| 1 | plugin_name: go.d.plugin |
| 2 | modules: |
| 3 | - meta: |
| 4 | id: collector-go.d.plugin-panos |
| 5 | plugin_name: go.d.plugin |
| 6 | module_name: panos |
| 7 | monitored_instance: |
| 8 | name: Palo Alto Networks PAN-OS |
| 9 | link: https://www.paloaltonetworks.com/network-security |
| 10 | categories: |
| 11 | - data-collection.networking |
| 12 | icon_filename: paloalto.svg |
| 13 | related_resources: |
| 14 | integrations: |
| 15 | list: [] |
| 16 | alternative_monitored_instances: [] |
| 17 | info_provided_to_referring_integrations: |
| 18 | description: "" |
| 19 | keywords: |
| 20 | - palo alto |
| 21 | - pan-os |
| 22 | - panos |
| 23 | - firewall |
| 24 | - bgp |
| 25 | - ha |
| 26 | - ipsec |
| 27 | - licenses |
| 28 | overview: |
| 29 | data_collection: |
| 30 | metrics_description: | |
| 31 | This collector monitors Palo Alto Networks PAN-OS firewalls. |
| 32 | It collects read-only XML API telemetry for BGP, system status, HA, environment sensors, licenses, and IPsec SAs. |
| 33 | method_description: | |
| 34 | It gathers metrics by periodically running PAN-OS XML API operational commands through the pango SDK. |
| 35 | default_behavior: |
| 36 | auto_detection: |
| 37 | description: | |
| 38 | This collector does not auto-detect PAN-OS firewalls. A job must be configured with the firewall management URL and credentials. |
| 39 | limits: |
| 40 | description: | |
| 41 | The default collection interval is 60 seconds to keep polling load conservative on the PAN-OS management plane. |
| 42 | performance_impact: |
| 43 | description: | |
| 44 | Each collection runs PAN-OS XML API operational requests. The collector uses serial requests and caps the SDK transport to 2 connections per firewall job. Multiple jobs targeting the same firewall multiply that per-job connection budget, so configure one job per firewall management interface unless you intentionally need separate scopes. |
| 45 | additional_permissions: |
| 46 | description: | |
| 47 | The configured PAN-OS account must be allowed to use the XML API and run read-only operational requests for the collected telemetry. |
| 48 | multi_instance: true |
| 49 | supported_platforms: |
| 50 | include: [] |
| 51 | exclude: [] |
| 52 | setup: |
| 53 | prerequisites: |
| 54 | list: |
| 55 | - title: PAN-OS XML API access |
| 56 | description: | |
| 57 | Enable XML API access and provide either an API key or username/password credentials that can generate one. |
| 58 | The account needs permission to run operational commands. |
| 59 | configuration: |
| 60 | file: |
| 61 | name: go.d/panos.conf |
| 62 | options: |
| 63 | description: | |
| 64 | The following options can be defined globally: update_every, autodetection_retry. |
| 65 | folding: |
| 66 | title: Config options |
| 67 | enabled: true |
| 68 | list: |
| 69 | - name: update_every |
| 70 | description: Data collection interval (seconds). |
| 71 | default_value: 60 |
| 72 | required: false |
| 73 | group: Collection |
| 74 | - name: autodetection_retry |
| 75 | description: Autodetection retry interval (seconds). Set 0 to disable. |
| 76 | default_value: 0 |
| 77 | required: false |
| 78 | group: Collection |
| 79 | - name: url |
| 80 | description: PAN-OS management interface URL. The path must be empty, `/`, or `/api`. |
| 81 | default_value: https://127.0.0.1 |
| 82 | required: true |
| 83 | group: Target |
| 84 | - name: timeout |
| 85 | description: PAN-OS XML API request timeout (seconds). |
| 86 | default_value: 3 |
| 87 | required: false |
| 88 | group: Target |
| 89 | - name: vsys |
| 90 | description: Optional PAN-OS virtual system scope for operational commands. |
| 91 | default_value: "" |
| 92 | required: false |
| 93 | group: Target |
| 94 | - name: api_key |
| 95 | description: PAN-OS XML API key. Takes priority over username/password key generation. |
| 96 | default_value: "" |
| 97 | required: false |
| 98 | group: Auth |
| 99 | - name: username |
| 100 | description: PAN-OS username used for API key generation. |
| 101 | default_value: "" |
| 102 | required: false |
| 103 | group: Auth |
| 104 | - name: password |
| 105 | description: PAN-OS password used for API key generation. |
| 106 | default_value: "" |
| 107 | required: false |
| 108 | group: Auth |
| 109 | - name: tls_skip_verify |
| 110 | description: Skip TLS certificate and hostname verification. |
| 111 | default_value: no |
| 112 | required: false |
| 113 | group: TLS |
| 114 | - name: tls_ca |
| 115 | description: Path to CA bundle used to validate the server certificate. |
| 116 | default_value: "" |
| 117 | required: false |
| 118 | group: TLS |
| 119 | - name: tls_cert |
| 120 | description: Path to client TLS certificate. |
| 121 | default_value: "" |
| 122 | required: false |
| 123 | group: TLS |
| 124 | - name: tls_key |
| 125 | description: Path to client TLS private key. |
| 126 | default_value: "" |
| 127 | required: false |
| 128 | group: TLS |
| 129 | - name: proxy_url |
| 130 | description: HTTP proxy URL. Include proxy credentials in the URL if needed. |
| 131 | default_value: "" |
| 132 | required: false |
| 133 | group: Proxy |
| 134 | - name: headers |
| 135 | description: Additional HTTP headers. |
| 136 | default_value: "" |
| 137 | required: false |
| 138 | group: Headers |
| 139 | - name: vnode |
| 140 | description: Associates this data collection job with a Virtual Node. |
| 141 | default_value: "" |
| 142 | required: false |
| 143 | group: Virtual Node |
| 144 | examples: |
| 145 | folding: |
| 146 | title: Config |
| 147 | enabled: true |
| 148 | list: |
| 149 | - name: API key |
| 150 | description: Collecting PAN-OS metrics with an existing XML API key. |
| 151 | folding: |
| 152 | enabled: false |
| 153 | config: | |
| 154 | jobs: |
| 155 | - name: firewall |
| 156 | url: https://192.0.2.1 |
| 157 | api_key: YOUR_PANOS_XML_API_KEY |
| 158 | update_every: 60 |
| 159 | timeout: 3 |
| 160 | - name: Username/password key generation |
| 161 | description: Letting the collector generate and reuse an API key through PAN-OS. |
| 162 | config: | |
| 163 | jobs: |
| 164 | - name: firewall |
| 165 | url: https://192.0.2.1 |
| 166 | username: netdata |
| 167 | password: YOUR_PASSWORD |
| 168 | update_every: 60 |
| 169 | timeout: 3 |
| 170 | troubleshooting: |
| 171 | problems: |
| 172 | list: |
| 173 | - name: No BGP charts are created |
| 174 | description: | |
| 175 | Verify that BGP is configured and that the account can run PAN-OS XML API operational requests. |
| 176 | The collector logs when no legacy or Advanced Routing Engine BGP peer command returns peers. |
| 177 | Advanced Routing Engine parsing is best-effort until validated with sanitized real PAN-OS ARE XML output. |
| 178 | - name: Panorama proxy collection is unsupported |
| 179 | description: | |
| 180 | Configure one job per firewall management interface. This collector does not support using Panorama as a target proxy for managed firewalls in v1. |
| 181 | - name: A metricset fails but other charts work |
| 182 | description: | |
| 183 | The collector keeps successful metricsets running and logs the failing metricset name and XML command context. |
| 184 | - name: PAN-OS accepted a command but no telemetry appears |
| 185 | description: | |
| 186 | A "success response has no recognized telemetry payload" error means PAN-OS accepted the operational command, but the XML result did not contain the expected section for that metricset. |
| 187 | Verify the account permissions and platform support for the metricset, or provide a sanitized XML sample so the parser can be updated. |
| 188 | - name: A PAN-OS value cannot be parsed |
| 189 | description: | |
| 190 | The collector reports missing or invalid integer, decimal, duration, status, license expiration, and IPsec tunnel-count values with the metricset, field, entity name, and raw value when present. |
| 191 | It does not silently convert missing or malformed values to zero, report fake valid status, or treat unrecognized license dates as never-expiring licenses. |
| 192 | alerts: |
| 193 | - name: panos_bgp_peer_not_established |
