Wiki

The following will get you basic set up that will allow you to generate cadf messages within ceilometer from keystone. This should be considered a work in progress guide and therefore open to expansion.

1. Grab devstack:

  git clone https://git.openstack.org/openstack-dev/devstack

2. Set up a local.conf

  [[local|localrc]]
  HOST_IP=192.168.0.48
  FLOATING_RANGE=192.168.0.224/27
  FIXED_RANGE=10.11.12.0/24
  FIXED_NETWORK_SIZE=256
  FLAT_INTERFACE=eth0
  enable_plugin ceilometer https://git.openstack.org/openstack/ceilometer.git
  SERVICE_TOKEN=cadftest
  SERVICE_TOKEN=p6ssw0rd
  ADMIN_PASSWORD=p6ssw0rd
  MYSQL_PASSWORD=p6ssw0rd
  RABBIT_PASSWORD=p6ssw0rd
  SERVICE_PASSWORD=p6ssw0rd
  LOGFILE=/opt/stack/logs/stack.sh.log
  LIBS_FROM_GIT=python-keystoneclient,python-openstackclient

3 . After devstack completes, edit keystone.conf and make (or amend!) the following

  notification_format = cadf
  notification_driver = messaging
  notification_driver = log 

Note: For Liberty the formatting has changed, and now exists as follows

  driver = messaging
  driver = log

The above enables logging to both ceilometer and keystones log file (apache log)

Generate an event

4. Source admin credentials

  . openrc admin admin

5. Create a user in keystone (so we create a CADF audit event)

  openstack user create cadf_test --os-identity-api-version 3 --os-auth-url http://<your_ip>:5000/v3 --os-default-domain default

6. Last of all, let's view the event

  ceilometer event-list --query event_type=identity.user.created

Useful Links

  ceilometer event-list --query event_type=<event>

  ceilometer event-list --query event_type=identity.project.created