Can I monitor TR7 metrics with Prometheus / Grafana?

Short answer

Yes, in two ways. At the device level, the network of the Prometheus server is entered in the Prometheus Allowed Networks field on the Settings → Device Management → Management Access screen; the /metrics endpoint on the TR7 management address provides device, vService and Backend Service metrics, returns 401 to addresses outside the allowed network, and ready-made dashboard files for Grafana are downloaded from the SNMP & Grafana Files section on the same screen. At the vService level, the Provide Prometheus Service action provides metrics in Prometheus format on the HTTP vService's own address (default /metrics). Since this action has no authentication, access is restricted with a condition (e.g. Source IP).

Problem: TR7 Metrics Are Missing from the Central Monitoring System

The organization collects all its systems with Prometheus and monitors them in Grafana; the metrics of the TR7 device and the vServices are also wanted on the same dashboards.

Solution: Two Methods

Method 1 provides the entire device from a single endpoint; Method 2 provides the own metrics of a single HTTP vService from the address of that vService. The two can be used together.

Your situation	Suitable method
Device and all vService metrics, ready-made Grafana dashboards	Method 1: Management Access → Prometheus
Prometheus can reach only the address of an HTTP vService	Method 2: Provide Prometheus Service action

Method 1: Management Access → Prometheus Recommended

• How it works The /metrics endpoint of the TR7 management interface returns metrics in text format if the address sending the request is in the Prometheus Allowed Networks list; it gives a 401 response to other addresses.
• Where it is openedSettings → Device Management → Management Access → Edit → Prometheus
• Requirement Access from the Prometheus server to the HTTP (default 80) or HTTPS (default 443) port of the TR7 management address; if HTTP / HTTPS Allowed Networks are defined, the Prometheus server is also in those lists
• Scope The whole device; not assigned to a vService

Step-by-Step Configuration

1

Adım 1 Open the edit form

On the Settings → Device Management → Management Access screen, the Edit button is clicked; the edit tab opens (how to edit).

2

Adım 2 Enter the allowed network

The Prometheus Allowed Networks switch in the Prometheus section is turned on (while it is off, Disabled is written) and the address of the Prometheus server is added in CIDR format (e.g. 203.0.113.50/32). If the list is empty, no address can reach the endpoint.

3

Adım 3 Save

The Edit button at the very bottom of the form is clicked; on this screen, the name of the save button is Edit (Edit).

4

Adım 4 Configure Prometheus

On the Prometheus server, the TR7 management address is written as a target under scrape_configs (Prometheus scrape_config). If the management interface is accessed over HTTPS, scheme: https is used:

scrape_configs:
  - job_name: tr7
    metrics_path: /metrics
    scheme: https
    static_configs:
      - targets: ['192.0.2.10:443']

5

Adım 5 Import the Grafana dashboards

The Service Dashboard or Global Dashboard file (the __rate_interval or __interval version) is downloaded from the SNMP & Grafana Files section on the Management Access screen and imported in Grafana.

Verification

1EndpointPrometheus server

Command: curl -k https://192.0.2.10/metrics

ExpectedText metric lines starting with tr7_

2Unauthorized addressAnother client

The same request is sent from an address outside the allowed network.

Expected401 Your IP is not allowed for Prometheus service

Method 2: Provide Prometheus Service Action

• How it works The action answers the requests that match the condition and come to the Metric Address path with the metrics of the vService, without sending them to the Backend Service; requests that do not match the condition go to the Backend Service normally.
• Where it is openedLoad Balancer → Actions → Action Type = Provide Prometheus Service
• Requirement HTTP vService; access of the Prometheus server to the vService address
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the condition form

On the Load Balancer → Conditions screen, the Add button is clicked (how to add).

2

Adım 2 Define the source address condition

Condition Name is entered, Criteria = Source IP and the source type Manual are selected, and the address of the Prometheus server (e.g. 203.0.113.50) is entered.

3

Adım 3 Save the condition

The Add button is clicked.

4

Adım 4 Open the action form

On the Load Balancer → Actions screen, the Add button is clicked.

5

Adım 5 Define the action

Action Name is entered, and Action Type = Provide Prometheus Service is selected. Metric Address is left at the default /metrics or changed; the path matches exactly. In the Conditions field, the created condition is selected. If Conditions is left empty, the metrics are open to everyone who reaches the vService.

6

Adım 6 Save the action

The Add button is clicked.

7

Adım 7 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is right-clicked and Edit is selected.

8

Adım 8 Add the action to the vService

The action is selected in the Actions field in the Details panel. The action does not work unless it is added to the vService.

9

Adım 9 Save

The Save button is clicked. The progress of applying the change is followed from the sync indicator at the bottom right of the screen. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent manually with Synchronize. The address and port of the vService are written as the Prometheus target (Prometheus configuration example).

Verification

1EndpointPrometheus server

Command: curl http://192.0.2.20/metrics

ExpectedText metric output in Prometheus format

2Other clientAn address outside the condition

The same request is sent from an address other than the Prometheus server.

ExpectedThe request goes to the Backend Service; no metrics are returned

Common Mistakes

• Leaving the Prometheus allowed networks list empty. If the list is empty, the endpoint returns 401 to every address.
• Forgetting management access. If HTTP / HTTPS Allowed Networks are defined and the Prometheus server is not in these lists, the server cannot reach the management address at all.
• Leaving the Provide Prometheus service action without a condition. The metrics are open to everyone who reaches the vService.
• Writing the metric address differently. The path matches exactly; /metrics and /metrics/ are different.
• Looking for the action on an L7 TCP vService. Provide Prometheus Service works only on an HTTP vService.
• Confusing SNMP polling with Prometheus. SNMP access in Management Access is a separate integration.

How it is done in the documentation

• Management Access · Prometheus Allowed Networks
• Management Access · SNMP & Grafana Files
• Provide Prometheus Service · Metric Address
• Provide Prometheus Service · Prometheus Configuration Example

Related questions

• Which metrics are on the vService dashboard?
• Can I send flow data with IPFIX?
• Where do I monitor the current status of my vService?