Cloud NGFW for AWS CloudWatch Metrics
Table of Contents
Cloud NGFW for AWS CloudWatch Metrics
Publish custom metrics in AWS CloudWatch for your Cloud NGFW for AWS
resource.
Cloud NGFW for AWS publishes custom metrics in AWS CloudWatch to help you monitor your Cloud
NGFW's health, performance and usage patterns. With these additional metrics you can
assess the overall health of your Cloud NGFW resources, identify performance bottlenecks
and detect anomalies. These metrics are numerical values describing aspects of a Cloud
NGFW at a particular time. Collected every five minutes, metrics are useful for alerting
due to their frequent sampling.
The CloudWatch log group,
S3 bucket, CloudWatch namespace and the Kinesis stream should be pre-created in the
Cloud Formation Template (CFT).
Metrics are collected every five minutes. All
metrics are published to one namespace. CloudWatch stores your metrics, so that you
can access historical information for added perspective on how your Cloud NGFW
resources are performing. You can also set alarms that watch for certain thresholds,
and send notifications or take actions when those thresholds are met. For more
information, see the Amazon CloudWatch documentation.
The following CloudWatch metrics are supported by the Cloud NGFW resource:
|
Field Name
|
Description
|
|---|---|
|
Dataplane CPU Utilization (%)
|
Monitors dataplane CPU usage and measures the traffic load on the
Cloud NGFW resource.
|
|
Dataplane Packet Buffer Utilization (%)
|
Monitors dataplane buffer usage and measures buffer utilization. If
you have a sudden burst in traffic, monitoring your buffer
utilization allows you to ensure that the firewall does not deplete
the dataplane buffer, which results in dropped packets.
|
|
Connection per Second
|
Represents the total number of concurrent TCP connections.
|
|
Session Throughput Kbps
|
The session throughput, measured in Kbps.
|
|
Session Throughput Pps
|
The session throughput, measured in Pps.
|
|
Sessions Active
|
Monitors the total number of sessions that are active on the Cloud
NGFW resource. An active session is a session that is in the flow
lookup table for which packets will be inspected and forwarded, as
required by policy.
|
|
Session Utilization (%)
|
Monitors the TCP, UDP, ICMP and SSL sessions that are currently
active and the packet rate, new connection establish rate, and
firewall throughput to determine session utilization.
|
|
BytesIn
|
Number of bytes in the server-to-client direction of the session.
|
|
BytesOut
|
Number of bytes in the client-to-server direction of the session.
|
|
PktsIn
|
Number of server-to-client packets for the session.
|
|
PktsOut
|
Number of client-to-server packets for the session.
|
To publish CloudWatch Metrics:
- Log into your Cloud NGFW resource.
- Select NG Firewalls.
- Select Log Settings.
- Under Metrics, specify the following:
- CloudWatch Namespace. This field represents the location on AWS where the metrics are collected.
- CloudWatch Metric. Select the metrics you want to monitor. See the table above for supported metrics.
- Click Save.
![]()
A sample output of metrics displayed in an account resemble:
