Skyline Configuration on Check Point Servers that run Gaia OS

Procedure

On an online Check Point Server:

The OpenTelemetry Agent (OtlpAgent) and the OpenTelemetry Collector (CPotelcol) packages are installed automatically on all applicable Check Point Servers, if you allowed the Automatic Update downloads as described in sk94508.

On an offline Check Point Server:

The minimum required OpenTelemetry Agent and OpenTelemetry Collector packages are also installed as part of the Jumbo Hotfix Accumulator installation.

See sk178566 > section "Requirements".

Related offline update packages:

Important Notes

Important:

Do not cut and paste the commands below. Enter them manually.
In a Cluster, you must configure all the Cluster Members in the same way.
In Management High Availability, we recommend to configure all the Management Servers in the same way.
On a Maestro Orchestrator (MHO):

You can run the CLI command "sklnctl" (in the Expert mode) or run the Gaia REST API command (requires Gaia API v1.7 or higher).

The CLI command runs on the Orchestrator and configures only the Orchestrator.
In a Scalable Platform Security Group:

You can run the CLI command "g_all sklnctl" (in the Expert mode) or run the Gaia REST API command (requires Gaia API v1.7 or higher).
For the applicable Gaia REST API commands, refer to the Check Point Gaia API Reference (v1.7 and higher):
- In Gaia API v1.8 and higher: Section "Diagnostics" > Section "OpenTelemetry.
- In Gaia API v1.7: Section "OpenTelemetry".

Procedure

Prepare the required payload for the command:

Notes:

Replace the placeholder strings "<...>" below with your actual strings.
The "name" attribute is optional, but recommended.

Must contain only lowercase Latin letters (a-z).

To configure a TLS connection between the OpenTelemetry Collector and monitoring server:

In the "ca-public-key" section, configure the TLS settings with the CA certificate of your monitoring server (as PEM X509), or use a self-signed certificate you generate for yourself.

In the example payloads below, replace "<SERVER-CERTIFICATE>" with the CA certificate of the monitoring server (PEX X509) - paste the entire string:

-----BEGIN CERTIFICATE-----<BASE64_TEXT>-----END CERTIFICATE-----

In the "url" attribute, configure your monitoring server's IP address / URL.

If you do not wish to use TLS encryption in labs or test environments, then make these changes in the payload:
1. In the "url" attribute, change the URL protocol from "https://" to "http://".
2. Remove the "client-auth" and "server-auth" attributes.
  
  Note - When you apply the payload, this warning appears: "it is recommended to have both client and server authentication").

Example JSON payloads for Splunk:

Note - For information about a HEC Token for Splunk, click here.

Example JSON payloads for SolarWinds:

Note - For information about an API Token for SolarWinds, click here.

Example JSON payloads for Dynatrace:

Note - For information about a Access Token for Dynatrace, click here.

Example JSON payloads for VictoriaMetrics:

JSON payload for VictoriaMetrics - connection with TLS

Note - In the "basic" section, configure the "username" and "password" attributes to your monitoring server's username / password.

The "password" attribute supports only these characters:

uppercase letters (A-Z)
lowercase letters (a-z)
digits (0-9)
underscore (_)
comma (,)
period (.)
backslash (\)
slash (/)
hyphen (-)

{
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "basic": {
                        "username": "<USERNAME_on_VICTORIAMETRICS_SERVER>",
                        "password": "<PASSWORD_on_VICTORIAMETRICS_SERVER>"
                    }
                },
                "enabled": true,
                "server-auth": {
                    "ca-public-key": {
                        "type": "PEM-X509",
                        "value": "<SERVER-CERTIFICATE>"
                    }
                },
                "type": "prometheus-remote-write",
                "url": "https://<EXTERNAL_IP_ADDRESS_of_VICTORIAMETRICS_SERVER>:9090/api/v1/write"
            }
        ]
    }
}

Example JSON payloads for Datadog:

Warning - Skyline does not support a JSON payload that contains other export targets together with the Datadog export target.

Run the configuration command to apply the JSON payload - either the CLI command (in the Expert mode), or the Gaia REST API command:

Method 1 - Run the CLI command "sklnctl":

Save the JSON payload in a file (for example, /home/admin/payload.json).

On a Scalable Platform Security Group, copy the JSON payload file to all Security Group Members:

asg_cp2blades /home/admin/payload.json

Run this command:

On a Security Gateway / each Cluster Member / Management Server / Log Server / SmartEvent Server:

sklnctl export --set "$(cat /home/admin/payload.json)"

On a Scalable Platform Security Group:

g_all sklnctl export --set "$(cat /home/admin/payload.json)"

Method 2 - Run the Gaia REST API command "set-open-telemetry" (requires Gaia API v1.7 and higher):

POST{server}/v1.7/set-open-telemetry
Content-Type: application/json
X-chkp-sid: {{session}}
{
   <JSON Payload>
}

Note - To disable Skyline completely:

Change the value of the "enabled" attribute in the JSON payload file:

from "enabled": true

to "enabled": false
Run the API command again

Procedure

The sklnctl tool configures the OpenTelemetry Collector.

The OpenTelemetry Collector filter works on the allow-list basis.

Note - On a Scalable Platform Security Group, run the "g_all sklnctl <options>" command.

These are the available commands (in the Expert mode):

To show the currently exported metrics:

sklnctl otelcol metrics --show

To check if default metrics are exported:

sklnctl otelcol metrics --is-default

To add metrics to the allow-list:

sklnctl otelcol metrics --add <metric-id1> <metric-id2> <metric-id3> ...

To remove metrics from the allow-list:

sklnctl otelcol metrics --remove <metric-id1> <metric-id2> <metric-id3> ...

To reset the allow-list to the default:

sklnctl otelcol metrics --reset

Example workflow (in the Expert mode):

Show the currently exported metrics:

sklnctl otelcol metrics --show > /var/log/metrics.txt

Edit the file to keep only the desired metrics:

vi /var/log/metrics.txt

See Skyline Metrics Repository.

On a Scalable Platform Security Group, copy the file to all Security Group Members:

asg_cp2blades /var/log/metrics.txt

Add the desired metrics to the allow-list:

On a Security Gateway / each Cluster Member / Management Server / Log Server / SmartEvent Server:

sklnctl otelcol metrics --add $(cat /var/log/metrics.txt | tr '\n' ' ')

On a Scalable Platform Security Group:

g_all sklnctl otelcol metrics --add $(cat /var/log/metrics.txt | tr '\n' ' ')

Skyline Configuration on Check Point Servers that run Gaia OS - Other Monitoring Tools

Step 1 - Install the Third-Party Monitoring Tool

Step 2 - Install the OpenTelemetry Agent and OpenTelemetry Collector on the Check Point Server

Step 3 - Configure the OpenTelemetry Collector on the Check Point Server to work with the Third-Party Monitoring Tool

Step 4 - Configure the filter for the OpenTelemetry Collector exported metrics

Step 5 - Configure Access Control Policy