Retrieving Audit & Reports from Foreman

Question

I have a Foreman 1.9.0 system using postgres as the back end on RHEL 7.2.

A requirement has come up to be able to send the audit log and reports to an external entity in near real time (5-10 minute mark).

I have been looking on the web and haven't be able to find out if this is possible. I could create a script that reads the logs directly from the database and outputs them into xml. But this is less than ideal from an accountability point of view.

The ideal output solution would be XML but syslog message format would suffice.

Thanks

Answer 1

I think with such stringent requirements you should create a Foreman plugin. See https://theforeman.org/plugins/#3.WritingYourOwn for help or ask in the mailing list and IRC channels.

Foreman uses the gem 'audited' (https://github.com/collectiveidea/audited) to capture the changes made to all objects. This gem stores the audits in an object named 'Audit'. You can extend this object in your Foreman plugin, and write a after_save call that sends a representation of itself in XML to your external server. This way your audits would be sent automatically, however you should be careful and make the operation asynchronous and capture errors in case the connection with the external server doesn't work, etc...

Alternatively (and a bit more rudimentary & error-prone) you can write a rake task (see examples here https://github.com/theforeman/foreman/tree/develop/lib/tasks) that collects all audits info every X minutes and sends it to the external server in XML. This would in practice be a very similar script to what you described before.

Answer 2

I would also add there is an existing plugin https://github.com/frimik/foreman_audited_notifications that has basic / similar capabilities to what you ask for.