Forward Metrics to Oracle Cloud Infrastructure
Push OCI Firewall operational metrics directly to OCI Kafka for scalable, unified
data collection and analysis.
| Where Can I Use This? | What Do I Need? |
|---|
- VM-Series (Managed by PAN-OS®, Panorama®, or Strata Cloud
Manager)
- Prisma AIRS (Managed by PAN-OS®, Panorama®, or Strata Cloud
Manager)
|
|
OCI Kafka Metric Forwarding enables your OCI Firewalls to directly push
operational metrics to OCI Kafka. This feature moves away from traditional polling
mechanisms, improving scalability and providing a unified data path for metrics. Your
firewalls can actively transmit data directly to OCI Kafka, eliminating intermediary
VMs. OCI Kafka simplifies data ingestion architectures. It offers enhanced scalability
and high availability, handling increased metric volume and velocity from more firewalls
through its managed service design.
Your OCI Firewalls collect and push several types of operational data:
Data flow metrics
System metrics for firewall resource health
Customer metrics for user and application activity
App-ID™ metrics for application identification details
Each metric includes essential metadata such as timestamp, instance ID,
compartment ID, and PAN-OS version for analysis. This feature exports existing
identified metrics more efficiently, without introducing new categories.
The metric forwarding system consists of the following components:
OCI Firewall (VM-Series): Acts as the primary source for
operational metrics, collecting data flow, system, customer, and App-ID metrics.
OCI Kafka: A managed service within Oracle Cloud Infrastructure
that serves as the centralized, scalable, and highly available destination for
forwarded metrics. This implementation replaces existing OCI streaming
pools.
The entire metric forwarding solution relies on the availability and
configuration of an external OCI Kafka managed service. This service handles the
complexities of a Kafka cluster, including high availability and scalability. Your OCI
Firewall continuously collects a defined set of metrics. A VM-Series plugin within your
firewall establishes an internal connection with daemon to send this data.
The firewall periodically collects and sends metrics to defined Kafka topics.
The demon processes the metrics received from your firewall and pushes them directly to
your configured OCI Kafka topic. This communication is secured using Mutual TLS (mTLS),
requiring client certificates for authentication and encryption.
Configure OCI Forwarding Metrics
This section provides a step-by-step walkthrough for deploying and configuring the
OCI Kafka metric forwarding feature on your OCI Firewalls using CLI.
- Configure Kafka metric forwarding parameters.
Use the request plugins
vm_series kafka-metric-server command to define a new Kafka
metric
server.
admin@PA-VM> request plugins vm_series kafka-metric-server client-cert client2
kafka-broker bootstrap-clstr-a6tvlyfwpiixb84g.kafka.us-phoenix-1.oci.oraclecloud.com:9093 kafka-topic metrics server-name METRICS
Kafka metric server configured successfully
Name : METRICS
Broker : bootstrap-clstr-a6tvlyfwpiixb84g.kafka.us-phoenix-1.oci.oraclecloud.com:9093
Topic : metrics
Client Certificate : configured
This command establishes a new
Kafka metric server configuration on your firewall. It specifies the client
certificate for mTLS, the Kafka broker endpoint, the target topic for
metrics, and a unique name for this configuration.
- Verify the configured Kafka metric servers.
Execute the show plugins
vm_series kafka-metric-servers command to display active
configurations.
admin@PA-VM> show plugins vm_series kafka-metric-servers
Configured Kafka Metric Servers :
--------------------------------------------------
Name : METRICS
Broker : bootstrap-clstr-a6tvlyfwpiixb84g.kafka.us-phoenix-1.oci.oraclecloud.com:9093
Topic : metrics
Client Certificate : configured
--------------------------------------------------
Total : 1 Kafka metric server(s) configured
- (Optional) Debug and monitor Kafka metric forwarding.
Check the Kafka log level configuration using debug plugins vm_series
kafka set-log-level show.
admin@PA-VM> debug plugins vm_series kafka set-log-level show
Kafka Log Level Configuration
=======================================================
Timestamp : 2026-04-06 12:09:29
Config File : /etc/fluent-bit/fluent-bit-kafka.conf
Input :
Log_Level : info
Output :
rdkafka.debug : broker,topic,security
Pipeline PID : 1137139 (running)
This command provides insight into the current logging configuration
for the Kafka metric forwarding process, indicating what level of
detail is being captured.
- View the pipeline statistics using debug plugins vm_series kafka
statistics.
admin@PA-VM> debug plugins vm_series kafka statistics
Fluent Bit Pipeline Statistics (accumulated)
=================================================================
Process : Running (PID 1137139, uptime 3h 47m 29s)
Timestamp : 2026-04-06 15:50:48
Summary :
Total Input Records : 890
Total Input Bytes : 1.60 MB
Total Output Records : 890
Total Output Bytes : 1.60 MB
Total Dropped : 0
Pending (in-flight) : 0
Buffered Chunks : 0
Buffer Memory : 0 B
Input Plugins :
Name Records Bytes
----------------------------------------------------------
kafka_METRICS_in 890 1.60 MB
storage_backlog.1 0 0 B
Output Plugins (per topic) :
Name Queued Bytes Dropped Retried Errors Status
---------------------------------------------------------------------------------
kafka_METRICS_out 890 1.60 MB 0 0 0 OK
STATUS : All records queued to Kafka output plugin
NOTE : These are Fluent Bit pipeline counters. 'Delivered' means
queued to the Kafka client library, not confirmed by broker.
Run 'debug plugins vm_series kafka config-status' to verify
broker connectivity and mTLS handshake.
```
- Verify broker connectivity and mTLS handshake status using debug
plugins vm_series kafka config-status.
admin@PA-VM> debug plugins vm_series kafka config-status
<response status="success">
<result>
Kafka Configuration Status
=================================================================
Timestamp : 2026-04-06 15:51:48
Fluent Bit :
Process : Running (PID 1137139)
Health API : N/A (process running)
Config File : present
Kafka Metrics Server SDB :
Status : configured
Name : METRICS
Broker : bootstrap-clstr-a6tvlyfwpiixb84g.kafka.us-phoenix-1.oci.oraclecloud.com:9093
Topic : metrics
Client Certificate : configured
Kafka Output [kafka_METRICS_out] :
Brokers : bootstrap-clstr-a6tvlyfwpiixb84g.kafka.us-phoenix-1.oci.oraclecloud.com:9093
Topics : metrics
Match : firewall_metrics
Security Protocol : SSL
Compression : snappy
SSL/mTLS : Configured
Broker Connectivity :
bootstrap-clstr-a6tvlyfwpiixb84g.kafka.us-phoenix-1.oci.oraclecloud.com:9093 TCP OK (6.4 ms)
mTLS OK (12.0 ms)
Certificate & Key Status :
Client Cert : Present (expires : Mar 18 22:07:05 2027 GMT)
Private Key : Present
STATUS : All checks passed — Kafka configuration is valid
</result>
</response>
```
