How to get system configuration alerts on RHEL from Red Hat Insights using Drift

Figure 2 - System and baseline association

In this example, we added ‘rhel8desktop’ system to the list of associated systems for ‘Standard baseline’ baseline. This means that every time ‘rhel8desktop’ checks in, Drift will check for differences between ‘rhel8desktop’ system and ‘Standard Baseline’ defined baseline and then trigger a ‘Drift from baseline detected’ event if the system configuration differs from the defined baseline.

You can also use Drift APIs to set baseline and system associations. Find more information on the Red Hat Insights API documentation. 

End-to-end Drift Notifications

Now that we have configured Drift to alert when ‘rhel8desktop’ configuration differs from our defined ‘Standard Baseline’ baseline, we will receive an email as well as a webhook notification when a difference is detected and triggered. 

See examples of the email (Figure 3) and webhook (Figure 4) received after running the sudo insights-client command on ‘rhel8desktop’ to simulate a scheduled daily run.

Figure 3 - Example of an email received for a ‘Drift from baseline detected’ notification.

The email notification contains information about the system and the baseline(s) it differs from. Clicking on the system name redirects to the Inventory profile for the system. Clicking on the baseline name points directly to the Comparison report for this system and the selected baseline in the Drift application. The Baseline feature and how to use it in Comparison to get a list of differences between system configuration and baseline was introduced in a previous blog post.

Figure 4 - Example of a webhook message received from a ‘Drift from baseline detected’ notification

The webhook notification contains information about the system (in the context section) and about the baseline it differs from (payload section). This can be used in multiple manners to troubleshoot, update CMDB records in third party applications, or even automate the trigger of specific alerts or processes according to your organization.

Conclusion 

In this article, we showed how you can now associate systems to defined baselines in Drift, and get alerted wherever a system configuration differs from them. In the example, a ‘Drift from baseline detected’ event is triggered, and email and webhook notifications are sent according to the Notifications configuration for the organization. This new feature can help you maintain your systems configuration to match your organization's standard operating environments.

Other Red Hat Insights services such as Advisor and Policies also use the Notifications service to send alerts based on their findings. Additional event types triggered by Red Hat Insights applications will be added as we grow the service and on-board new features.

We invite you to test this new feature out in Drift and provide feedback and suggestions using the Red Hat Customer Portal feedback form.