11. Tower Logging and Aggregation¶

11.1.1. Log message schema¶

Common schema for all loggers:

• cluster_host_id: Unique identifier of the host within the Tower cluster

• level: Standard python log level, roughly reflecting the significance of the event All of the data loggers as a part of this feature use INFO level, but the other Tower logs will use different levels as appropriate

• logger_name: Name of the logger we use in the settings, for example, “activity_stream”

• @timestamp: Time of log

• path: File path in code where the log was generated

11.1.2. Activity stream schema¶

• (common): This uses all the fields common to all loggers listed above

• actor: Username of the user who took the action documented in the log

• changes: JSON summary of what fields changed, and their old/new values.

• operation: The basic category of the changed logged in the activity stream, for instance, “associate”.

• object1: Information about the primary object being operated on, consistent with what we show in the activity stream

• object2: If applicable, the second object involved in the action

11.1.3. Job event schema¶

This logger reflects the data being saved into job events, except when they would otherwise conflict with expected standard fields from the logger, in which case the fields are nested. Notably, the field host on the job_event model is given as event_host. There is also a sub-dictionary field, event_data within the payload, which contains different fields depending on the specifics of the Ansible event.

This logger also includes the common fields.

11.1.4. Scan / fact / system tracking data schema¶

These contain a detailed dictionary-type fields that are either services, packages, or files.

• (common): This uses all the fields common to all loggers listed above

• services: For services scans, this field is included and has keys based on the name of the service. NOTE: Periods are disallowed by elastic search in names, and are replaced with “_” by our log formatter

• package: Included for log messages from package scans

• files: Included for log messages from file scans

• host: Name of host scan applies to

• inventory_id: Inventory id host is inside of

11.1.5. Job status changes¶

This is a intended to be a lower-volume source of information about changes in job states compared to job events, and also intended to capture changes to types of unified jobs other than job template based jobs.

In addition to common fields, these logs include fields present on the job model.

11.1.6. Tower logs¶

In addition to the common fields, this contains a msg field with the log message. Errors contain a separate traceback field. These logs can be enabled or disabled in the Configure Tower User Interface ENABLE EXTERNAL LOGGING setting.

11.1.7. Logging Aggregator Services¶

The logging aggregator service works with the following monitoring and data analysis systems:

11.1.7.1. Splunk¶

Ansible Tower’s Splunk logging integration uses the Splunk HTTP Collector. When configuring a SPLUNK logging aggregator, add the full URL to the HTTP Event Collector host, like in the following example:

https://yourtowerfqdn.com/api/v2/settings/logging

{
    "LOG_AGGREGATOR_HOST": "https://yoursplunk:8088/services/collector/event",
    "LOG_AGGREGATOR_PORT": null,
    "LOG_AGGREGATOR_TYPE": "splunk",
    "LOG_AGGREGATOR_USERNAME": "",
    "LOG_AGGREGATOR_PASSWORD": "$encrypted$",
    "LOG_AGGREGATOR_LOGGERS": [
        "awx",
        "activity_stream",
        "job_events",
        "system_tracking"
    ],
    "LOG_AGGREGATOR_INDIVIDUAL_FACTS": false,
    "LOG_AGGREGATOR_ENABLED": true,
    "LOG_AGGREGATOR_TOWER_UUID": ""
}

Splunk HTTP Event Collector listens on 8088 by default so it is necessary to provide the full HEC event URL (with port) in order for incoming requests to be processed successfully. These values are entered in the example below:

For further instructions on configuring the HTTP Event Collector, refer to the Splunk documentation.

11.1.7.2. Loggly¶

To set up the sending of logs through Loggly’s HTTP endpoint, refer to https://www.loggly.com/docs/http-endpoint/. Loggly uses the URL convention described at http://logs-01.loggly.com/inputs/TOKEN/tag/http/, which is shown inputted in the Logging Aggregator field in the example below:

11.1.7.3. Sumologic¶

In Sumologic, create a search criteria containing the json files that provide the parameters used to collect the data you need.