Except for a few special cases, getting CADF information out of OpenStack services is pretty straightforward. However, depending on the distribution, these instructions may differ.
The following instructions show how Nova can be enabled for CADF audit events to be sent to Ceilometer (optionally log files). This is done through the Keystone middleware, which provides an optional WSGI middleware filter that allows the ability to audit API requests for each component of OpenStack.
First, log in to your OpenStack deployment. Edit the /etc/nova/api-paste.ini file. At the end of the file, add the following code:
[filter:audit] paste.filter_factory = pycadf.middleware.audit:AuditMiddleware.factory audit_map_file = /etc/nova/api_audit_map.conf ...
