CADF Keystone setup

gistfile1.txt

Very Basic Inspector Environment Set Up for Keystone CADF events  (Complete WIP, Do not trust this yet!)

Install / Vagrant up Ubuntu 14.04 or later

clone devstack

git clone https://git.openstack.org/openstack-dev/devstack

My localrc

FLOATING_RANGE=192.168.1.224/27
FIXED_RANGE=10.11.12.0/24
FIXED_NETWORK_SIZE=256
FLAT_INTERFACE=eth0
RECLONE=yes
ENABLED_SERVICES=key,ceilometer-acentral,ceilometer-acompute,ceilometer-alarm-evaluator,ceilometer-alarm-notifier,ceilometer-anotification,ceilometer-api,ceilometer-collector,g-api,g-reg,n-api,n-crt,n-obj,n-cpu,n-net,n-cond,cinder,c-sch,c-api,c-vol,n-sch,n-cauth,horizon,mysql,rabbit
SERVICE_TOKEN=openstack
ADMIN_PASSWORD=openstack
MYSQL_PASSWORD=openstack
RABBIT_PASSWORD=openstack
SERVICE_PASSWORD=openstack
LOGFILE=/opt/stack/logs/stack.sh.log
LIBS_FROM_GIT=python-keystoneclient,python-openstackclient

Edit keystone.conf and make (or amend!) the following


notification_format = cadf
notification_driver = messaging
notification_driver = log 


Generate an event

 . openrc admin admin
openstack user create cadf_test --os-identity-api-version 3 --os-auth-url http://<your_ip>:5000/v3 --os-default-domain default

View the event

ceilometer event-list --query event_type=identity.user.created