Appendix B - AIOps Metrics Repository


Data	Description
Blades > Status and Update
blades.entitlement	Indicates whether the software blade is entitled to download updates. 0 - Entitled 1 - Not entitled 2 - Evaluation 3 - Expired 4 - Unavailable 5 - Unknown status 6 - Not applicable This metric is available in: R82 and later R81.20 Jumbo Hotfix Accumulator, Take 54 and later R81.10 Jumbo Hotfix Accumulator, Take 135 and later R81 Jumbo Hotfix Accumulator, Take 99 and later
blades.expiration	Expiration date of software blade entitlement (in seconds) This metric is available in: R82 and later R81.20 Jumbo Hotfix Accumulator, Take 54 and later R81.10 Jumbo Hotfix Accumulator, Take 135 and later R81 Jumbo Hotfix Accumulator, Take 99 and later
blades.state	Indicates whether the software blade active: 0 - Enabled 1 - Disabled 2 - Unknown This metric is available in: R82 and later R81.20 Jumbo Hotfix Accumulator, Take 54 and later R81.10 Jumbo Hotfix Accumulator, Take 135 and later R81 Jumbo Hotfix Accumulator, Take 99 and later
blades.update.state	Updated status of software blades.
blades.update.time	Time when software blades were last updated.
CGNS
cgns.central_license.cpu_cores.allocated	Number of CPU cores allocated by the CGNS central license
cgns.central_license.cpu_cores.total	Total CPU cores available in the CGNS central license
cgns.cme.accounts	Number of accounts managed by CGNS CME
cgns.cme.state	Current state of the CGNS CME service
cgns.cme.take	CGNS CME takeover status
cgns.controller.state	Operational state of the CGNS controller
cgns.controller.take	CGNS controller takeover status
ClusterXL
cluster_xl.members.state	Current state of the ClusterXL member.
cluster_xl.mode	The ClusterXL mode: HA - High Availability LS - Load Sharing Active-Active.
cluster_xl.pnotes	Names of critical devices that report their state as `problem`.
System > CPU > Top
connection.top.cpu.utilization	CPU utilization of the CoreXL Firewall instance, in %. This metric is available in R82 and higher.
connection.top.cpu.wt.utilization	`PPE_WT` CPU utilization of the CoreXL SND instance, in %. For information about `PPE_WT`, see the HyperFlow chapter. This metric is available in: R82 and later
System > Gaia
agent.gaia.os.role	The internal role of the Gaia OS agent. This metric identifies the function or role assigned to the Gaia operating system instance (example, Security Gateway, Management Server). Introduced to replace certain CPView metrics.
deployment.package.darwin.info	Information about the deployment package for macOS (Darwin) agents, such as version, status, or package details.
deployment.package.info	Indicates whether it is a recommended software version. Note: Marks the relevant software packages as recommended.
env.domain	Domain names on a .
System > Firewall
firewall.multik.state	The state of CoreXL: On Off
firewall.policy.name	Name of the last installed Access Control policy.
firewall.policy.time	Time of the last Access Control policy installation.
System > Flofiler
flow_profiler.entities	Number of top CPU consumer entities.
flow_profiler.utilization	CPU utilization for each entity, in percentage.
Hardware > BIOS
hardware.bios	Indicates which BIOS is used: 1.0 - Primary (default) 0.0 - Secondary This metric is available in R82 and later.
hardware.bios.state	State of BIOS: 1.0 - Up 0.0 - Down
Hardware > Fans
hardware.fan	The current fan speed.
hardware.fan.max	The maximum supported fan speed.
hardware.fan.min	The minimum supported fan speed.
hardware.fan.state	State of the sensor: 0 - Works correctly 1 - Failed
Hardware > Model
hardware.model	Model name of the Appliance or Open Server. Example: Quantum 6200
Hardware > PSU
hardware.power_consumption	Total power consumption of server, in Watts. This metric is available in R82.10 and later.
hardware.power_supply	State of the PSU: 0.0 - Down 1.0 - Up 2.0 - Empty 3.0 - Dummy This metric is available in R82 and later.
hardware.power_supply.state	The PSU used: 1.0 - Primary (default) 0.0 - Secondary
Hardware > Temperature
hardware.temperature	Current temperature measurement of the sensor.
hardware.temperature.max	Maximum supported temperature
hardware.temperature.min	Minimum supported temperature
hardware.temperature.state	State of the temperature sensor: 0 - Works correctly 1 - Failed
Hardware > Voltage
hardware.voltage	Current voltage measurement of the sensor.
hardware.voltage.max	Maximum supported voltage.
hardware.voltage.min	Minimum supported voltage.
hardware.voltage.state	State of the voltage sensor: 0 - Works correctly 1 - Failed
System > CoreXL
kernel.instances.count	Number of CoreXL Firewall instances
firewall.multik.state	The state of CoreXL: On Off
system.cpu.dynamic_balancing.state	The state of CoreXL Dynamic Balancing: On Off
Object Management and Database
management.object.info	Provides metadata or detailed information about objects stored in the Check Point Management .Server.
Network > Heavy Connections
network.heavy_connection.bytes	Number of bytes transferred in the connection.
network.heavy_connection.packets	Number of packets transferred in the connection. This metric is available in: R82 and later R81.20 Jumbo Hotfix Accumulator, Take 54 and later R81.10 Jumbo Hotfix Accumulator, Take 135 and later R81 Jumbo Hotfix Accumulator, Take 99 and later
Network > Network Probes (VPN)
network.probes.last_probe	Time of the last report from the Network probe. This metric is available in R82 and later.
network.probes.last_status_change	Time when Network probe status last changed. This metric is available in R82 and later.
network.probes.mode	Monitoring mode of the Network probe: ICMP HTTP This metric is available in R82 and later.
network.probes.state	Current state of the Network probe. This metric is available in R82 and later.
Maestro Orchestrator
orchestrator.deployment.member_id	Member ID of the Orchestrator on its Maestro Site. This metric is available in R82 and later.
orchestrator.deployment.num_of_mhos_on_site	Number of Orchestrators on the Maestro Site. This metric is available in R82 and later.
orchestrator.deployment.num_of_sites	Number of Maestro Sites. This metric is available in R82 and later.
orchestrator.deployment.orchd	Status of the main daemon `orchd` on this Orchestrator: 1.0 - Up (default) 0.0 - Down This metric is available in R82 and later.
orchestrator.deployment.site_id	ID of the Maestro Site. This metric is available in R82 and later.
orchestrator.lag	Current states of Bond (LAG) interfaces for communication with peer Orchestrators, on the same site and on the peer site. This metric is available in R82 and later.
orchestrator.lldp	Information about the LLDP messages received from security appliances. This metric is available in R82 and later.
orchestrator.ports.admin_state	1.0 - Up (default) 0.0 - Down This metric is available in R82 and later.
orchestrator.ports.labels	General information about the ports on the Orchestrator. This metric is available in R82 and later.
orchestrator.ports.link_state	Link state of the ports on the Orchestrator. This metric is available in R82 and later.
orchestrator.ports.max_rx_power	Maximum received optical power measured on a port (in dBm)
orchestrator.ports.max_temperature	Highest temperature recorded on a port (in °C)
orchestrator.ports.max_tx_power	Maximum transmitted optical power measured on a port (in dBm). Indicates the strength of the signal being sent from the port.
orchestrator.ports.min_rx_power	Minimum received optical power measured on a port. Useful for detecting weak or failing fiber links.
orchestrator.ports.min_temperature	The minimum temperature (°C) recorded on a port.
orchestrator.ports.min_tx_power	Minimum transmitted optical power (dBm) measured on the port.
orchestrator.ports.port_power_class	The power class of the port (example, SFP/SFP+ module class), indicating supported optical power range.
orchestrator.ports.power_required	The amount of power (W) required by the port/module.
orchestrator.ports.ports_table.physical_port	Physical port identifier or index in the orchestrator's port table.
orchestrator.ports.rx_bytes_per_second	Traffic received (RX) by the port, in Bytes per second. This metric is available in R82 and later.
orchestrator.ports.rx_frames_per_second	Received (RX) traffic by the port, in packets (frames) per second. This metric is available in R82 and later.
orchestrator.ports.rx_mbit_per_second	Received (RX) traffic by the port, in Megabits per second. This metric is available in R82 and later.
orchestrator.ports.temperature	The current temperature of the port in °C.
orchestrator.ports.transceiver_state	The transceiver state in the port on this Orchestrator: 1.0 - Plugged (default) 0.0 - Unplugged This metric is available in R82 and later.
orchestrator.ports.tx_bytes_per_second	Transmitted (TX) traffic by the port, in Bytes per second. This metric is available in R82 and later.
orchestrator.ports.tx_frames_per_second	Transmitted (TX) traffic by the port, in packets (frames) per second. This metric is available in R82 and later.
orchestrator.ports.tx_mbit_per_second	Transmitted (TX) traffic by the port, in Megabits per second. This metric is available in R82 and later.
orchestrator.sg_lag	The current states of Bond (LAG) interfaces for communication between the Orchestrator and the Security Appliances. This metric is available in R82 and later.
