Dell PowerFlex 4.5.x Administration Guide

Define the Ingress notification policy

Use this procedure to define a notification policy to forward Ingress audit messages. The purpose of this policy is to capture POST, PUT, and DELETE requests of signed-in users passing through the Ingress Controller and send them to the rsyslog-forwarder (also known as the syslog-listener). The rsyslog-forwarder then forwards them to the external destinations.

1. Add a syslog source, if you do not have one already:
   1. Go to Settings > Events and Alerts > Notification Policies.
      You can also use the following REST API: dispatch-sources/post
   2. From the Sources pane, click Add.
      The Add Source window opens.
   3. Enter a source name and description. For the name, you can enter Ingress.
   4. For the type, select Syslog and click Enable Syslog.
2. Create a destination, if you do not have one already.
   You can use the destination that you created to define the event to syslog audit notification policy from the previous procedure.
3. Create a new policy:
   1. Go to Settings > Events and Alerts > Notification Policies.
      You can also use the following REST API: dispatch-policies/post
   2. Click Create New Policy.
   3. Enter a name and a description for the notification policy. For the policy name, you can enter: Powerflex Ingress to external Syslog
   4. Set the Source Type to Syslog.
   5. Set the Facility to Auditlog.
   6. Select the check box beside the severity levels that you want to associate with this policy.

      The severity indicates the risk (if any) to the system, in relation to the changes that generated the audit messages.

   7. Select the destination that is created in the previous step and click Submit.