Compliance scan fails in Multilogforwarder due to search for instance CLF in RHOCP 4

Solution Verified - Updated -

Issue

  • After upgrading to Red Hat OpenShift Logging v6.0 and configuring the Multi Log Forwarder, the compliance scan fails with below message,

    apiVersion: compliance.openshift.io/v1alpha1
    description: |-
    Ensure that Audit Log Forwarding Is Enabled
    OpenShift audit works at the API server level, logging all requests coming to the server. Audit is on by default and the best practice is to ship   audit logs off the cluster for retention. The cluster-logging-operator is able to do this with the
    
    ClusterLogForwarders
    
    resource. The forementioned resource can be configured to logs to different third party systems. For more information on this, please    reference the official documentation: https://docs.openshift.com/container-platform/4.6/logging/cluster-logging-external.html
    id: xccdf_org.ssgproject.content_rule_audit_log_forwarding_enabled
    instructions: |-
    Run the following command:
    oc get clusterlogforwarders instance -n openshift-logging -ojson | jq -r '.spec.pipelines[].inputRefs | contains(["audit"])'
    The output should return true.
    Is it the case that Logs are not forwarded outside the cluster?
    
  • The scan continues to search for the legacy instance ClusterLogForwarder (CLF), even though no such restriction is mentioned for the multi log forwarder in the documentation.

  • Similar issue may also occur with any of the allowed outcomes in the CLF: azureMonitor, cloudwatch, elasticsearch, googleCloudLogging, http, kafka, loki, lokistack, otlp, splunk, syslog.

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4.16
  • Red Hat OpenShift Logging (RHOL)
    • 6
  • Compliance Operator
    • 1.6.1

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content