> Source: [sk171057](https://support.checkpoint.com/results/sk/sk171057)

# sk171057 - How to enable CloudGuard metrics on an existing CloudGuard Network Security Gateway deployed in Azure

| Property | Value |
|----------|-------|
| Solution ID | sk171057 |
| Date Created | 2020-12-21 |
| Last Modified | 2025-12-11 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R81 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |
| Platform | Azure |

## Solution

Introduction
------------

When you enable CloudGuard metrics, you allow CloudGuard Gateways or Virtual Machine Scale Set (VMSS) instances to send `cpstat` statuses and statistics to the Azure Monitor service.  

* If CloudGuard metrics were enabled during VMSS creation on the Azure marketplace, new instances will have the feature enabled.
* If CloudGuard metrics were **NOT** enabled during VMSS creation on the Azure marketplace, each new instance on scale-out will need to follow this article to have this feature enabled.(This can be automated with the [CME](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CME/Content/Topics-Cloud_Management_Extension_CME/Overview.htm)using the "-cg" option in the template definition; this runs a script on new instances when they are created.)

Follow these instructions to enable or disable CloudGuard metrics on existing CloudGuard Network Security Gateways deployed in Azure.  

**Enable CloudGuard Metrics**
-----------------------------

1. Log in to the Security Gateway or Scale Set instance via SSH and validate the image version. Run: `cat /etc/cloud-version`   
2. Connect to the Azure portal and enable System Identity for Security Gateway or VMSS:  

1. Go to the Security Gateway or VMSS resource.
2. Click on the **Identity** tab.
3. Enable System Identity and click **Save** .  

   For **example**:

![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1608200875117/metrics_2202012171238062.png)

3. Assign System Identity to the Security Gateway or VMSS Resource Group:  

1. From the Azure portal navigate to the Security Gateway or VMSS Resource Group.
2. Click on the **Access control (IAM)** tab.
3. Click on **add role assignment** and choose the **Monitoring metrics publisher** role.
4. In **Assign access to** chose **Virtual Machine Scale Set** for VMSS or **Virtual Machine** for the Security Gateway.
5. Select the relevant subscription.
6. Select the System Identity that has the same name as the Security Gateway or Virtual Machines Scale Set.

For **example**:

![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1608200875117/metrics_3202012171238433.png)

4. On the Security Gateway or VMSS instance, create the `$FWDIR/conf/cloud_azure_cred.json` file with the following content:  
`{`  
`"credentials": "IAM"`  
`}`

5. Enable CloudGuard metrics agent. Run:  
` $FWDIR/scripts/cloud_metrics.sh start`

6. Make sure the metrics are being sent successfully in the `/var/log/cloud_metrics.log`  

For **example** :  

![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1608200875117/metrics_6202012171239544.png)

7. Check that you can see the CloudGuard metrics in Azure Monitoring:

1. Navigate to the Security Gateway or VMSS view.
2. Click on the**Metrics**tab.
3. Select **Metric Namespace** - **cloudguard**.
4. Select the relevant CloudGuard metric from the available drop-down metrics list.

<br />

For **example** :  
![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1608200875117/metrics_7202012171240505.png)

CloudGuard counters list
------------------------

Below you can find all the exported counters.

|----------------------------------------------|--------------|
| **Metric Name**                              | **Unit**     |
| Num. Connections                             | Count        |
| Active Virtual Memory (Bytes)                | Bytes        |
| Active Real Memory (Bytes)                   | Bytes        |
| Free Real Memory (Bytes)                     | Bytes        |
| Memory Swaps/Sec                             | Count/Second |
| Memory To Disk Transfers/Sec                 | Count/Second |
| CPU User Time (%)                            | Percent      |
| CPU System Time (%)                          | Percent      |
| CPU Idle Time (%)                            | Percent      |
| CPU Usage (%)                                | Percent      |
| CPU Queue Length                             | Count        |
| CPU Interrupts/Sec                           | Count/Second |
| Disk Free Space (%)                          | Percent      |
| Disk Total Free Space (Bytes)                | Bytes        |
| Disk Available Free Space (Bytes)            | Bytes        |
| Disk Total Space (Bytes)                     | Bytes        |
| Encrypted packets                            | Count        |
| Decrypted packets                            | Count        |
| Encryption errors                            | Count        |
| Decryption errors                            | Count        |
| IKE current SAs                              | Count        |
| IKE no response from peer (initiator errors) | Count        |
| IPsec current Inbound SAs                    | Count        |
| IPsec current Outbound SAs                   | Count        |

Disable CloudGuard Metrics
--------------------------

To stop sending CloudGuard metrics on the Security Gateway or VMSS instance run:  

`$FWDIR/scripts/cloud_metrics.sh stop`  

Known limitations
-----------------

* CloudGuard metrics is not supported when using a proxy.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content