Red Hat Lightspeed collects minimal system metadata for analysis while providing data obfuscation, redaction, and automatic retention controls.

Red Hat Lightspeed helps to identify and address operational and vulnerability risks, before they result in system downtime. This functionality requires that Red Hat Lightspeed collects small pieces of system metadata for processing and analysis. Here is how we ensure the security of your data:

Data collectors upload system information to Red Hat Hybrid Cloud Console. Systems are deduplicated so that they display only one time in inventory, helping you track reporting services and troubleshoot collection issues.

Each system registered in inventory gets its data from one of many data collectors. Data collectors run on a regular cadence and synchronize their collected data with the Red Hat Hybrid Cloud Console.

A system can be reported by one or more collectors. When multiple collectors provide information for the same system, inventory uses a deduplication mechanism to merge the information. This process ensures that systems are displayed only once in inventory.

The following data collectors upload system information to the Red Hat Hybrid Cloud Console:

System facts are the metadata that data collectors gather about your RHEL systems. Red Hat Lightspeed uses system facts to analyze system health, identify issues, and generate recommendations for optimization and security.

insights-client uses system facts to populate inventory data in Red Hat Lightspeed and to update existing data. Red Hat Lightspeed also uses system facts to analyze system performance and to create recommendations for services such as Advisor or remediations.

Red Hat Lightspeed performs initial and daily system analyses to monitor status, identify issues, and flag systems for deletion based on staleness criteria.

When you register systems, Red Hat Lightspeed performs an initial analysis and then runs daily analyses to monitor your system status. Red Hat Lightspeed stores the status information in inventory. You can view the system details from the Inventory Systems page in the Hybrid Cloud Console.

Red Hat Lightspeed analysis results can include alerts that identify issues in your systems, and recommendations about how to resolve those issues.

Red Hat Lightspeed also monitors for system staleness by using specific staleness criteria to flag systems that are not reporting regularly. If systems do not report for a specified period of time, Red Hat Lightspeed flags them for deletion.

Red Hat Lightspeed provides REST APIs with token-based authentication to enable secure programmatic access to inventory data, recommendations, and system details. These secure REST APIs support integration with automation tools and custom workflows.

All Red Hat Lightspeed APIs are Representational State Transfer (REST) APIs. REST APIs are stateless, meaning servers do not save client data between requests. Token-based authentication provides granular control over access permissions and enhances security.

Filter inventory systems by name, status, operating system, data collector, RHC status, last seen, workspace, or tags. This helps you quickly locate systems of interest and manage specific infrastructure subsets.

There are several ways to refine your inventory view to help you focus on the issues and systems that matter the most. Using the following steps, you can filter your systems inventory by several criteria, including:

Each system in Red Hat Lightspeed has a display name that is assigned automatically by data collectors or manually by users. Using display names ensures consistent identification and prevents naming conflicts across your infrastructure.

There are two ways to assign a display name to a system:

To resolve naming conflicts and ensure consistent system identification, data collectors assign display names to systems based on priority. Understanding the priority order helps you troubleshoot why certain display names override others.

A data collector is a specific application or service responsible for sending host information, updates, or system profile data to Red Hat Lightspeed inventory. For example, Red Hat Subscription Manager (RHSM) and Red Hat Satellite act as data collectors for Red Hat Lightspeed.

A data collector can provide a display name to Red Hat Lightspeed during registration or a registration update. If the system has a manually assigned name, the data collector uses that name as the display name. Otherwise, the data collector does not provide a display name, so Red Hat Lightspeed uses the system fully qualified domain name (FQDN) as a display name.

Each data collector that interacts with Red Hat Lightspeed has an assigned priority. Red Hat Lightspeed inventory uses the display name provided by the data collector with the highest priority. That means that the display name reported by a higher-priority data collector overrides the display name set by a data collector with a lower priority.

The following table shows the data collectors in order of priority.

You can assign custom display names to systems by using the UI, the insights-client, or the API. This ensures consistent naming across your infrastructure and prevents automatic naming conflicts.

System display names assigned through a data collector, such as during registration with Subscription Manager, receive the highest priority. This means that lower-priority data collectors cannot override names that you set manually.

You can assign display names by using three methods:

Assign a custom display name to ensure consistent naming and prevent automatic name conflicts. Manually assigned display names receive the highest priority and cannot be overridden by data collectors.

