Skyline Configuration on Check Point Servers that run Gaia OS - Other Monitoring Tools

Best Practice - Use the Prometheus Server with the Grafana Server.

See Skyline Configuration on Check Point Servers that run Gaia OS - Prometheus with Grafana.

Note:

By default, Skyline on a Check Point Server uses a proxy server configured in one of these:

  • SmartConsole > Global properties > Proxy.

  • SmartConsole > the object of the Check Point Server > Network Management > Proxy.

  • The proxy server configured in the Gaia operating system on this Check Point Server.

If this Check Point Server must connect to a specific destination directly (to bypass the configured proxy server), then configure an exception:

  1. Connect to the command line on this Check Point Server.

  2. Log in to the Expert mode.

  3. Edit this file:

    vi /opt/CPotelcol/no_proxy

    Skyline uses this file to configure the standard environment variable named "NO_PROXY".

  4. Add a comma-separated list of domains, IP addresses, or networks to exclude from the configured proxy server.

    Example:

    localhost,my.collector.host

  5. Save the changes in the file and exit the editor.

Skyline supports these third-party monitoring tools (to configure these tools, refer to the third-party official documentation):

This section applies to these Check Point Servers:

  • Security Gateways / VSX Gateways.

  • ClusterXL Members.

    In a Cluster, you must configure all the Cluster Members in the same way.

  • Security Groups on Scalable Platforms (ElasticXL Cluster, Maestro, and Scalable Chassis).

  • Security Management Servers.

  • Multi-Domain Security Management Servers.

  • Multi-Domain Log Servers.

  • Log Servers.

  • SmartEvent Servers.

  • Endpoint Security Management Servers.

  • Endpoint Policy Servers.

Step 1 - Install the Third-Party Monitoring Tool

Refer to the third-party official documentation.

Step 2 - Install the OpenTelemetry Agent and OpenTelemetry Collector on the Check Point Server

On an online Check Point Server:

The OpenTelemetry Agent (OtlpAgent) and the OpenTelemetry Collector (CPotelcol) packages are installed automatically on all applicable Check Point Servers, if you allowed the Automatic Update downloads as described in sk94508.

On an offline Check Point Server:

The minimum required OpenTelemetry Agent and OpenTelemetry Collector packages are also installed as part of the Jumbo Hotfix Accumulator installation.

See sk178566 > section "Requirements".

Related offline update packages:

Step 3 - Configure the OpenTelemetry Collector on the Check Point Server to work with the Third-Party Monitoring Tool

Important:

  • Do not cut and paste the commands below. Enter them manually.

  • In a Cluster, you must configure all the Cluster Members in the same way.

  • In Management High Availability, we recommend to configure all the Management Servers in the same way.

  • On a Maestro Orchestrator (MHO):

    You can run the CLI command "sklnctl" (in the Expert mode) or run the Gaia REST API command (requires Gaia API v1.7 or higher).

    The CLI command runs on the Orchestrator and configures only the Orchestrator.

  • In a Scalable Platform Security Group:

    You can run the CLI command "g_all sklnctl" (in the Expert mode) or run the Gaia REST API command (requires Gaia API v1.7 or higher).

  • For the applicable Gaia REST API commands, refer to the Check Point Gaia API Reference (at the top, select the correct version) (v1.7 and higher):

    • In Gaia API v1.8 and higher: Section "Diagnostics" > Section "OpenTelemetry.

    • In Gaia API v1.7: Section "OpenTelemetry".

  1. Prepare the required payload for the command:

    Notes:

    • Replace the placeholder strings "<...>" below with your actual strings.

    • The "name" attribute is optional, but recommended.

      Must contain only lowercase Latin letters (a-z).

    • To configure a TLS connection between the OpenTelemetry Collector and monitoring server:

      In the "ca-public-key" section, configure the TLS settings with the CA certificate of your monitoring server (as PEM X509), or use a self-signed certificate you generate for yourself.

      In the example payloads below, replace "<SERVER_CERTIFICATE>" with the CA certificate of the monitoring server (PEX X509) - paste the entire string:

      -----BEGIN CERTIFICATE-----<BASE64_TEXT>-----END CERTIFICATE-----

    • In the "url" attribute, configure your monitoring server's IP address / URL.

      If you do not wish to use TLS encryption in labs or test environments, then make these changes in the payload:

      1. In the "url" attribute, change the URL protocol from "https://" to "http://".

      2. Remove the "client-auth" and "server-auth" attributes.

        Note - When you apply the payload, this warning appears: "it is recommended to have both client and server authentication").

    Example JSON payloads for Splunk:

    Notes:

    • For information about a HEC Token for Splunk, click here.

