Skyline Configuration on Check Point Servers that run Gaia OS - Other Monitoring Tools

Best Practice - Use the Prometheus Server with the Grafana Server.

See Skyline Configuration on Check Point Servers that run Gaia OS - Prometheus with Grafana.

Skyline supports other third-party monitoring tools (to configure these tools, refer to the third-party official documentation):

This section applies to these Check Point Servers:

Security Gateways / VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Gateways
ClusterXL Cluster of Check Point Security Gateways that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Security Gateways are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) VSX VSLS cluster supports up to 13 Cluster Members. Note: In ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic. Members
Security Groups A logical group of Security Appliances (in Maestro) / Security Gateway Modules (on Scalable Chassis) that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances / Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. In Maestro, each Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. on Scalable Platforms (Maestro and Scalable Chassis The container that contains the all the components of a 60000 / 40000 Appliance. Synonym: Chassis.)
Security Management Servers
Multi-Domain Security Management Servers
Multi-Domain Log Servers
Log Servers
SmartEvent Servers
Endpoint Security Management Servers
Endpoint Policy Servers

Step 1 - Install the Third-Party Monitoring Tool

Refer to the third-party official documentation.

Step 2 - Install the OpenTelemetry Agent and OpenTelemetry Collector on the Check Point Server

Step 3 - Configure the OpenTelemetry Collector on the Check Point Server to work with the Third-Party Monitoring Tool

Step 4 - Configure the filter for the OpenTelemetry Collector exported metrics

Procedure

The sklnctl tool configures the OpenTelemetry Collector.

The OpenTelemetry Collector filter works on the allow-list basis.

These are the available commands (in the Expert mode):

To show the currently exported metrics:

sklnctl otelcol metrics --show

To check if default metrics are exported:

sklnctl otelcol metrics --is-default

To add metrics to the allow-list:

sklnctl otelcol metrics --add <metric-id1> <metric-id2> <metric-id3> ...

To remove metrics from the allow-list:

sklnctl otelcol metrics --remove <metric-id1> <metric-id2> <metric-id3> ...

To reset the allow-list to the default:

sklnctl otelcol metrics --reset

Example workflow (in the Expert mode):

Show the currently exported metrics:

sklnctl otelcol metrics --show > /var/log/metrics.txt

Edit the file to keep only the desired metrics:

vi /var/log/metrics.txt

See Skyline Metrics Repository.

Add the desired metrics to the allow-list:

sklnctl otelcol metrics --add $(cat /var/log/metrics.txt | tr '\n' ' ')

Step 5 - Configure Access Control Policy

If you configured Skyline on a Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources., ClusterXL, or Scalable Platform Security Group, then you must make sure your Access Control Policy allows the connection to the Third-Party Monitoring Tool to send the exported metrics.

You must configure the required rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. on the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. (in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. or with Management API) and install the policy.

See the:

Quantum Security Management Administration Guide for your version.
Check Point Management API Reference.