| 194 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/panos.conf |
| 195 | metric: panos.bgp.peer.state |
| 196 | info: Critical when a BGP peer has not been established for 5 minutes. |
| 197 | - name: panos_device_certificate_invalid |
| 198 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/panos.conf |
| 199 | metric: panos.system.device_certificate_status |
| 200 | info: Critical when PAN-OS reports the device certificate as invalid. |
| 201 | - name: panos_ha_peer_connection_down |
| 202 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/panos.conf |
| 203 | metric: panos.ha.peer.connection_status |
| 204 | info: Critical when the HA peer connection has not been up for 5 minutes. |
| 205 | - name: panos_environment_sensor_alarm |
| 206 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/panos.conf |
| 207 | metric: panos.environment.sensor_alarm_status |
| 208 | info: Critical when PAN-OS reports an environment sensor alarm. |
| 209 | - name: panos_license_expired |
| 210 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/panos.conf |
| 211 | metric: panos.license.status |
| 212 | info: Critical when PAN-OS reports a license as expired. |
| 213 | - name: panos_license_expires_soon |
| 214 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/panos.conf |
| 215 | metric: panos.license.time_until_expiration |
| 216 | info: Warning under 30 days before expiration, critical under 7 days. Expired licenses trigger panos_license_expired instead. |
| 217 | metrics: |
| 218 | folding: |
| 219 | title: Metrics |
| 220 | enabled: false |
| 221 | description: "" |
| 222 | availability: [] |
| 223 | scopes: |
| 224 | - name: System |
| 225 | description: These metrics refer to the PAN-OS device. |
| 226 | labels: |
| 227 | - name: hostname |
| 228 | description: PAN-OS hostname. |
| 229 | - name: model |
| 230 | description: PAN-OS model. |
| 231 | - name: serial |
| 232 | description: Device serial number. |
| 233 | - name: sw_version |
| 234 | description: PAN-OS software version. |
| 235 | metrics: |
| 236 | - name: panos.system.uptime |
| 237 | description: System Uptime |
| 238 | unit: seconds |
| 239 | chart_type: line |
| 240 | dimensions: |
| 241 | - name: uptime |
| 242 | - name: panos.system.device_certificate_status |
| 243 | description: Device Certificate Status |
| 244 | unit: status |
| 245 | chart_type: stacked |
| 246 | dimensions: |
| 247 | - name: valid |
| 248 | - name: invalid |
| 249 | - name: panos.system.operational_mode |
| 250 | description: Operational Mode |
| 251 | unit: mode |
| 252 | chart_type: stacked |
| 253 | dimensions: |
| 254 | - name: normal |
| 255 | - name: other |
| 256 | - name: High availability |
| 257 | description: These metrics refer to the PAN-OS HA pair state reported by the local firewall. |
| 258 | labels: [] |
| 259 | metrics: |
| 260 | - name: panos.ha.status |
| 261 | description: HA Status |
| 262 | unit: status |
| 263 | chart_type: stacked |
| 264 | dimensions: |
| 265 | - name: enabled |
| 266 | - name: disabled |
| 267 | - name: panos.ha.local.state |
| 268 | description: Local HA State |
| 269 | unit: state |
| 270 | chart_type: stacked |
| 271 | dimensions: |
| 272 | - name: active |
| 273 | - name: passive |
| 274 | - name: non_functional |
| 275 | - name: suspended |
| 276 | - name: unknown |
| 277 | - name: panos.ha.peer.state |
| 278 | description: Peer HA State |
| 279 | unit: state |
| 280 | chart_type: stacked |
| 281 | dimensions: |
| 282 | - name: active |
| 283 | - name: passive |
| 284 | - name: non_functional |
| 285 | - name: suspended |
| 286 | - name: unknown |
| 287 | - name: panos.ha.peer.connection_status |
| 288 | description: HA Peer Connection Status |
| 289 | unit: status |
| 290 | chart_type: stacked |
| 291 | dimensions: |
| 292 | - name: up |
| 293 | - name: down |
| 294 | - name: unknown |
| 295 | - name: panos.ha.state_sync_status |
| 296 | description: HA State Synchronization |
| 297 | unit: status |
| 298 | chart_type: stacked |
| 299 | dimensions: |
| 300 | - name: synchronized |
