Configuring Juniper CSO Observer jobs

Using the Juniper CSO Observer, you can define a full load job that will gather and read data about topology data from Juniper CSO. The observer is installed as part of the core installation procedure.

Before you begin

Important: The Juniper CSO observer supports the on-premise Juniper CSO version 4.1.0.

Ensure you have the Juniper CSO details to hand, such as details of the Juniper CSO API Server and its credentials.

About this task

The Juniper CSO Observer retrieves topology data from Juniper CSO Release 4.1 via REST APIs exposed by CSO API server.

You define and start the following job.
Full Topology Upload job
By default, these jobs are one-off, transient jobs that perform a full upload of all requested topology data as soon as they are triggered.
You can also run these jobs (again) manually from the Observer UI, or schedule them to run at set times when configuring them.
Run this job whenever you need the Juniper CSO topology data refreshed.

Procedure

  1. On the Observer jobs page, perform one of the following actions:
    To edit an existing job
    Open the List of options overflow menu next to the job and click View & edit.
    To create a new job
    Click Add a new job + and select the Juniper CSO Observer tile.
  2. Enter or edit the following parameters, then click Run job to save your job and begin retrieving information:
    Table 1. Juniper CSO Observer job parameters
    Parameter Action Details
    Unique ID Enter a unique name for the job. Required
    Juniper CSO Central MS URL Specify the Juniper CSO Central micro-service URL. Required
    CSO Keystone Authentication URL Enter the authentication URL for the identity service. Required
    CSO user domain name Enter the CSO user domain name. Required
    CSO domain or project or tenant name Enter the CSO domain or project or tenant name. Required
    CSO Authentication username Specify the CSO authentication user name. Required
    CSO Authentication password Specify the CSO authentication password. Required. Use plain text.
    Enable/Disable Secure Connection to CSO Host Set to 'true' to secure the connection, otherwise set to 'false' to bypass. Required
    Target system certificate Specify the certificate file name. Required if 'Enable/Disable Secure Connection to CSO's host' is set to 'true'.
    Required. For more information, see Configuring observer job security.
    On-prem
    Create and store the certificate in the ASM_HOME/security directory.
    OCP
    Obtain the authentication certificate using OpenSSL and store it as a secret.
    SSL Truststore File Specify the trustStore file name.
    Tip: You can use the observer name (<observer>.jks) for example junipercso.jks.
    		 Required. For both on-prem and OCP, provide the JKS name, and the observer will then create the JKS file accordingly.
    SSL Truststore Password If enable_secure_host_connection is set to 'true', then supply a password to decrypt the HTTPS trust store file. Required. Use plain text.
    SSL Validation Choose whether SSL validation is on or off. Turning SSL validation off will use HTTPS without host verification. Optional
    Access scope

    Enter text to provide a scope for the resources.

    Access scope can help map alerts to resources when resources in different scopes share the same parameters, such as matchTokens.

    		 Optional.
    Tip: You can define access scope for locations, project names, namespaces, etc.
    Generate debug support file
    Set the optional Generate debug support file parameter to 'True' in order to capture the output of the next scheduled job run as a file. This file will be stored with an observer's log files and can be used to debug observer issues, for example at the request of your designated Support team, or while using a test environment. For one-off jobs (that is, Load jobs), this parameter reverts to 'False' after the next completed run. To examine the output produced, you can load the generated debug file using the File Observer. The file is saved to the following locations:
    On-prem
    $ASM_HOME/logs/<obs>-observer/
    On OCP
    /var/log/itsm/<obs>-observer
    		 Optional
    Observer job description Enter additional information to describe the job. Optional
    Job schedule

    Specify when the job should run, and whether it should run at regular intervals.

    By default the job runs immediately, and only once.

    Optionally you can specify a future date and time for the job to run, and then set it to run at regular intervals after that.

    Optional. Transient (one-off) jobs only.

    If you set a job schedule, the run intervals must be at least 90 seconds apart, and if you set them at less than 15 minutes, a warning is displayed, as the frequency can impact system performance.

To acquire Juniper CSO certificate and build SSL truststore

  1. Create a certificate as described in step two of Configuring observer job security.
  2. Import the certificate into a keystore and encrypt the keystore.
    The following example of a Java keytool command imports the Juniper CSO certificate file into a keystore and then encrypts the keystore with a given password.
    keytool -import -v -trustcacerts -alias {Juniper CSO Hostname} -file {certificate_file_name}.crt -keystore {keystore file name} -storepass {your plain text password to encrypt keystore}
  3. Copy the keystore file ({keystore file name}) to the $ASM_HOME/security directory to complete the SSL setup.