Dell PowerFlex 4.5.x Administration Guide

Define the PowerFlex events notification policy

Use this procedure to define a notification policy to forward events in the PowerFlex system to the rsyslog-forwarder (also known as the syslog-listener). Then, the rsyslog-forwarder forwards the events to the external destinations that are defined in the policy.

1. Add a destination:

   First, you must add the identified Security Information and Event Manager (SIEM) server as a destination.

   1. Go to Settings > Events and Alerts > Notification Policies.
      You can also use the following REST API: dispatch-destinations/post
   2. From the Destinations pane, click Add.
      The Create New Destination Protocol window opens.
   3. Enter the destination name and description.
   4. From the Destination Type menu, select Syslog.
   5. Click Next and enter the IP, port, and protocol (TCP) of the target SIEM. Ensure that the SIEM IP, port, and protocol are reachable.
2. Create a new policy:

   The new policy defines the rules for processing PowerFlex event messages from sources and specifies to which destination that information should be sent.

   1. Go to Settings > Events and Alerts > Notification Policies.
      You can also use the following REST API: dispatch-policies/post
   2. Click Create New Policy.
   3. Enter a name and a description for the notification policy. For the policy name, you can enter: Powerflex events to external Syslog
   4. Set the Source Type to Powerflex_events.
   5. From the Resource Domain menu, select the resource domain for the notification policy. The resource domain options are:
      • All
      • Management
      • Block (Storage)
      • File (Storage)
      • Compute (Servers, Operating Systems, virtualization)
      • Network (Switches, connectivity etc.)
      • Security (RBAC, certificates, CloudLink etc)
   6. Select the check box beside the severity levels that you want to associate with this policy.

      The severity indicates the risk (if any) to the system, in relation to the changes that generated the event message.

   7. Select the destination that is created in the previous step and click Submit.