| 301 | - name: not_synchronized |
| 302 | - name: unknown |
| 303 | - name: High availability link |
| 304 | description: These metrics refer to a single PAN-OS HA link. |
| 305 | labels: |
| 306 | - name: link |
| 307 | description: HA link name. |
| 308 | metrics: |
| 309 | - name: panos.ha.link_status |
| 310 | description: HA Link Status |
| 311 | unit: status |
| 312 | chart_type: stacked |
| 313 | dimensions: |
| 314 | - name: up |
| 315 | - name: down |
| 316 | - name: unknown |
| 317 | - name: Environment sensor |
| 318 | description: These metrics refer to a single PAN-OS environment sensor. |
| 319 | labels: |
| 320 | - name: slot |
| 321 | description: Hardware slot. |
| 322 | - name: sensor |
| 323 | description: Sensor description. |
| 324 | - name: sensor_type |
| 325 | description: Sensor type. |
| 326 | metrics: |
| 327 | - name: panos.environment.temperature |
| 328 | description: Environment Temperature |
| 329 | unit: Celsius |
| 330 | chart_type: line |
| 331 | dimensions: |
| 332 | - name: temperature |
| 333 | - name: panos.environment.fan_speed |
| 334 | description: Environment Fan Speed |
| 335 | unit: RPM |
| 336 | chart_type: line |
| 337 | dimensions: |
| 338 | - name: speed |
| 339 | - name: panos.environment.voltage |
| 340 | description: Environment Voltage |
| 341 | unit: Volts |
| 342 | chart_type: line |
| 343 | dimensions: |
| 344 | - name: voltage |
| 345 | - name: panos.environment.sensor_alarm_status |
| 346 | description: Environment Sensor Alarm |
| 347 | unit: status |
| 348 | chart_type: stacked |
| 349 | dimensions: |
| 350 | - name: clear |
| 351 | - name: alarm |
| 352 | - name: panos.environment.power_supply_presence_status |
| 353 | description: Power Supply Presence |
| 354 | unit: status |
| 355 | chart_type: stacked |
| 356 | dimensions: |
| 357 | - name: present |
| 358 | - name: absent |
| 359 | - name: panos.environment.power_supply_alarm_status |
| 360 | description: Power Supply Alarm |
| 361 | unit: status |
| 362 | chart_type: stacked |
| 363 | dimensions: |
| 364 | - name: clear |
| 365 | - name: alarm |
| 366 | - name: License summary |
| 367 | description: These metrics summarize PAN-OS licenses. |
| 368 | labels: [] |
| 369 | metrics: |
| 370 | - name: panos.license.count |
| 371 | description: Licenses |
| 372 | unit: licenses |
| 373 | chart_type: line |
| 374 | dimensions: |
| 375 | - name: total |
| 376 | - name: expired |
| 377 | - name: License |
| 378 | description: These metrics refer to one PAN-OS license. |
| 379 | labels: |
| 380 | - name: feature |
| 381 | description: License feature name. |
| 382 | - name: description |
| 383 | description: License description. |
| 384 | metrics: |
| 385 | - name: panos.license.status |
| 386 | description: License Status |
| 387 | unit: status |
| 388 | chart_type: stacked |
| 389 | dimensions: |
| 390 | - name: valid |
| 391 | - name: expired |
| 392 | - name: panos.license.time_until_expiration |
| 393 | description: Time until expiration for non-expired licenses. A value of -1 means PAN-OS reports that the license never expires. |
| 394 | unit: days |
| 395 | chart_type: line |
| 396 | dimensions: |
| 397 | - name: time_until_expiration |
| 398 | - name: IPsec summary |
| 399 | description: These metrics summarize active PAN-OS IPsec security associations. |
| 400 | labels: [] |
| 401 | metrics: |
| 402 | - name: panos.ipsec.tunnels |
| 403 | description: IPsec Tunnels |
| 404 | unit: tunnels |
| 405 | chart_type: line |
| 406 | dimensions: |
| 407 | - name: active |
| 408 | - name: IPsec tunnel |
| 409 | description: These metrics refer to one active PAN-OS IPsec security association. |
| 410 | labels: |
| 411 | - name: tunnel |
| 412 | description: Tunnel name. |
| 413 | - name: gateway |
| 414 | description: Gateway name. |
| 415 | - name: remote |
| 416 | description: Remote peer. |
| 417 | - name: tunnel_id |
| 418 | description: PAN-OS tunnel identifier. |
| 419 | - name: protocol |
| 420 | description: Tunnel protocol. |
| 421 | - name: encryption |
| 422 | description: Encryption algorithm. |
