Skip to content

docs(nim): add NIM OTel setup steps to NGF security events page #2304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devbgv wants to merge 1 commit into
base: main
Choose a base branch
from
+62 −4
Open

docs(nim): add NIM OTel setup steps to NGF security events page #2304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions content/nim/security-monitoring/ngf-security-events.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,62 @@ This integration covers security event visibility only. NGINX Instance Manager c
- NGINX Gateway Fabric running F5 WAF for NGINX with NGINX Agent v3, connected to NGINX Instance Manager. See [Connect NGINX Gateway Fabric to NGINX Instance Manager]({{< ref "/nim/connect-kubernetes/connect-ngf.md" >}}).
- Security Monitoring turned on in NGINX Instance Manager

## Configure NGINX Instance Manager

Before NGINX Gateway Fabric can send security events to NGINX Instance Manager, configure NGINX Instance Manager to receive them.

### Enable the OpenTelemetry collector

@promptless promptless Bot Sep 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

enable-disable: use "turn on" instead of "enable". The troubleshooting page describes this same collector as "turned on", so this heading reads better as Turn on the OpenTelemetry collector. Leave the collector_config.enable: true config value unchanged, since it must match the config key.


NGINX Instance Manager uses an embedded OpenTelemetry (OTel) collector to receive security events from NGINX Gateway Fabric over gRPC.

1. Open `/etc/nms/nms.conf` and set `collector_config.enable` to `true`:

```yaml
collector_config:
enable: true
```

2. Create the OTel collector configuration file at `/etc/nms/otel-collector-config.yaml`:

```yaml
receivers:
otlp:
protocols:
grpc:
endpoint: "0.0.0.0:4317"
http:
endpoint: "0.0.0.0:4318"

processors:
batch:
send_batch_size: 500
timeout: 2s
secevt: {}

exporters:
debug:
verbosity: normal

service:
pipelines:
logs:
receivers: [otlp]
processors: [batch, secevt]
exporters: [debug]

@promptless promptless Bot Sep 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technical accuracy, for a subject matter expert to confirm (flagged separately from style): this pipeline's only exporter is debug, which writes events to the collector's log output. The page's stated outcome is that events appear in the Security Dashboard. Confirm whether the secevt processor delivers events to Security Monitoring on its own, or whether the pipeline also needs an exporter that forwards events to NGINX Instance Manager. As written, someone who copies this config may see events logged but not shown in the dashboard.

```

3. Restart the NGINX Instance Manager service to apply the changes:

```shell
sudo systemctl restart nms
```

### Verify network access

Confirm NGINX Instance Manager is reachable from the Kubernetes cluster on port `4317` (gRPC). NGINX Gateway Fabric sends security events to this port.

---

## Set up event export from NGINX Gateway Fabric

NGINX Gateway Fabric generates and exports security events. NGINX Instance Manager doesn't pull or request them. Configure the export on the NGINX Gateway Fabric side.
Expand Down
10 changes: 6 additions & 4 deletions content/nim/security-monitoring/troubleshooting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,19 +51,21 @@ If NGINX Instance Manager doesn't receive security events from a NGINX Gateway F

### Resolution

Check the following on NGINX Instance Manager, in order:
First, make sure you've completed all NIM-side setup steps described in [Configure NGINX Instance Manager]({{< ref "/nim/security-monitoring/ngf-security-events.md#configure-nginx-instance-manager" >}}), including enabling the OpenTelemetry collector and creating the collector configuration file.

@promptless promptless Bot Sep 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

f5-product-names, enable-disable, sentence-length: "NIM-side" abbreviates a product name — don't abbreviate NGINX product names. "enabling" should read "turning on" to match how both pages describe this collector as "turned on". The sentence also runs past the 20-word task limit, so split it:

First, complete the setup steps on NGINX Instance Manager. See [Configure NGINX Instance Manager]({{< ref "/nim/security-monitoring/ngf-security-events.md#configure-nginx-instance-manager" >}}). These include turning on the OpenTelemetry collector and creating the collector configuration file.


Then check the following on NGINX Instance Manager, in order:

1. Confirm the embedded OpenTelemetry collector is turned on. In `nms.conf`, verify `collector_config.enable` is set to `true`:

```yaml
collector_config:
enable: true
collector_config:
enable: true
```

If you change this setting, restart the service:

```shell
sudo systemctl restart nms
sudo systemctl restart nms
```

2. Confirm NGINX Instance Manager is reachable from the Kubernetes cluster on port `4317` (gRPC).
Expand Down
Loading