Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Integrations › Prometheus

Prometheus

Prometheus and Grafana

Status: SUPPORTED as operator-hosted scrape + in-tree dashboards. Not Grafana Cloud / SaaS.Audience: observability engineer

What it does

When metrics.enabled is true, the Manager exposes Prometheus text at metrics.path (default /metrics) on the API listener. Access is admin JWT + RoleAuth("admin"). Agent optional metrics bind 127.0.0.1:9090 by default.

In-tree Grafana dashboards (operator-hosted Grafana):

  • grafana/dashboards/security-overview.json
  • grafana/dashboards/agent-status.json
  • grafana/dashboards/attack-patterns.json
  • grafana/dashboards/system-performance.json
  • grafana/dashboards/authentication.json
  • Enterprise tree also has cluster-ha.json (cluster is not a public HA product)

Provisioning samples: grafana/provisioning/datasources.yml, dashboards.yml.

Edition

SHARED scrape. Cluster dashboard is Enterprise-tree only and still not a certified HA product.

Prerequisites

  • Prometheus that can present admin credentials (bearer JWT) to the Manager
  • Grafana with a Prometheus datasource
  • metrics.enabled: true on Manager
  • Optional Agent metrics.enabled: true for localhost scrape via node exporter pattern / local Prometheus

Required permissions / credentials

  • Admin JWT (same privilege as console)
  • TLS trust to the Manager
  • Do not scrape with anonymous access

Configuration

Manager:

metrics:
  enabled: true
  path: /metrics

Agent:

metrics:
  enabled: false
  bind_address: "127.0.0.1"
  port: 9090
  metrics_path: /metrics
  health_path: /health
  allowed_cidrs: []   # empty = localhost only

Setup

  1. Enable Manager metrics; restart.
  2. zwallctl login and scrape:
curl -sS https://manager.example.com:8443/metrics \
  -H "Authorization: Bearer TOKEN"
  1. Configure Prometheus bearer_token (file, not argv).
  2. Import JSON dashboards from the same edition tree into operator-hosted Grafana.
  3. Optional: scrape Agent 127.0.0.1:9090/metrics from a local Prometheus on that host only.

Verification

  • HTTP 200 Prometheus text
  • Disabled: route skipped (metrics.enabled false)
  • 401 without admin JWT

Expected signals / results

Counters for log ingest, license denials, login, Agent health — names are code-owned. Grafana panels show series when the datasource matches. Traffic rates in dashboards are not a published PPS product number.

Failure modes

Scroll sideways to see the full table. Use the arrow keys when focused.

SymptomMeaning
404 / connectionmetrics disabled or wrong path
401/403not admin
empty Grafanawrong Prometheus job / TLS

Troubleshooting

  • Path override metrics.path
  • Split-mode: scrape the API port, not an unrelated web port
  • Agent bind remains loopback unless you knowingly set allowed_cidrs

Security considerations

Scrape credentials are admin-equivalent. Prefer a dedicated admin with monitoring scope only if you introduce one; today RoleAuth is admin. Do not expose Agent metrics on a public interface.

Limitations

  • Not a SaaS
  • Cluster dashboard ≠ certified HA
  • No published cardinality/retention SLA