Palo Alto Networks PAN-OS

Plugin: go.d.plugin Module: panos

Overview

This collector monitors Palo Alto Networks PAN-OS firewalls. It collects read-only XML API telemetry for BGP, system status, HA, environment sensors, licenses, and IPsec SAs.

It gathers metrics by periodically running PAN-OS XML API operational commands through the pango SDK.

This collector is supported on all platforms.

This collector supports collecting metrics from multiple instances of this integration, including remote instances.

The configured PAN-OS account must be allowed to use the XML API and run read-only operational requests for the collected telemetry.

Default Behavior

Auto-Detection

This collector does not auto-detect PAN-OS firewalls. A job must be configured with the firewall management URL and credentials.

Limits

The default collection interval is 60 seconds to keep polling load conservative on the PAN-OS management plane.

Performance Impact

Each collection runs PAN-OS XML API operational requests. The collector uses serial requests and caps the SDK transport to 2 connections per firewall job. Multiple jobs targeting the same firewall multiply that per-job connection budget, so configure one job per firewall management interface unless you intentionally need separate scopes.

Setup

You can configure the panos collector in two ways:

Important

UI configuration requires paid Netdata Cloud plan.

Prerequisites

PAN-OS XML API access

Enable XML API access and provide either an API key or username/password credentials that can generate one. The account needs permission to run operational commands.

Configuration

Options

The following options can be defined globally: update_every, autodetection_retry.

via UI

Configure the panos collector from the Netdata web interface:

1. Go to Nodes.
2. Select the node where you want the panos data-collection job to run and click the :gear: (Configure this node). That node will run the data collection.
3. The Collectors → Jobs view opens by default.
4. In the Search box, type panos (or scroll the list) to locate the panos collector.
5. Click the + next to the panos collector to add a new job.
6. Fill in the job fields, then click Test to verify the configuration and Submit to save.
   • Test runs the job with the provided settings and shows whether data can be collected.
   • If it fails, an error message appears with details (for example, connection refused, timeout, or command execution errors), so you can adjust and retest.

via File

The configuration file name for this integration is go.d/panos.conf.

The file format is YAML. Generally, the structure is:

update_every: 1
autodetection_retry: 0
jobs:
  - name: some_name1
  - name: some_name2

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/panos.conf

Examples

API key

Collecting PAN-OS metrics with an existing XML API key.

jobs:
  - name: firewall
    url: https://192.0.2.1
    api_key: YOUR_PANOS_XML_API_KEY
    update_every: 60
    timeout: 3

Username/password key generation

Letting the collector generate and reuse an API key through PAN-OS.

jobs:
  - name: firewall
    url: https://192.0.2.1
    username: netdata
    password: YOUR_PASSWORD
    update_every: 60
    timeout: 3

Metrics

Metrics grouped by scope.

The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels.

Per System

These metrics refer to the PAN-OS device.

Labels:

Metrics:

Per High availability

These metrics refer to the PAN-OS HA pair state reported by the local firewall.

This scope has no labels.

Metrics:

Per High availability link

These metrics refer to a single PAN-OS HA link.

Labels:

Metrics:

Per Environment sensor

These metrics refer to a single PAN-OS environment sensor.

Labels:

Metrics:

Per License summary

These metrics summarize PAN-OS licenses.

This scope has no labels.

Metrics:

Per License

These metrics refer to one PAN-OS license.

Labels:

Metrics:

Per IPsec summary

These metrics summarize active PAN-OS IPsec security associations.

This scope has no labels.

Metrics:

Per IPsec tunnel

These metrics refer to one active PAN-OS IPsec security association.

Labels:

Metrics:

Per BGP peer

These metrics refer to a single BGP peer on a PAN-OS virtual router or logical router.

Labels:

Metrics:

Per BGP peer address family

These metrics refer to one AFI/SAFI family for a BGP peer.

Labels:

Metrics:

Per BGP virtual router

These metrics refer to one PAN-OS virtual router or logical router.

Labels:

Metrics:

Alerts

The following alerts are available:

Troubleshooting

Debug Mode

Important: Debug mode is not supported for data collection jobs created via the UI using the Dyncfg feature.

To troubleshoot issues with the panos collector, run the go.d.plugin with the debug option enabled. The output should give you clues as to why the collector isn’t working.

• Navigate to the plugins.d directory, usually at /usr/libexec/netdata/plugins.d/. If that’s not the case on your system, open netdata.conf and look for the plugins setting under [directories].

  cd /usr/libexec/netdata/plugins.d/
  

• Switch to the netdata user.

  sudo -u netdata -s
  

• Run the go.d.plugin to debug the collector:

  ./go.d.plugin -d -m panos
  

  To debug a specific job:

  ./go.d.plugin -d -m panos -j jobName
  

Getting Logs

If you’re encountering problems with the panos collector, follow these steps to retrieve logs and identify potential issues:

• Run the command specific to your system (systemd, non-systemd, or Docker container).
• Examine the output for any warnings or error messages that might indicate issues. These messages should provide clues about the root cause of the problem.

System with systemd

Use the following command to view logs generated since the last Netdata service restart:

journalctl _SYSTEMD_INVOCATION_ID="$(systemctl show --value --property=InvocationID netdata)" --namespace=netdata --grep panos

System without systemd

Locate the collector log file, typically at /var/log/netdata/collector.log, and use grep to filter for collector’s name:

grep panos /var/log/netdata/collector.log

Note: This method shows logs from all restarts. Focus on the latest entries for troubleshooting current issues.

Docker Container

If your Netdata runs in a Docker container named “netdata” (replace if different), use this command:

docker logs netdata 2>&1 | grep panos

No BGP charts are created

Verify that BGP is configured and that the account can run PAN-OS XML API operational requests. The collector logs when no legacy or Advanced Routing Engine BGP peer command returns peers. Advanced Routing Engine parsing is best-effort until validated with sanitized real PAN-OS ARE XML output.

Panorama proxy collection is unsupported

Configure one job per firewall management interface. This collector does not support using Panorama as a target proxy for managed firewalls in v1.

A metricset fails but other charts work

The collector keeps successful metricsets running and logs the failing metricset name and XML command context.

PAN-OS accepted a command but no telemetry appears

A “success response has no recognized telemetry payload” error means PAN-OS accepted the operational command, but the XML result did not contain the expected section for that metricset. Verify the account permissions and platform support for the metricset, or provide a sanitized XML sample so the parser can be updated.

A PAN-OS value cannot be parsed

The collector reports missing or invalid integer, decimal, duration, status, license expiration, and IPsec tunnel-count values with the metricset, field, entity name, and raw value when present. It does not silently convert missing or malformed values to zero, report fake valid status, or treat unrecognized license dates as never-expiring licenses.