reduce resource overhead.

Before you begin
Copy link

  • The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud.
  • The python-openstackclient package is on your workstation. 
    $ dnf list installed python-openstackclient
  • You have created security groups.
  • You have created security group rules for the security groups.
  • You have assigned ports to the security groups.

Procedure
Copy link

  1. Confirm that the system OS_CLOUD variable is set for your cloud: 
    $ echo $OS_CLOUD
my_cloud

    Reset the variable if necessary:

    $ export OS_CLOUD=my_other_cloud

    As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

  2. To disable a log object, enter the following command: 
    $ openstack network log set --disable <log_object_name>
    • Replace <log_object_name> with the name of the log object.
  3. To enable a log object, enter the following command: 
    $ openstack network log set --enable <log_object_name>
    • Replace <log_object_name> with the name of the log object.

Organize logging with descriptive log names
Copy link

Rename a security group log object to assign a descriptive name for easier identification and organization.

Before you begin
Copy link

  • The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud.
  • The python-openstackclient package is on your workstation. 
    $ dnf list installed python-openstackclient
  • You have created security groups.
  • You have created security group rules for the security groups.
  • You have assigned ports to the security groups.

Procedure
Copy link

  1. Confirm that the system OS_CLOUD variable is set for your cloud: 
    $ echo $OS_CLOUD
my_cloud

    Reset the variable if necessary:

    $ export OS_CLOUD=my_other_cloud

    As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

  2. To rename a log object, enter the following command: 
    $ openstack network log set --name <new_log_object_name> <object>
    • Replace <new_log_object_name> with the new name of the log object.
    • Replace <object> with the old name or ID of the log object.

Delete security group log objects
Copy link

Delete security group log objects to remove unused log collectors and optimize system resources.

Before you begin
Copy link

  • The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud.
  • The python-openstackclient package is on your workstation. 
    $ dnf list installed python-openstackclient
  • You have created security groups.
  • You have created security group rules for the security groups.
  • You have assigned ports to the security groups.

Procedure
Copy link

  1. Confirm that the system OS_CLOUD variable is set for your cloud: 
    $ echo $OS_CLOUD
my_cloud

    Reset the variable if necessary:

    $ export OS_CLOUD=my_other_cloud

    As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

  2. To delete one or more log objects, enter the following command: 
    $ openstack network log delete <log_object_name> [<log_object_name> ...]

    Replace <log_object_name> with the name of the log object to delete. To delete multiple log objects, enter a list of log object names, separated by spaces.

Accessing security group log content
Copy link

The Networking service (neutron) aggregates security group logs from all instances on a Compute node in one location: /var/log/containers/openvswitch/ovn-controller.log.

The log file contains other log objects. Security group log entries include the string acl_log.

Adjust rate and burst limits for security group logging
Copy link

Adjust rate and burst limits to optimize security group logging.

Before you begin
Copy link

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.
  • The Networking service (neutron) has loaded the logging service plugin and the logging extension.

    For more information, see Verify security group logging is enabled.

About this task
Copy link

the Networking service (neutron) limits the maximum number of packets that it logs per second. You can adjust rate and burst limits to optimize logging for your environment.

The Networking service limits the maximum number of packets that it logs per second with the rate_limit_interval parameter. The default value is 100 packets per second.

When the number of packets the Networking service logs reaches the rate limit, the Networking service queues the excess packets to be logged with the rate_limit_burst parameter. The default value is 25 packets in the log queue.

You can modify the values of these parameters to meet the logging requirements of your networks.

Logging rate and burst limits do not limit control of data traffic. They limit only the transmission of logging data.

Procedure
Copy link

  1. Create a YAML file and add the following content: 
    apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: openstack-control-plane
spec:
  neutron:
    template:
      customServiceConfig: |
        [network_log]
        rate_limit: <logged_packets>
        burst_limit: <queued_packets>
    • Replace <logged_packets> with the maximum number of packets that can be logged per second.
    • Replace <queued_packets> with the maximum number of packets that can be placed in the queue to be logged per second.
  2. Apply the updated OpenStackControlPlane CR configuration: 
    $ oc apply -f <control_plane_update.yaml>
    • Replace <control_plane_update.yaml> with the name of the YAML file that contains your update.
  3. Wait until Red Hat OpenShift Container Platform (RHOCP) creates the resources related to the OpenStackControlPlane CR. Check the status of the control plane deployment: 
    $ oc get openstackcontrolplane -n OPENSTACK
    Sample output
    NAME                      STATUS    MESSAGE
openstack-control-plane   Unknown   Setup started

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip

    Append the -w option to the get command to track deployment progress.

Results
Copy link

  • Confirm that your rate and burst configuration changes are updated.

    Create one log object, and verify the meter band entry:

    $ oc rsh -n openstack ovsdbserver-nb-0 ovn-nbctl --no-leader list meter-band
     
    _uuid               : 721334bc-8e45-417a-a523-9e4d56dd97c3
action              : drop
burst_size          : 55
external_ids        : {}
rate                : 132