System > CPU
system.cpu.count	Number of CPU cores.
system.cpu.utilization	Utilization of the CPU core as a percentage of the total utilization.
system.cpu.interrupts	Number of device interrupts that occurred per CPU core.
System > Filesystem
system.filesystem.limit	Total disk space, in Bytes.
system.filesystem.usage	Free disk space currently used, in Bytes.
System > Memory
system.memory.limit	Total RAM available for processes, in Bytes.
system.memory.usage	RAM usage by processes, in Bytes
system.fw.memory.limit	Total RAM available for Firewall processes, in Bytes.
system.fw.memory.usage	RAM usage by Firewall processes, in Bytes.
system.fw.memory.utilization	RAM usage by Firewall processes, in %. This metric is available in R82 and later.
System > Gaia
system.gaia.os.edition	Operating system distribution if the OS kernel is 32-bit or 64-bit.
system.gaia.os.role	Name of the installed Check Point product configuration.
system.gaia.os.version	Software release version.
System > Input/Output
system.io.utilization	Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.
System > Network
system.network.connections.rate	Connection rate (connections per second).
System > Network > Packets
system.network.packets.receive	Total number of received packets by this network interface since the boot.
system.network.packets.transmit	Total number of transmitted packets by this network interface since the boot.
system.network.dropped.receive	Total number of the received packets that were dropped since boot.
system.network.dropped.transmit	Total number of dropped transmitted packets since the boot.
system.network.errors.receive	Total number of received packets that are corrupted since the boot.
system.network.errors.transmit	Total number of corrupted transmitted packets since the boot.
system.network.io.receive	Total number of traffic bits received by the network interface since the boot.
system.network.io.transmit	Total number of traffic bits transmitted by the network interface since the boot.
System > Network > Interfaces
system.network.interface.address	IP address of the network interface
system.network.interface.io.receive.rate	Current rate of successfully received packets over the communication channel (in bits per second).
system.network.interface.io.receive.rate.peak	Maximal recorded rate of successfully received packets for the network interface (in bits per second).
system.network.interface.io.transmit.rate	Current rate of successfully transmitted packets over the communication channel (in bits per second).
system.network.interface.io.transmit.rate.peak	Maximal recorded rate of successfully transmitted packets for this network interface (in bits per second).
system.network.interface.packets.receive.rate	Current rate of successfully received packets over the communication channel (in packets per second).
system.network.interface.packets.receive.rate.peak	Maximal recorded rate of successfully received packets for this network interface (in packets per second)
system.network.interface.packets.transmit.rate	Current rate of successfully transmitted packets over the communication channel (in packets per second).
system.network.interface.packets.transmit.rate.peak	Maximal recorded rate of successfully transmitted packets for this network interface (in packets per second).
system.network.interface.state	The state of the network interface: 0 - Off 1 - On
System > Network > NAT
system.network.nat.connections.count	Number of NAT pool concurrent connections.
system.network.nat.connections.rate	Number of NAT pool concurrent connections per second.
system.network.nat.ports	Number of ports used for the NAT pool.
system.network.nat.ports.limit	Total number of ports that can be used for the NAT pool.
System > Memory Paging
system.paging.limit	Total RAM assigned to swap memory, in Bytes.
system.paging.usage	RAM usage for swap, in Bytes.
System > Process > Top
system.process.top.cpu.utilization	CPU utilization by a process, in %.
system.process.top.fd.count	Number of file descriptors by a process.
system.process.top.memory.usage	Memory utilization by a process, in Bytes.
SD-WAN
sdwan.modules.cost	Cost of SD-WAN modules.
sdwan.modules.jitter	Jitter of SD-WAN modules.
sdwan.modules.jitter.limit.max	Jitter threshold of SD-WAN modules.
sdwan.modules.latency	Latency of SD-WAN modules.
sdwan.modules.latency.limit.max	Latency threshold of SD-WAN modules.
sdwan.modules.nexthop.nexthop.jitter	SD-WAN Nexthop Jitter. This metric is available in R81.20 Jumbo Hotfix Accumulator, Take 79 and higher.
sdwan.modules.nexthop.nexthop.latency	SD-WAN Nexthop Latency. This metric is available in R81.20 Jumbo Hotfix Accumulator, Take 79 and higher.
sdwan.modules.nexthop.nexthop.packetloss	SD-WAN Nexthop Packet Loss. This metric is available in R81.20 Jumbo Hotfix Accumulator, Take 79 and higher.
sdwan.modules.overlay_vpn.connections.downtime	Indicates how long the Overlay VPN connection was down (in seconds).
sdwan.modules.overlay_vpn.connections.drops	Indicates how many times the Overlay VPN connection has been dropped.
