> Source: [sk108769](https://support.checkpoint.com/results/sk/sk108769) # sk108769 - Amazon Web Services (AWS) CloudWatch integration | Property | Value | |----------|-------| | Solution ID | sk108769 | | Date Created | 2015-11-19 | | Last Modified | 2025-09-28 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R81 (EOS), R81.10 (EOS), R81.20, R82 | | OS | Gaia | | Platform | AWS | ## Cause ## Solution This article describes how to report Security Gateway statistics as metrics to the **Amazon Web Services (AWS) CloudWatch service**. These metrics could be used to monitor the Security Gateway's health as well as to trigger auto-scale events. Prerequisites ------------- It is assumed that you are familiar with general AWS concepts and services such as: * CloudWatch * Elastic Compute Cloud (EC2) * Identity and Access Management (IAM) To automatically make API calls to AWS, the Security Gateway should be provided with AWS credentials. This is achieved using a standard AWS mechanism called IAM Roles. For that, you need an AWS user account with IAM privileges. For additional information regarding IAM roles refer to: * [IAM roles for EC2 instances - Simplified Secure Access to AWS service APIs from EC2](http://aws.amazon.com/blogs/aws/iam-roles-for-ec2-instances-simplified-secure-access-to-aws-service-apis-from-ec2) * [IAM Roles for Amazon EC2](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) Setup ----- 1. Create this AWS IAM policy: 1. Go to 2. Go to **Policies** and select **Create policy** 3. Select JSON and paste the following: `{` ` "Version": "2012-10-17",` ` "Statement": [` ` {` ` "Action": [` ` "cloudwatch:PutMetricData"` ` ],` ` "Effect": "Allow",` ` "Resource": "*"` ` }` ` ]` `}` 2. Attach the above policy to an existing IAM role or create a new role with the above policy. 3. Use this role when launching the EC2 instance. 4. Start reporting the metrics periodically by running: `/sbin/cloudwatch start` This will register a cron job that runs every minute and updates the AWS CloudWatch service with the gateway statistics. To stop reporting, run: `/sbin/cloudwatch stop` This will unregister the cron job. 5. Gateway statistics should now appear in your CloudWatch service portal:
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk108769/general202310011122501.png) ### **Instruction** 1. In AWS Portal, go to CloudWatch tab \> All metrics \> Check Point \> AutoScalingGroup\\InstanceID. 2. Search by value. 3. Mark the metrics you want to see on the graph. 4. Choose time range. **Notes:** * Security Gateway statistics are sent at a frequency of about once a minute. * Metrics can be filtered by instance ID. * Metrics can be filtered by AutoScalingGroup ARN name (instance profile) if that AutoScalingGroup environment.
### **Supported solutions** * Security Gateways Auto Scaling Group for Gateway Load Balancer * Security Gateway * Security Cluster * Security Management Server * AutoScalingGroup: when deploying the solution via CloudFormation, you can enable CloudWatch by setting the parameter to *true* . Refer to [sk111013 - AWS CloudFormation Templates](https://support.checkpoint.com/results/sk/sk111013) \> Security Gateways Auto Scaling Group. Available Metrics ----------------- ### CPstat \& ethtool Show / Hide full metrics list |----------------------------------------------|--------------| | **Metric Name** | **Unit** | | Num. Connections | Count | | Active Virtual Memory (Bytes) | Bytes | | Active Real Memory (Bytes) | Bytes | | Free Real Memory (Bytes) | Bytes | | Memory Swaps/Sec | Count/Second | | Memory To Disk Transfers/Sec | Count/Second | | CPU User Time (%) | Percent | | CPU System Time (%) | Percent | | CPU Idle Time (%) | Percent | | CPU Usage (%) | Percent | | CPU Queue Length | Count | | CPU Interrupts/Sec | Count/Second | | Disk Free Space (%) | Percent | | Disk Total Free Space (Bytes) | Bytes | | Disk Available Free Space (Bytes) | Bytes | | Disk Total Space (Bytes) | Bytes | | Encrypted packets | Count | | Decrypted packets | Count | | Encryption errors | Count | | Decryption errors | Count | | IKE current SAs | Count | | IKE no response from peer (initiator