Use the insights-client command-line tool to set a custom display name for a system. This ensures consistent naming across your infrastructure and automates assignment during deployment.

With the insights-client, you can set the system display name on the system itself. This method is useful for automating display name assignment during system configuration or deployment.

Use the inventory API to programmatically set custom display names for systems to enable automation and bulk operations.

Systems that connect through the Red Hat Lightspeed proxy are highlighted with the insights-proxy tag in Red Hat Lightspeed inventory. Use this tag to verify proxy routing in disconnected environments and manage connectivity from a central location.

Red Hat Lightspeed automatically detects and tags proxy-connected systems. To view all proxy-connected systems or identify which systems route through a specific proxy instance, filter your inventory by insights-proxy.

When you use the configure-client.sh script to configure systems to use the Red Hat Lightspeed proxy, the script uses the Red Hat Lightspeed system tagging capability to identify the proxy server on the client systems.

insights-proxy: <rhproxy-hostname>

insights-proxy: myproxy-example

When a client system uses a proxy server to communicate with Red Hat Lightspeed, you can view the proxy server in inventory in the Red Hat Hybrid Cloud Console. The Filter by tags filter displays the proxy server tag grouped under the insights-client heading. You can select the proxy server tag to view the client systems connected to it.

To disable the proxy connection, remove the proxy configuration from the client. Removing the configuration also removes the proxy connection tags from inventory.

Red Hat Lightspeed inventory provides a unified view of RPM, image mode, and OSTree-based systems to enable streamlined system management. Image-based system filters enable identification and monitoring of image mode and OSTree deployments with access to deployment-specific metadata.

Red Hat Lightspeed unifies all system types into a single, streamlined view. You can view and manage RPM (package mode), image mode, and OSTree-based systems from the same inventory page. Red Hat Lightspeed includes filters that enable you to select and display only image-based systems.

You can connect an image-based system to Red Hat Lightspeed in the following ways:

Image-based systems display additional metadata in inventory, including:

Embed an activation key in image-based RHEL systems to automatically connect to Red Hat Lightspeed on first boot. This eliminates manual registration steps and ensures that image-based RHEL systems have immediate inventory visibility.

Manually connect an image-based RHEL system to Red Hat Lightspeed by using the rhc command with an activation key and Organization ID. This registers the system in inventory and grants Red Hat Lightspeed service access whether the system connects directly to Red Hat services or through a proxy server.

Register image-based RHEL systems with Satellite by using your preferred method to enable centralized management and Red Hat Lightspeed monitoring.

Use the Image-based system filter to view image-based systems in inventory and verify their bootc image sources and deployment status.

To show details for a system, click the system name. The System Details page includes the image URL and its corresponding hash value.

The bootc panel on the System Details page shows information about the following:

Add an image-based RHEL system to a workspace to organize and manage systems according to your environment requirements.

Remove obsolete or decommissioned systems from inventory to maintain an accurate record of your active infrastructure.

Use the following procedure to remove obsolete or decommissioned systems from inventory.

You can simplify access management in the Red Hat Hybrid Cloud Console by using role-based access control (RBAC). The User Access feature assigns specific permissions to roles instead of individual users, which are then inherited when roles are assigned to user groups.

You can also create custom groups and roles to provide more fine-tuned control over specific features of Red Hat Lightspeed to suit the needs of your organization.

If you are an Organization Administrator, you can use the User Access feature under Identity & Access Management → User Access in the Hybrid Cloud Console to:

The two predefined groups available in User Access, Default access and Default admin access provide different baseline privilege levels for users in your organization. You can also create custom groups to align permissions with specific personas, job functions, or teams in your organization.

The Default admin access group includes many (but not all) predefined roles that provide update and delete permissions. The roles in this group usually include administrator in their names.

Understand how predefined roles in Red Hat Hybrid Cloud Console bundle permissions across multiple Red Hat Lightspeed applications to align with common user personas. Use predefined roles to reduce administrative effort, or create custom roles for more fine-tuned control over specific features.

The predefined roles are a starting point to help you control and manage user permissions. You can then use these roles to create custom roles that are tailored to your specific use cases and organization. For example, you can use the predefined granular roles to create custom roles that provide more fine-tuned control over specific features of Red Hat Lightspeed.

