What is Prometheus; how are TR7 metrics exposed to Prometheus?

Short answer

Prometheus is the open-source monitoring system that scrapes the HTTP metric endpoints of the monitored targets at regular intervals and stores the data as time series (Prometheus · Overview); its data is usually visualized with Grafana dashboards. TR7 exposes metrics in two ways. At the device level, the /metrics endpoint at the TR7 management address provides the device, vService and Backend Service metrics; only the networks in the Prometheus Allowed Networks list on the Management Access screen can access this endpoint, and if the list is empty or turned off, every request is rejected with 401. At the vService level, on the other hand, the Provide Prometheus Service action added to an HTTP vService responds to the requests arriving at the path in the Metric Address field (default /metrics) with metrics in Prometheus format, without forwarding them to the Backend Service. The ready-made Grafana dashboard files are obtained from the Grafana Files row in Management Access.

Where It Is Used in TR7

Where	Field / label	What for
Settings → Device Management → Management Access → Edit → Prometheus	Prometheus Allowed Networks (on/off, CIDR list)	The Prometheus networks that can access the device's /metrics endpoint
Load Balancer → Actions → Add	Action Type = Provide Prometheus Service; Metric Address (default /metrics); Conditions	A metric endpoint over the vService address; restricting access with a condition
Settings → Device Management → Management Access	Grafana Files: Service Dashboard and Global Dashboard (__rate_interval and __interval versions)	Ready-made Grafana dashboards

Two Paths

	Device /metrics endpoint	Provide Prometheus Service action
Address	TR7 management address	The HTTP vService's address and the Metric address path
Access control	Prometheus Allowed Networks; 401 to the addresses outside it	No authentication; restricted by attaching a condition (e.g. Source IP) to the action
Scope	Device, vService and Backend Service metrics	The metrics of the vService the action is attached to

• Setup steps: Can I monitor TR7 metrics with Prometheus / Grafana?

Common Misconceptions

• "TR7 sends the metrics to Prometheus." Prometheus itself pulls the metrics from TR7; TR7 only exposes an endpoint.
• "The requests arriving at the metric path also go to the Backend Service." The action responds directly to the requests arriving at this path; it does not forward them to the Backend Service. The path is matched exactly and case-sensitively.
• "While Prometheus allowed networks is empty, everyone can access it." While the list is empty or the field is off, the device's /metrics endpoint rejects every request.

How it is done in the documentation

• Management Access · Prometheus Allowed Networks
• Provide Prometheus Service
• Provide Prometheus Service · Metric Address
• Management Access · SNMP & Grafana Files

Related questions

• Can I monitor TR7 metrics with Prometheus / Grafana?
• What is SNMP; for what purposes is it used in TR7?