sdwan.modules.overlay_vpn.connections.uptime	Indicates how long the Overlay VPN connection was up (in seconds).
sdwan.modules.packetloss	Packet Loss of SD-WAN modules.
sdwan.modules.packetloss.count	Packet Loss Counter of SD-WAN modules.
sdwan.modules.packetloss.limit.max	Packet Loss threshold of SD-WAN modules.
system.network.interface.rx_throughput_bs	Current rate of successfully received packets over the communication channel (in bits per second).
system.network.interface.tx_throughput_bs	Current rate of successfully transmitted packets over the communication channel (in bits per second).
sdwan.modules.state	State of SD-WAN modules.
system.sdwan.overlay_cost	Cost of Overlay VPN
system.sdwan.overlay_down_total_count	Number of times the Overlay VPN connection has been dropped.
system.sdwan.gw_data	Data/statistics about SD-WAN gateways (example, status, throughput, or health).
system.sdwan.overlay_down_last_time	Timestamp of the last time an SD-WAN overlay tunnel went down.
system.sdwan.overlay_jitter	Overlay VPN Jitter (in milliseconds).
system.sdwan.overlay_latency	Overlay VPN Latency (in milliseconds).
system.sdwan.overlay_packtloss	Overlay VPN Packet Loss
system.sdwan.overlay_packtloss_counter	Packet loss counter
system.sdwan.overlay_up_last_time	Overlay VPN Packet Loss Counter.
system.sdwan.probes.jitter_stat	Jitter statistics (variation in latency) measured by SD-WAN probes.
system.sdwan.probes.latency_stat	Latency statistics (ms) measured by SD-WAN probes.
system.sdwan.probes.packetloss_stat	Packet loss statistics (%) measured by SD-WAN probes.
system.sdwan.rules_steering_download_speed	Measured download speed (Mbps) for SD-WAN rule-based steering.
system.sdwan.rules_steering_download_speed_threshold	The threshold value for download speed in SD-WAN steering rules.
system.sdwan.rules_steering_isp_cost	Steering ISP Cost
system.sdwan.rules_steering_jitter_stat	Steering Jitter (in milliseconds).
system.sdwan.rules_steering_jitter_threshold	Steering Jitter Threshold (in milliseconds).
system.sdwan.rules_steering_latency_stat	Steering Latency (in milliseconds).
system.sdwan.rules_steering_latency_threshold	Steering Latency Threshold (in milliseconds).
system.sdwan.rules_steering_packet_lost_percentage	Steering Packet Loss.
system.sdwan.rules_steering_packet_lost_threshold	Steering Packet Loss Threshold.
system.sdwan.rules_steering_upload_speed	Not available
system.sdwan.rules_steering_upload_speed_threshold	Not available
System > Traffic
system.traffic.connections	Number of concurrent connections
system.traffic.dropped	Total number of traffic drops made by Security Gateway Software Blades
system.traffic.dropped.rate	Rate of traffic drops (number of drops per second) made by Security Gateway Software Blades This metric is available in: R82 and higher R81.20 Jumbo Hotfix Accumulator, Take 70 and higher R81.10 Jumbo Hotfix Accumulator, Take 152 and higher
system.traffic.io.receive	Inbound throughput (bits per second)
system.traffic.io.transmit	Outbound throughput (bits per second)
system.traffic.packets.receive	Inbound packet rate (packets per second)
system.traffic.packets.transmit	Outbound packet rate (packets per second)
system.traffic.templates	The total number of traffic drops due to the hit rate for Drop Templates exceeding the limit. This metric is available in R81.20 Jumbo Hotfix Accumulator Take 119 and higher.
system.uptime	The total time (in seconds) the system has been running since the last reboot.
VPN > Probes
vpn.probes.tunnel	The state of the VPN tunnel: 0 - Down Any positive integer - Up (this value is the outbound SPI of the VPN tunnel) This metric is available in R82 and higher.
vpn.probes.tunnel_decrypted_bytes	The total number of decrypted bytes. This metric is available in R82 and higher.
vpn.probes.tunnel_decrypt_throughput	VPN tunnel decrypted throughput. This metric is available in R82 and higher.
vpn.probes.tunnel_encrypted_bytes	The total number of encrypted bytes. This metric is available in R82 and higher.
vpn.probes.tunnel_encrypt_throughput	VPN tunnel encrypted throughput. This metric is available in R82 and higher.
vpn.probes.tunnel_expire_time	The time when the VPN Tunnel will expire. This metric is available in R82 and higher.
vpn.probes.tunnel_generated_time	Time when the VPN Tunnel was established. This metric is available in R82 and higher.