errors) | Count | | IPsec current Inbound SAs | Count | | IPsec current Outbound SAs | Count | | tx_timeout | Count | | suspend | Count | | resume | Count | | wd_expired | Count | | interface_up | Count | | interface_down | Count | | admin_q_pause | Count | | bw_in_allowance_exceeded | Count | | bw_out_allowance_exceeded | Count | | pps_allowance_exceeded | Count | | conntrack_allowance_exceeded | Count | | linklocal_allowance_exceeded | Count | | queue_0_tx_cnt | Count | | queue_0_tx_bytes | Count | | queue_0_tx_queue_stop | Count | | queue_0_tx_queue_wakeup | Count | | queue_0_tx_dma_mapping_err | Count | | queue_0_tx_linearize | Count | | queue_0_tx_linearize_failed | Count | | queue_0_tx_napi_comp | Count | | queue_0_tx_tx_poll | Count | | queue_0_tx_doorbells | Count | | queue_0_tx_prepare_ctx_err | Count | | queue_0_tx_bad_req_id | Count | | queue_0_tx_llq_buffer_copy | Count | | queue_0_tx_missed_tx | Count | | queue_0_tx_unmask_interrupt | Count | | queue_0_rx_cnt | Count | | queue_0_rx_bytes | Count | | queue_0_rx_rx_copybreak_pkt | Count | | queue_0_rx_csum_good | Count | | queue_0_rx_refil_partial | Count | | queue_0_rx_bad_csum | Count | | queue_0_rx_page_alloc_fail | Count | | queue_0_rx_skb_alloc_fail | Count | | queue_0_rx_dma_mapping_err | Count | | queue_0_rx_bad_desc_num | Count | | queue_0_rx_bp_yield | Count | | queue_0_rx_bp_missed | Count | | queue_0_rx_bp_cleaned | Count | | queue_0_rx_bad_req_id | Count | | queue_0_rx_empty_rx_ring | Count | | queue_0_rx_csum_unchecked | Count | | queue_0_rx_lpc_warm_up | Count | | queue_0_rx_lpc_full | Count | | queue_0_rx_lpc_wrong_numa | Count | | ena_admin_q_aborted_cmd | Count | | ena_admin_q_submitted_cmd | Count | | ena_admin_q_completed_cmd | Count | | ena_admin_q_out_of_space | Count | | ena_admin_q_no_completion | Count | Appendix - CloudGuard Network exported Check Point SNMP Object IDs (MIB IDs) ---------------------------------------------------------------------------- Check Point provides a set of MIB files that contain definitions of all SNMP counters supported by Check Point software. Show / Hide list of MIB IDs exported by CloudGuard Network Security Gateways to AWS CloudWatch: |----------------------------------------------|--------------|-----------------------------| | **Metric Name** | **Unit** | **Check Point MIB ID** | | Num. Connections | Count | .1.3.6.1.4.1.2620.1.1.25.3 | | Active Virtual Memory (Bytes) | Bytes | .1.3.6.1.4.1.2620.1.6.7.4.2 | | Active Real Memory (Bytes) | Bytes | .1.3.6.1.4.1.2620.1.6.7.4.4 | | Free Real Memory (Bytes) | Bytes | .1.3.6.1.4.1.2620.1.6.7.4.5 | | Memory Swaps/Sec | Count/Second | .1.3.6.1.4.1.2620.1.6.7.4.6 | | Memory To Disk Transfers/Sec | Count/Second | .1.3.6.1.4.1.2620.1.6.7.4.7 | | CPU User Time (%) | Percent | .1.3.6.1.4.1.2620.1.6.7.2.1 | | CPU System Time (%) | Percent | .1.3.6.1.4.1.2620.1.6.7.2.2 | | CPU Idle Time (%) | Percent | .1.3.6.1.4.1.2620.1.6.7.2.3 | | CPU Usage (%) | Percent | .1.3.6.1.4.1.2620.1.6.7.2.4 | | CPU Queue Length | Count | .1.3.6.1.4.1.2620.1.6.7.2.5 | | CPU Interrupts/Sec | Count/Second | .1.3.6.1.4.1.2620.1.6.7.2.6 | | Disk Free Space (%) | Percent | .1.3.6.1.4.1.2620.1.6.7.3.3 | | Disk Total Free Space (Bytes) | Bytes | .1.3.6.1.4.1.2620.1.6.7.3.4 | | Disk Available Free Space (Bytes) | Bytes | .1.3.6.1.4.1.2620.1.6.7.3.5 | | Disk Total Space (Bytes) | Bytes | .1.3.6.1.4.1.2620.1.6.7.3.6 | | Encrypted packets | Count | .1.3.6.1.4.1.2620.1.2.4.1.1 | | Decrypted packets | Count | .1.3.6.1.4.1.2620.1.2.4.1.2 | | Encryption errors | Count | .1.3.6.1.4.1.2620.1.2.4.2.1 | | Decryption errors | Count | .1.3.6.1.4.1.2620.1.2.4.2.2 | | IKE current SAs | Count | .1.3.6.1.4.1.2620.1.2.9.1.1 | | IKE no response from peer (initiator errors) | Count | .1.3.6.1.4.1.2620.1.2.9.2.2 | | IPsec current Inbound SAs | Count | .1.3.6.1.4.1.2620.1.2.5.2.1 | | IPsec current Outbound SAs | Count | .1.3.6.1.4.1.2620.1.2.5.2.3 | Additional information about Check Point MIB and SNMP: * [sk90860 - How to configure SNMP on Gaia OS](https://support.checkpoint.com/results/sk/sk90860) * [sk90470 - Check Point SNMP MIB files](https://support.checkpoint.com/results/sk/sk90470) Ethtool