By default, Red Hat provides a set of consolidated roles and a set of granular roles in the Red Hat Hybrid Cloud Console User Access UI. The consolidated roles significantly reduce the administrative effort required to manage user permissions, while the granular roles provide more fine-tuned control over specific features of Red Hat Lightspeed.

You can use the predefined consolidated and granular roles in User Access simultaneously, but using consolidated roles can significantly reduce the administrative effort.

Verify your current permissions and the roles or groups assigned to you in the Red Hat Hybrid Cloud Console. Check your permissions to troubleshoot access issues or understand your level of access to Red Hat Lightspeed applications.

You can also filter your permissions by application, for example, by advisor, cost management, inventory, and remediations.

If you are an Organization Administrator, you can view and manage user permissions for all users in your organization. Control access to Red Hat Lightspeed and other Red Hat Hybrid Cloud Console services through the User Access interface.

Understand the predefined roles that control access to the inventory service of Red Hat Lightspeed. Use these role definitions to assign appropriate permissions to users based on their responsibilities.

The following roles enable standard or enhanced access to inventory features:

Control workspace access with custom User Access roles that define permissions for specific workspaces. Workspaces group systems by location, department, or purpose, with each system belonging to only one workspace, ensuring users access only relevant systems.

Workspaces support role-based access control (User Access) to restrict system visibility and management based on user roles and group membership. Use User Access settings to set custom permissions on workspaces according to user role.

Be aware that you can still view the workspace name assigned to the system for which you have read access, even if you do not have access to the workspace itself. To view the workspace that contains the system, you need to have at least the Workspaces Viewer role, the RHEL viewer role, or have Workspace view permissions assigned. Before making changes in the User Access settings UI, review the list of known limitations in the User Scenarios section of the documentation.

Workspace access control supports two common organizational needs: isolating infrastructure between multiple IT teams, and restricting users to ungrouped systems only. Understanding these patterns and their limitations helps you to plan effective workspace configurations.

Use custom User Access roles to restrict users to viewing only the systems in specific workspaces while preventing them from accessing other workspaces or ungrouped systems in your organization.

Use the Red Hat Lightspeed export service to export system inventory data to CSV or JSON format. With the exported data, you can perform offline analysis, integrate with external tools, and create custom reporting workflows. Exported files are retained for 7 days.

The export service runs asynchronously in the background, allowing you to continue working while your export request is processed. You can export data by using either the UI or the Export API, and choose between CSV or JSON output formats based on your analysis needs.

The service is available in both the Red Hat Lightspeed UI and through the Export Service API.

The exported content includes the following information about each system in your inventory:

The inventory export service works differently from the export function in other services, such as advisor. Some of the differences are:

The inventory export process creates a zip file that includes the data file, a manifest, and metadata. The export archive file helps you verify export completion and understand the data structure.

The zip file contains the following files:

Export inventory data directly from the Red Hat Lightspeed UI to download system information in CSV or JSON format. Use the exported data for offline analysis, reporting, or integration with external tools.

The inventory data export service works differently from the export service for other Red Hat Lightspeed services, such as advisor. The UI export feature initiates the export request and automatically downloads the file to your browser when the export completes.

The Export Service API is an asynchronous REST API. You can use the Export Service API to export inventory data in JSON or CSV format. You can also integrate with external tools, automate workflows, and process inventory data offline.

The REST API entry point for the Export Service is:

https://console.redhat.com/api/export/v1

The API supports the GET, POST, and DELETE HTTP methods and offers the following operations:

The API works asynchronously. You submit a POST /exports request to initiate the export and receive a reply with a unique ID for that export. You can then use that ID to monitor the progress of the export operation with the GET /exports/id/status request. When the generated export is complete, you can download it (GET /exports/id) or delete it (DELETE /exports/id).

Successful requests return the following HTTP response codes:

The server retains generated export files for 7 days.

Use the Export Service API to programmatically export inventory data by submitting requests, monitoring progress, and downloading completed files. First, obtain an export ID by using POST /exports, then use that ID in all subsequent operations.

You can export data from multiple Red Hat Lightspeed services such as inventory and notifications in a single request. Consolidating the data from multiple sources eliminates the need for separate export operations.

