Skyline - Instrument CheckPoint API (Traces, API calls, API routes, users, http response codes)

[Alexander_Wilke]

Hello,

the API gets more important for us and we have more an d different users and applications connecting to the API at the same time.

Sometimes we get feedback that some calls did not work or took very long. Unfortunately there is no skyline / OpenTelemetry export of the API usage.

I would like to see some metrics about

- connected users

- http status codes (200, 401, ...)

- POST, GET, ...

- bytes transferred per user / connection

- API routes like 

• /web_api/add-host
• /web_api/delete-host

I hope with these type of metrics I can better understand which API route/path has issues or caused issues because of specific http response codes. In addition I hope I can correlate system CPU/memory usage with amount of connected users, connections and API calls.

In a more far future it may be helpful to instrument further processes like apache, postgresql and maybe CPM to give a visibility which services is responding slowly and where the bottleneck is.

OpenTelemetry provides instrumentations for apache and postgres and java. maybe this is something which max help users and CP internal teams.

Learn how to instrument Apache Http Server with OpenTelemetry | OpenTelemetry

opentelemetry-collector-contrib/receiver/postgresqlreceiver/documentation.md at main · open-telemetr...

However, my question is, are there any plans ans possibilities to provide more information about the API, connected user, API routes and response codes.

Regards

Alexander

[PhoneBoy]

That would require such activity to be instrumented, of course, which it probably isn’t at current.
Adding @Omer_Kleinstern for visibility.

[Vincent_Bacher]

Custom script support will be a way to collect metrics which are not out of the box integrated into Skyline

[Alexander_Wilke]

Instrumenting these applications may work - or not. maybe some are password proteced.
However - support - is the magic word. I do not want to run software piece which integrate (deep) into the main system and are not supported.

However - opentelemetry is an important opensource product and it may be relevant in other parts ike OpenAppsc.io or opensource project for a web application firewall of checkpoint or the payed solution. If you are running a WAF and Loadbalancer you may be interested in these types of metrics.

nevertheless - thanks for feedback!

[Vincent_Bacher]

I should not say this here but tbh. i would not use CP as WAF 🙂

[Alexander_Wilke]

I do not and do not plan to do so. However it is a CP product and maybe they use this chance to implement OpeneTelemtry traces/metrics 😛

[Vincent_Bacher]

Indeed. We are testing Skyline in our environment and are absolutely happy to have opentelemetry on board.
Running it on round about 100 devices (VSX, OpenServer).
But unfortunately it's still very buggy.

[Alexander_Wilke]

Hello @Elad_Chomsky 
Hello CP Team,

please make this script's output available in skyline:

sk181906 - How to see the API usage on a Management Server?

at 

command

user

in/out/duration

the

      "x_chkp_sid": "8095012a-4ec3-deab-90f5-ab54a7d36127",
Should be mapped before to a username to avoid high cardinality issues with changing sid in prometheus.

[Elad_Chomsky]

Hi @Alexander_Wilke ,

As of the next Skyline version, new metrics on the API are added.  they will be part of the official Skyline repository documentation, which should be published in a week or two.