metrics --------------- Shows statistics of the network interfaces that start with "eth", including information about received and transmitted packets, errors, collisions, and more network data. These metrics will add to the ClouadWatch instances with version R81.20 and higher. Metrics can be filtered by network interface by searching \-\ Show / Hide metrics list |------------------------------|----------| | **Metric Name** | **Unit** | | tx_timeout | Count | | suspend | Count | | resume | Count | | wd_expired | Count | | interface_up | Count | | interface_down | Count | | admin_q_pause | Count | | bw_in_allowance_exceeded | Count | | bw_out_allowance_exceeded | Count | | pps_allowance_exceeded | Count | | conntrack_allowance_exceeded | Count | | linklocal_allowance_exceeded | Count | | queue_0_tx_cnt | Count | | queue_0_tx_bytes | Count | | queue_0_tx_queue_stop | Count | | queue_0_tx_queue_wakeup | Count | | queue_0_tx_dma_mapping_err | Count | | queue_0_tx_linearize | Count | | queue_0_tx_linearize_failed | Count | | queue_0_tx_napi_comp | Count | | queue_0_tx_tx_poll | Count | | queue_0_tx_doorbells | Count | | queue_0_tx_prepare_ctx_err | Count | | queue_0_tx_bad_req_id | Count | | queue_0_tx_llq_buffer_copy | Count | | queue_0_tx_missed_tx | Count | | queue_0_tx_unmask_interrupt | Count | | queue_0_rx_cnt | Count | | queue_0_rx_bytes | Count | | queue_0_rx_rx_copybreak_pkt | Count | | queue_0_rx_csum_good | Count | | queue_0_rx_refil_partial | Count | | queue_0_rx_bad_csum | Count | | queue_0_rx_page_alloc_fail | Count | | queue_0_rx_skb_alloc_fail | Count | | queue_0_rx_dma_mapping_err | Count | | queue_0_rx_bad_desc_num | Count | | queue_0_rx_bp_yield | Count | | queue_0_rx_bp_missed | Count | | queue_0_rx_bp_cleaned | Count | | queue_0_rx_bad_req_id | Count | | queue_0_rx_empty_rx_ring | Count | | queue_0_rx_csum_unchecked | Count | | queue_0_rx_lpc_warm_up | Count | | queue_0_rx_lpc_full | Count | | queue_0_rx_lpc_wrong_numa | Count | | ena_admin_q_aborted_cmd | Count | | ena_admin_q_submitted_cmd | Count | | ena_admin_q_completed_cmd | Count | | ena_admin_q_out_of_space | Count | | ena_admin_q_no_completion | Count | Troubleshooting --------------- If you cannot see the metrics sending to the CloudWatch, run this command and see instruction below: *cloudwatch stop; cloudwatch start; cloudwatch run* * **Issue 1: Error message Scenario** : While running `cloudwatch start` the error "*Error message - for more information see $FWDIR/log/cloudwatch.elg* " is displayed. **Solution** : See *$FWDIR/log/cloudwatch.elg* for more information. * **Issue 2: AccessDenied Scenario** : Error in the *cloudwatch.elg* file: *\[DATE TIME\] __name__ ERROR AccessDenied : User: arn:aws:sts::...:assumed-role/...... is not authorized to perform: cloudwatch:PutMetricData because no identity-based policy allows the cloudwatch:PutMetricData action* **Cause** : Missing permissions on the instance. **Solution** : Create AWS IAM policy of the instance and attach it to the instance as mentioned in the Setup section \> Step 1. * **Issue 3: Connection timed out Scenario** : Error in the *cloudwatch.elg* file: *Connection timed out* *__ ERROR Occurred while sending metrics* *__ ERROR details: Traceback (most recent call last):* *...* **Cause** : HTTPS request to AWS return an error because connectivity issues. **Solution** : Check configuration in the Administration guide and make sure you didn't miss a step. Check the route table and make sure you allow HTTPS connection to that instance. * **Issue 4: instance profile Scenario** : Error in the *cloudwatch.elg* file: *ERROR Failed to get instance profile from metadata* *ERROR Error details: NoneType: None* **Cause** : *cloudwatch.py* failed to match the instance profile of the AutoScalingGroup. **Solution**: Check if the instance profile ARN contains the words "instance" and "profile". If so, create a new one without these words (as they are reserved words).
Know Limitations ---------------- * The AutoScalingGroup name or instance profile ARN cannot contain the string "instance" and "profile".
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content