Skyline tutorial

[Manning]

I've taken a little bit of time to put together a video for Project Skyline; a new real-time health monitoring.

This tool sends data from Check Point CPview and forwards it to open-source tools Prometheus & Grafan.

[the_rock]

Great job, very impressive! Happy holidays.

Andy

[D_TK]

Terrific video, thanks for creating.  Can i assume that the load on the gateway(s) to push the data to skyline is negligible?

Thanks.

[Blason_R]

Yes - The load is very negligible and I am using it in production use. I am looking for Alert mechanism.

[Jarvis_Lin]

I done all step with no wrong, but no luck,

It is not work for me, is anyone successfully?

[the_rock]

Worked for me just fine...what step does it fail for you?

[Jarvis_Lin]

Hi Rock,

Grafana is no data, and prometheus had error message.

10.8.1.8 is prometheus and grafana server.

Dec 25 21:52:32 skyline2 prometheus[875]: ts=2022-12-25T13:52:32.208Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error" count=500 exemplarCount=0 >
Dec 25 21:52:37 skyline2 prometheus[875]: ts=2022-12-25T13:52:37.210Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error" count=243 exemplarCount=0 >
Dec 25 21:53:32 skyline2 prometheus[875]: ts=2022-12-25T13:53:32.209Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error" count=500 exemplarCount=0 >
Dec 25 21:53:35 skyline2 prometheus[875]: ts=2022-12-25T13:53:35.466Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error while sending metadata" cou>
Dec 25 21:53:37 skyline2 prometheus[875]: ts=2022-12-25T13:53:37.210Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error" count=243 exemplarCount=0 >
Dec 25 21:54:32 skyline2 prometheus[875]: ts=2022-12-25T13:54:32.209Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error" count=500 exemplarCount=0 >
Dec 25 21:54:35 skyline2 prometheus[875]: ts=2022-12-25T13:54:35.467Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error while sending metadata" cou>
Dec 25 21:54:37 skyline2 prometheus[875]: ts=2022-12-25T13:54:37.211Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error" count=243 exemplarCount=0 >
Dec 25 21:55:32 skyline2 prometheus[875]: ts=2022-12-25T13:55:32.210Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error" count=500 exemplarCount=0 >
Dec 25 21:55:37 skyline2 prometheus[875]: ts=2022-12-25T13:55:37.212Z caller=dedupe.go:112 component=remote level=error remote_name=809306 url=http://10.8.1.8:9090/api/v1/write msg="non-recoverable error" count=243 exemplarCount=0

I done all step with no failed,

[Blason_R]

Looks like your prometheus is not started with --enable-feature=remote-write-receiver ?

ensure to run ps aux command and see if really prometheus is running with that parameter?

[Jarvis_Lin]

Hi Blason_R,

Thanks a lot,

It is working when I add "--enable-feature=remote-write-receiver" parameter.

Regards,

Jarvis

[belteto]

Great job!

Is this working on the MDS installed on VMware? Or just on the CP management appilances?

I was able to set up everything, seems working. However there is no data received from the MDS server. I see traffic on port 9090 to the prometheus server, but shows no data. just the uptime of the host visible in the Grapana. 

Balint

[Arik_Ovtracht]

Yes it should work perfectly on VMWares.

Perhaps something was wrong in your setup process? 

If you need assistance, please contact me directly at ariko@checkpoint.com

[belteto]

Ahh, I find the problem.

The cpview api service was not running.

started and works well.

maybe i missed this in the SK.

[Jarvis_Lin]

I can start with follow this command,

/opt/CPotelcol/REST.py --set_open_telemetry “$(cat payload.json)”

I want to stop to skyline on device, which command can do this?

[Blason_R]

find the PID and kill it. From expert mode

ps auxww | grep REST.py -> This would show the PID then

kill -9 <PID_NUMBER>

[Jarvis_Lin]

find nothing PID of REST.py

I running  lsof -i:9090 and show as below

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
otelcol 3431 admin 10u IPv4 11792824 TCP CPSMS:36866->10.8.1.8:websm (ESTABLISHED)

then kill -9 3431, but it will running with another PID again .

[Arik_Ovtracht]

Use the following 3 commands to stop it:

/opt/CPotelcol/stop

/opt/CPviewExporter/stop

cpview -a off'

[juliusn_]

Hi, I'm trying to connect multible Firewalls to the Checkpoint Skyline monitoring tool (to connect5 a single firewall is possible but with multible I'm not able to connect) can anyone advise me ho to do that?

Greetings

Julius