The inventory export service supports multi-service exports within a single API request. This capability reduces the number of manual export operations required when you need data from multiple services.

To request multiple services, include the source information for each service in your POST /exports request, as in the following example:

{
  "name": "Inventory Export multiple sources",
  "format": "json",
  "sources": [
    {
      "application": "urn:redhat:application:inventory",
      "resource": "urn:redhat:application:inventory:export:systems",
      "filters": {}
    },
    {
      "application": "urn:redhat:application:notifications",
      "resource": "urn:redhat:application:notifications:export:events",
      "filters": {}
    }
  ]
}

The POST /exports request returns a unique export ID. When the export completes, the GET /exports request returns a ZIP file containing separate JSON or CSV files for each requested service.

Use an Ansible playbook to automate inventory exports on a schedule. Red Hat Lightspeed provides a generic playbook that uses token-based service accounts for authentication.

Systems follow a lifecycle with fresh, stale, and stale warning states based on reporting activity to maintain an accurate inventory.

View the current system state in inventory to monitor your system lifecycle status and to identify systems that require attention. Your assigned RBAC permissions determine how you view the system state.

You can view system states by using one of the following methods:

View system state and monitor health by filtering multiple systems or checking individual system details. Filtering identifies stale systems quickly. Individual system views display status indicators, color coding, and deletion countdown.

View system state from the dashboard and access detailed system information to monitor system lifecycle status and identify systems requiring attention. You need Inventory Hosts administrator RBAC permissions to access detailed system information.

Modify system staleness and deletion time limits to prevent active offline systems from being deleted.

By default, system states have the following time limits:

There are situations where a system is offline for an extended time period but is still in use. For example, test environments are often kept offline except when testing. Submarines or Internet of Things (IoT) devices can be out of range of communication for extended time periods. You can modify the system staleness and deletion time limits to ensure that systems that are offline but still active do not get deleted. Staleness and deletion settings get applied to all of your systems.

The Red Hat Lightspeed Host Inventory API provides custom staleness and deletion limit configurations to override default values. These configurations prevent the premature automatic deletion of offline systems that remain in active use.

When you do not have custom staleness and deletion settings configured for your system, Red Hat Lightspeed uses the default values to determine whether the system is in a stale state, or whether it should be automatically deleted.

Workspaces in Red Hat Lightspeed organize systems based on criteria such as environment, application, or team ownership. You can use workspaces to streamline workflows and control user access.

In Red Hat Lightspeed, workspaces are only for systems. Each system can belong to only one workspace. Systems that are not assigned to a specific workspace are automatically grouped in the Ungrouped Hosts workspace.

Each organization can have up to 120 workspaces. Workspaces follow naming, structural, and assignment rules that help ensure efficient system organization and access control.

On the Red Hat Hybrid Cloud Console, you can create a workspace to organize systems by environment, team, application type, or location. This enables you to filter system views across applications, control user access to specific systems, and streamline operational workflows.

Create a new workspace and add a system to it in a single operation from the Inventory Systems page. This lets you quickly organize a specific system without creating the workspace separately first.

Add systems to an existing workspace in the Red Hat Hybrid Cloud Console to organize them by team, environment, or application. You can also use workspaces to control user access to groups of systems.

Remove systems from a Red Hat Lightspeed workspace when they no longer belong to maintain accurate organization and proper access control. Removed systems automatically move to the Ungrouped Hosts workspace.

On the Hybrid Cloud Console, you can rename a workspace to better reflect its purpose. You might need to do this when team ownership changes or system groupings are reorganized.

On the Hybrid Cloud Console, you can delete a workspace when you no longer need it to organize systems. This helps you manage workspace capacity and stay within the organization limit.

Diagnose and resolve workspace creation errors such as workspace limits, permission issues, or duplicate name conflicts to successfully create and manage workspaces.

Common workspace creation errors include:

The inventory service triggers event types for validation errors, system registration, deletion, and staleness changes. This enables automated notifications, monitoring, and workflow integration based on inventory activity.

Configure behavior groups to receive notifications when inventory events occur across your organization. This enables centralized monitoring, automated workflows, and team-based alert routing for inventory changes.

Configure user email preferences to receive notifications about inventory events such as system registration and deletion. This enables you to monitor inventory changes and respond quickly to system lifecycle events.