Orchestrator Remote Log Receivers
Support > Technical Assistance > Orchestrator Remote Log Receiver
This page describes how to configure remote log receivers to forward Orchestrator alarm and audit log events to third-party collection endpoints. When an event occurs, Orchestrator sends the event message to all enabled receivers registered on this page. For information about the data contained in remote log messages, see Remote Log Messages.
Supported Receiver Types
| Receiver Type | Protocol | Message Format |
|---|---|---|
| HTTP | HTTP POST | JSON |
| HTTPS | HTTP POST | JSON |
| KAFKA | Kafka producer | JSON |
| SYSLOG | TCP, UDP, or TCP over SSL | RFC 5424 |
| WEBSOCKET | WSS | JSON |
Add a Remote Log Receiver
You can add HTTP/HTTPS, KAFKA, SYSLOG, and WEBSOCKET servers as remote log receivers.
Use one of the following options:
- To add an HTTPS receiver, click HTTPS. HTTPS is the default receiver type.
- To add a different receiver type, click the more (…) menu next to the list of receiver types, and then select the receiver type.
Enter the appropriate information for the receiver, and then click Save.
Each receiver entry in the table includes an Actions column on the right with controls to edit or delete the receiver.
Configure an HTTP Receiver
When you add or edit an HTTP receiver, complete the following fields in this order:
| Field | Description |
|---|---|
| Enable receiver | Click this slider to toggle between enabled and disabled state. |
| Name | Name of the receiver the logs are sent to. |
| Log type | Select Audit Log or Alarm. |
| URL | URL served by the HTTP log server that Orchestrator uses to send log data with POST REST calls. |
| User name (optional) | User name used in basic authentication when making REST calls. |
| Password (optional) | Password used in basic authentication when making REST calls. |
| Repeat password (optional) | Re-enter the password used in basic authentication. |
| Header name (optional) | Optional custom HTTP header name required by the third-party receiver. |
| Header value (optional) | Optional value for the custom HTTP header. |
| Data wrapper key (optional) | Optional key used to wrap the JSON event payload, as required by the third-party receiver. |
Configure an HTTPS Receiver
When you add or edit an HTTPS receiver, complete the following fields in this order:
| Field | Description |
|---|---|
| Enable receiver | Click this slider to toggle between enabled and disabled state. |
| Name | Name of the receiver the logs are sent to. |
| Log type | Select Audit Log or Alarm. |
| URL | The endpoint URL of the remote HTTPS server. |
| User name (optional) | User name used in basic authentication when making REST calls. |
| Password (optional) | Password used in basic authentication when making REST calls. |
| Repeat password (optional) | Re-enter the password used in basic authentication. |
| Header name (optional) | Optional custom HTTP header name required by the third-party receiver. |
| Header value (optional) | Optional value for the custom HTTP header. |
| Data wrapper key (optional) | Optional key used to wrap the JSON event payload, as required by the third-party receiver. |
NOTE: The values for Header Name, Header Value, and Data Wrapper Key vary depending on the third-party receiver you are integrating with (for example, Splunk). Refer to your third-party receiver’s documentation for the correct values to enter in these fields.
Configure a KAFKA Receiver
When you add or edit a KAFKA receiver, complete the following fields in this order:
| Field | Description |
|---|---|
| Enable receiver | Click this slider to toggle between enabled and disabled state. |
| Name | Name of the receiver the logs are sent to. |
| Log type | Select Audit Log or Alarm. |
| Topic | Topic name on the KAFKA receiver. |
| Bootstrap servers | Comma-separated list of KAFKA broker addresses in <ip>:<port> format. |
| Acks (optional) | Defines the number of KAFKA servers that must acknowledge a message before it is considered delivered. Values include acks=0, acks=1, or acks=all. |
| Retries (optional) | Number of retry attempts KAFKA makes before returning an error. |
| Batch size (optional) | Number of bytes produced in a batch before KAFKA sends the batch. |
| Buffer size (optional) | Maximum memory size available for buffering messages before send operations are blocked. |
| Linger time (optional) | Time KAFKA waits before sending the next message batch. |
Configure a SYSLOG Receiver
When you add or edit a SYSLOG receiver, complete the following fields in this order.
General settings:
| Field | Description |
|---|---|
| Enable receiver | Click this slider to toggle between enabled and disabled state. |
| Name | Name of the receiver the logs are sent to. |
| Log type | Select Audit Log or Alarm. |
| Protocol | Select TCP, UDP, or TCP over SSL. |
| Hostname/URL | Hostname or URL of the remote SYSLOG server. |
| Port | Port number on the SYSLOG server that accepts incoming events. |
| Custom data (optional) | Optional token embedded in the SYSLOG message for third-party integrations. |
Facility settings:
| Field | Description |
|---|---|
| Audit facility | SYSLOG facility used for audit log messages. |
| Alarm facility | SYSLOG facility used for alarm messages. |
Audit severity settings:
| Field | Description |
|---|---|
| Audit Error severity | Maps Orchestrator Error audit events to an external SYSLOG severity. |
| Audit Info severity | Maps Orchestrator Info audit events to an external SYSLOG severity. |
| Audit Debug severity | Maps Orchestrator Debug audit events to an external SYSLOG severity. |
Alarm severity settings:
| Field | Description |
|---|---|
| Alarm Critical severity | Maps Orchestrator Critical alarms to an external SYSLOG severity. |
| Alarm Major severity | Maps Orchestrator Major alarms to an external SYSLOG severity. |
| Alarm Minor severity | Maps Orchestrator Minor alarms to an external SYSLOG severity. |
| Alarm Warning severity | Maps Orchestrator Warning alarms to an external SYSLOG severity. |
Orchestrator sends SYSLOG messages in RFC 5424 format.
Configure a WEBSOCKET Receiver
When you add or edit a WEBSOCKET receiver, complete the following fields in this order:
| Field | Description |
|---|---|
| Enable receiver | Click this slider to toggle between enabled and disabled state. |
| Name | Name of the WEBSOCKET receiver. |
| Log type | Select Audit Log or Alarm. |
| IP allow list | List of source IP addresses that are allowed WEBSOCKET access to Orchestrator. |
After completing the fields, click Generate key to create the WEBSOCKET key.
To connect to the Orchestrator WEBSOCKET, do one of the following:
- Include the key in the HTTP header
X-Auth-Tokenwhen connecting to the WEBSOCKET. - Append the key as the query parameter
keyto the WEBSOCKET URL.
The generated WEBSOCKET key can be copied from the dialog and provided to the connecting client.
Event Message Retention
For an on-premises deployment, remote log resubmission availability depends on the current Statistics Retention settings for the non-statistics tables alarmnotification2 and actionlog. To configure these settings, go to Orchestrator > Software & Setup > Setup > Statistics Retention, and then select Others.
For orchestrator as a service, .all stats retention are HPE and license governed.
Each message includes a consecutive unique sequence ID that the receiver can use to detect and catch up on missed events.