| 423 | metrics: |
| 424 | - name: panos.ipsec.tunnel.sa_lifetime |
| 425 | description: IPsec Tunnel SA Remaining Lifetime |
| 426 | unit: seconds |
| 427 | chart_type: line |
| 428 | dimensions: |
| 429 | - name: remaining_lifetime |
| 430 | - name: BGP peer |
| 431 | description: These metrics refer to a single BGP peer on a PAN-OS virtual router or logical router. |
| 432 | labels: |
| 433 | - name: vr |
| 434 | description: PAN-OS virtual router or logical router. |
| 435 | - name: peer_address |
| 436 | description: BGP peer address. |
| 437 | - name: local_address |
| 438 | description: Local BGP address. |
| 439 | - name: remote_as |
| 440 | description: Remote autonomous system. |
| 441 | - name: peer_group |
| 442 | description: PAN-OS peer group. |
| 443 | metrics: |
| 444 | - name: panos.bgp.peer.state |
| 445 | description: BGP Peer State |
| 446 | unit: state |
| 447 | chart_type: stacked |
| 448 | dimensions: |
| 449 | - name: idle |
| 450 | - name: connect |
| 451 | - name: active |
| 452 | - name: opensent |
| 453 | - name: openconfirm |
| 454 | - name: established |
| 455 | - name: unknown |
| 456 | - name: panos.bgp.peer.uptime |
| 457 | description: BGP Peer Uptime |
| 458 | unit: seconds |
| 459 | chart_type: line |
| 460 | dimensions: |
| 461 | - name: uptime |
| 462 | - name: panos.bgp.peer.messages |
| 463 | description: BGP Peer Messages |
| 464 | unit: messages/s |
| 465 | chart_type: line |
| 466 | dimensions: |
| 467 | - name: in |
| 468 | - name: out |
| 469 | - name: panos.bgp.peer.updates |
| 470 | description: BGP Peer Updates |
| 471 | unit: messages/s |
| 472 | chart_type: line |
| 473 | dimensions: |
| 474 | - name: in |
| 475 | - name: out |
| 476 | - name: panos.bgp.peer.flaps |
| 477 | description: BGP Peer Flaps |
| 478 | unit: flaps/s |
| 479 | chart_type: line |
| 480 | dimensions: |
| 481 | - name: flaps |
| 482 | - name: panos.bgp.peer.established_transitions |
| 483 | description: BGP Peer Established Transitions |
| 484 | unit: transitions/s |
| 485 | chart_type: line |
| 486 | dimensions: |
| 487 | - name: established |
| 488 | - name: BGP peer address family |
| 489 | description: These metrics refer to one AFI/SAFI family for a BGP peer. |
| 490 | labels: |
| 491 | - name: vr |
| 492 | description: PAN-OS virtual router or logical router. |
| 493 | - name: peer_address |
| 494 | description: BGP peer address. |
| 495 | - name: local_address |
| 496 | description: Local BGP address. |
| 497 | - name: remote_as |
| 498 | description: Remote autonomous system. |
| 499 | - name: peer_group |
| 500 | description: PAN-OS peer group. |
| 501 | - name: afi |
| 502 | description: Address family. |
| 503 | - name: safi |
| 504 | description: Subsequent address family. |
| 505 | metrics: |
| 506 | - name: panos.bgp.peer.prefixes_received |
| 507 | description: BGP Peer Received Prefixes |
| 508 | unit: prefixes |
| 509 | chart_type: line |
| 510 | dimensions: |
| 511 | - name: total |
| 512 | - name: accepted |
| 513 | - name: rejected |
| 514 | - name: panos.bgp.peer.prefixes_advertised |
| 515 | description: BGP Peer Advertised Prefixes |
| 516 | unit: prefixes |
| 517 | chart_type: line |
| 518 | dimensions: |
| 519 | - name: advertised |
| 520 | - name: BGP virtual router |
| 521 | description: These metrics refer to one PAN-OS virtual router or logical router. |
| 522 | labels: |
| 523 | - name: vr |
| 524 | description: PAN-OS virtual router or logical router. |
| 525 | metrics: |
| 526 | - name: panos.bgp.vr.peers_by_state |
| 527 | description: BGP Peers by State |
| 528 | unit: peers |
| 529 | chart_type: stacked |
| 530 | dimensions: |
| 531 | - name: idle |
| 532 | - name: connect |
| 533 | - name: active |
| 534 | - name: opensent |
| 535 | - name: openconfirm |
| 536 | - name: established |
| 537 | - name: unknown |
| 538 | - name: panos.bgp.vr.peers_total |
| 539 | description: BGP Peers Total |
| 540 | unit: peers |
| 541 | chart_type: line |
| 542 | dimensions: |
| 543 | - name: configured |
| 544 | - name: established |