Compliance scan fails in Multilogforwarder due to search for instance CLF in RHOCP 4
Issue
-
After upgrading to
Red Hat OpenShift Logging v6.0and configuring theMulti Log Forwarder, thecompliance scanfails with below message,apiVersion: compliance.openshift.io/v1alpha1 description: |- Ensure that Audit Log Forwarding Is Enabled OpenShift audit works at the API server level, logging all requests coming to the server. Audit is on by default and the best practice is to ship audit logs off the cluster for retention. The cluster-logging-operator is able to do this with the ClusterLogForwarders resource. The forementioned resource can be configured to logs to different third party systems. For more information on this, please reference the official documentation: https://docs.openshift.com/container-platform/4.6/logging/cluster-logging-external.html id: xccdf_org.ssgproject.content_rule_audit_log_forwarding_enabled instructions: |- Run the following command: oc get clusterlogforwarders instance -n openshift-logging -ojson | jq -r '.spec.pipelines[].inputRefs | contains(["audit"])' The output should return true. Is it the case that Logs are not forwarded outside the cluster? -
The scan continues to search for the legacy
instanceClusterLogForwarder (CLF), even though no such restriction is mentioned for the multi log forwarder in the documentation. -
Similar issue may also occur with any of the allowed outcomes in the CLF:
azureMonitor,cloudwatch,elasticsearch,googleCloudLogging,http,kafka,loki,lokistack,otlp,splunk,syslog.
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 4.16
- Red Hat OpenShift Logging (RHOL)
- 6
- Compliance Operator
- 1.6.1
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.