>
    Strata Copilot
    Publish and View Custom Metrics in AWS CloudWatch
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for AWS
    3. Cloud NGFW for AWS Administration
    4. Monitor
    5. Publish and View Custom Metrics in AWS CloudWatch
    Download PDF
    Cloud NGFW for AWS

    Publish and View Custom Metrics in AWS CloudWatch

    Table of Contents

    Publish and View Custom Metrics in AWS CloudWatch

    Publish custom metrics in AWS CloudWatch for your Cloud NGFW for AWS resource
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for AWS
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Account (CSP)
    • AWS Marketplace account
    • User role (either tenant or administrator)
    Cloud NGFW for AWS publishes custom metrics in AWS CloudWatch to help you monitor your Cloud NGFW's health, performance, and usage patterns. With these additional metrics you can assess the overall health of your Cloud NGFW resources, identify performance bottlenecks and detect anomalies. These metrics are numerical values describing aspects of a Cloud NGFW at a particular time. Collected every 5 minutes, metrics are useful for alerting due to their frequent sampling.
    The CloudWatch log group, S3 bucket, CloudWatch namespace and the Kinesis stream should be precreated in the CloudFormation template (CFT).
    Metrics are collected every 5 minutes. All metrics are published to one namespace. CloudWatch stores your metrics, so that you can access historical information for an added perspective on how your Cloud NGFW resources are performing. You can also set alarms that watch for certain thresholds, and send notifications or take actions when those thresholds are met. For more information, see the Amazon CloudWatch documentation.
    The following CloudWatch metrics are supported by the Cloud NGFW resource:
    Field Name
    Description
    Dataplane CPU Utilization (%)
    Monitors dataplane CPU usage and measures the traffic load on the Cloud NGFW resource.
    Dataplane Packet Buffer Utilization (%)
    Monitors dataplane buffer usage and measures buffer utilization. If you have a sudden burst in traffic, monitoring your buffer utilization allows you to ensure that the firewall does not deplete the dataplane buffer, which results in dropped packets.
    Connection per Second
    Represents the total number of concurrent TCP connections.
    Session throughput Kbps
    The session throughputis , measured in Kbps.
    Session throughput Pps
    The session throughputis , measured in Pps.
    Sessions Active
    Monitors the total number of sessions that are active on the Cloud NGFW resource. An active session is a session that is in the flow lookup table for which packets will be inspected and forwarded, as required by policy.
    Session Utilization (%)
    Monitors the TCP, UDP, ICMP, and SSL sessions that are currently active and the packet rate, new connection establish rate, and firewall throughput to determine session utilization.
    BytesIn
    Number of bytes in the server-to-client direction of the session.
    BytesOut
    Number of bytes in the client-to-server direction of the session.
    PktsIn
    Number of server-to-client packets for the session.
    PktsOut
    Number of client-to-server packets for the session.
    To publish CloudWatch Metrics:
    1. Log in to your Cloud NGFW resource.
    2. Select NG Firewalls.
    3. Select Log Settings.
    4. Under Metrics, specify the following:
      1. CloudWatch Namespace. This field represents the location on AWS where the metrics are collected.
      2. CloudWatch Metric. Select the metrics you want to monitor. See the table above for supported metrics.
    5. Click Save.
      A sample output of metrics displayed in an account resembles:

    Track How Your Cloud NGFW Resource uses Memory

    You can track how your Cloud NGFW resources use available memory. This functionality is useful when you commit a configuration that includes a large rulestack and want to monitor the amount of memory used across all firewall instances.
    To track how your Cloud NGFW resource uses memory:
    1. Log in to your Cloud NGFW resource.
    2. Select NG Firewalls.
    3. Select Log Settings.
    4. Under Metrics, use the drop-down menu to select Config Memory Utilization. When this field is selected, the size of your Cloud NGFW configuration is displayed as a percentage when compared to the amount of available memory.
      After selecting the Config Memory Utilization option the CloudWatch Metrics field displays how memory is used across your firewall instance.

    © 2026 Palo Alto Networks, Inc. All rights reserved.