    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "token": {
                        "custom-header": {
                            "key": "token",
                            "value": "<YOUR_HEC_TOKEN>"
                        }
                    }
                },
                "server-auth": {
                    "ca-public-key": {
                        "type": "PEM-X509",
                        "value": "<SERVER_CERTIFICATE>"
                    }
                },
                "enabled": true,
                "type": "splunk_hec",
                "name": "splunk-tls-01",
                "url": "https://<FQDN_or_IP_of_SPLUNK_SERVER>:8088/services/collector/event"
            }
        ]
    }
}
    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "token": {
                        "custom-header": {
                            "key": "token",
                            "value": "<YOUR_HEC_TOKEN>"
                        }
                    }
                },
                "enabled": true,
                "type": "splunk_hec",
                "name": "splunk-no-tls-01",
                "url": "https://<FQDN_or_IP_of_SPLUNK_SERVER>:8088/services/collector/event"
            }
        ]
    }
}

    Example JSON payloads for SolarWinds:

    Note - For information about an API Token for SolarWinds, click here.

    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "token": {
                        "custom-header": {
                            "key": "Authorization",
                            "value": "Bearer <YOUR_API_TOKEN>"
                        }
                    }
                },
                "server-auth": {
                    "ca-public-key": {
                        "type": "PEM-X509",
                        "value": "<SERVER_CERTIFICATE>"
                    }
                },
                "enabled": true,
                "type": "otlp",
                "name": "solarwinds-tls-01",
                "url": "otel.collector.<YOUR_REGION>.cloud.solarwinds.com:443"
            }
        ]
    }
}
    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "token": {
                        "custom-header": {
                            "key": "Authorization",
                            "value": "Bearer <YOUR_API_TOKEN>"
                        }
                    }
                },
                "enabled": true,
                "type": "otlp",
                "name": "solarwinds-no-tls-01",
                "url": "otel.collector.<YOUR_REGION>.cloud.solarwinds.com:443"
            }
        ]
    }
}

    Example JSON payloads for Dynatrace:

    Note - For information about a Access Token for Dynatrace, click here.

    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "token": {
                        "custom-header": {
                            "key": "Authorization",
                            "value": "Api-Token <YOUR_ACCESS_TOKEN>"
                        }
                    }
                },
                "server-auth": {
                    "ca-public-key": {
                        "type": "PEM-X509",
                        "value": "<SERVER_CERTIFICATE>"
                    }
                },
                "enabled": true,
                "type": "otlphttp",
                "name": "dynatrace-tls-01",
                "url": "https://<FQDN_or_IP_of_DYNATRACE_SERVER>.live.dynatrace.com/api/v2/otlp"
            }
        ]
    }
}
    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "token": {
                        "custom-header": {
                            "key": "Authorization",
                            "value": "Api-Token <YOUR_ACCESS_TOKEN>"
                        }
                    }
                },
                "enabled": true,
                "type": "otlphttp",
                "name": "dynatrace-no-tls-01",
                "url": "https://<FQDN_or_IP_of_DYNATRACE_SERVER>.live.dynatrace.com/api/v2/otlp"
            }
        ]
    }
}

    Example JSON payloads for VictoriaMetrics:

    Note - In the "basic" section, configure the "username" and "password" attributes to your monitoring server's username / password.

    The "password" attribute supports only these characters:

    • uppercase letters (A-Z)
    • lowercase letters (a-z)
    • digits (0-9)
    • underscore (_)
    • comma (,)
    • period (.)
    • backslash (\)
    • slash (/)
    • hyphen (-)
    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "basic": {
                        "username": "<USERNAME_on_VICTORIAMETRICS_SERVER>",
                        "password": "<PASSWORD_on_VICTORIAMETRICS_SERVER>"
                    }
                },
                "enabled": true,
                "server-auth": {
                    "ca-public-key": {
                        "type": "PEM-X509",
                        "value": "<SERVER_CERTIFICATE>"
                    }
                },
                "type": "prometheus-remote-write",
                "url": "https://<EXTERNAL_IP_ADDRESS_of_VICTORIAMETRICS_SERVER>:9090/api/v1/write"
            }
        ]
    }
}
    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "enabled": true,
                "type": "prometheusremotewrite",
                "url": "https://<EXTERNAL_IP_ADDRESS_of_VICTORIAMETRICS_SERVER>:8088/services/collector"
            }
        ]
    }
}

    Example JSON payloads for Datadog:

    Warning - Skyline does not support a JSON payload that contains other export targets together with the Datadog export target.

    		 
    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "token": {
                        "custom-header": {
                            "key": "apikey",
                            "value": "<YOUR_API_KEY>"
                        }
                    }
                },
                "server-auth": {
                    "ca-public-key": {
                        "type": "PEM-X509",
                        "value": "<SERVER_CERTIFICATE>"
                    }
                },
                "enabled": true,
                "type": "datadog",
                "name": "datadog-tls-01",
                "url": "https://<DATADOG-SITE-ADDRESS>"
            }
        ]
    }
}

    Where "<DATADOG-SITE-ADDRESS>" is the site address of the Datadog intake, to which you send the Agent data:

    • datadoghq.com

    • datadoghq.eu 

    {
    "enabled": true,
    "export-targets": {
        "add": [
            {
                "client-auth": {
                    "token": {
                        "custom-header": {
                            "key": "apikey",
                            "value": "<YOUR_API_KEY>"
                        }
                    }
                },
                "enabled": true,
                "type": "datadog",
                "name": "datadog-no-tls-01",
                "url": "https://<DATADOG-SITE-ADDRESS>"
            }
        ]
    }
}

    Where "<DATADOG-SITE-ADDRESS>" is the site address of the Datadog intake, to which you send the Agent data:

    • datadoghq.com

    • datadoghq.eu

    Example JSON payload for Coralogix:

    Note - For information about Coralogix Endpoints, click here.

    		 
    {
    "enabled": true,
    "export-targets": {
      "rebase ": [
        {
          "client-auth": {
            "token": {
              "header-bearer-token": "<YOUR_API_TOKEN>"
            }
          },
          "enabled": true,
          "name": "coralogix-tls-01",
          "server-auth": {
            "ca-public-key": {
              "type": "PEM-X509",
              "value": "<SERVER_CERTIFICATE>"
            }
          },
          "type": "prometheus-remote-write",
          "url": " https://<CORALOGIX_ENDPOINT>/prometheus/v1/write"
        }
      ]
    }
}

  2. Run the configuration command to apply the JSON payload - either the CLI command (in the Expert mode), or the Gaia REST API command:

    • Method 1 - Run the CLI command "sklnctl":

      1. Save the JSON payload in a file (for example, /home/admin/payload.json).

      2. On a Scalable Platform Security Group, copy the JSON payload file to all Security Group Members:

        asg_cp2blades /home/admin/payload.json

      3. Run this command:

        • On a Security Gateway / each Cluster Member / Management Server / Log Server / SmartEvent Server:

          sklnctl export --set "$(cat /home/admin/payload.json)"

        • On a Scalable Platform Security Group:

          g_all sklnctl export --set "$(cat /home/admin/payload.json)"

    • Method 2 - Run the Gaia REST API command "set-open-telemetry" (requires Gaia API v1.7 and higher):

      POST{server}/v1.7/set-open-telemetry
Content-Type: application/json
X-chkp-sid: {{session}}
{
   <JSON Payload>
}

      Note - To disable Skyline completely:

      1. Change the value of the "enabled" attribute in the JSON payload file:

        from "enabled": true

        to "enabled": false

      2. Run the API command again

Step 4 - Configure the filter for the OpenTelemetry Collector exported metrics

The sklnctl tool configures the OpenTelemetry Collector.

The OpenTelemetry Collector filter works on the allow-list basis.

Notes:

  • For the available commands in the Expert mode, see CLI Syntax for 'sklnctl'.

  • On a Scalable Platform Security Group, run the "g_all sklnctl <options>" command.

Example workflow (in the Expert mode):

  1. Show the currently exported metrics:

    sklnctl otelcol metrics --show > /var/log/metrics.txt

  2. Edit the file to keep only the desired metrics:

    vi /var/log/metrics.txt

    See Skyline Metrics Repository.

  3. On a Scalable Platform Security Group, copy the file to all Security Group Members:

    asg_cp2blades /var/log/metrics.txt

  4. Add the desired metrics to the allow-list:

    • On a Security Gateway / each Cluster Member / Management Server / Log Server / SmartEvent Server:

      sklnctl otelcol metrics --add $(cat /var/log/metrics.txt | tr '\n' ' ')

    • On a Scalable Platform Security Group:

      g_all sklnctl otelcol metrics --add $(cat /var/log/metrics.txt | tr '\n' ' ')

Step 5 - Configure Access Control Policy

If you configured Skyline on a Security Gateway, ClusterXL, or Scalable Platform Security Group, then you must make sure your Access Control Policy allows the connection to the Third-Party Monitoring Tool to send the exported metrics.

You must configure the required rule on the Management Server (in SmartConsole or with Management API) and install the policy.

See the: