This is the documentation for the v21.03 version. Looking for the documentation of the latest version? Have a look here.
TNSR includes a Prometheus exporter which supports statistical data from the
dataplane (VPP) only. This data is typically fed into Grafana. When active,
the service listens for connections on TCP port
Configuring Grafana and its supporting systems is outside the scope of this documentation. Consult its documentation for details.
The Prometheus service on TNSR does not perform authentication or encryption. Only transmit data across trusted network paths, and do not expose the service to untrusted networks.
Data exported by Prometheus may be sensitive in nature, so protect access to the service with appropriate standard ACLs if the service is running in the dataplane namespace. Do not open access to the Prometheus port unilaterally. The default host ACL ruleset allows access to the Prometheus port.
- prometheus <namespace> enable
Enables the Prometheus Exporter service in either the
hostnamespace is more secure as limits the exposure of the service to host OS management networks.
After enabling the service, start it as described in Service Control.
- prometheus <namespace> disable
Disables the Prometheus Exporter service in the given namespace.
- prometheus <namespace> filter <regex> [<regex> […]]
Adds one or more regular expression filters which limit the data exposed by the service. For a list of items which can be filtered, query the service as described in Querying Prometheus Data.
- no prometheus <namespace> filter <regex>
Removes a filter.
Querying Prometheus Data¶
The URL for metrics is:
In the URL,
<IP address> is an IP address on an interface in the appropriate
namespace. For example, if Prometheus is running in the
host namespace, the
IP address would be from a host OS management interface on TNSR.
This service is not meant to be queried by a web browser. Use a client
which understands Prometheus data, or a client such as
curl which will
print the data returned by the service when testing.
The Prometheus statistics daemon uses an AF_INET6 socket which can accept
connections from both IPv4 and IPv6 clients. When viewing the daemon process,
it will show
IPv6, or similar strings in the output. This is
normal and does not indicate a problem.
$ sudo netstat -lntp | grep prometheus tcp6 0 0 :::9482 :::* LISTEN 2985/vpp_prometheus $ sudo lsof +c15 -iTCP -sTCP:LISTEN | grep prometheus vpp_prometheus_ 2985 root 3u IPv6 39319 0t0 TCP *:9482 (LISTEN)
As mentioned in the warning at the start of this section, the Prometheus service does not have its own encryption or authentication. As such, the primary ways to protect the service are:
- Isolate the service to the appropriate namespace
This is typically the
hostnamespace, but some TNSR configurations do not have host interfaces.
- Protect the network paths carrying Prometheus data
Use a directly connected secure path, such as a local management network. If the data must be transmitted remotely, encrypt the path between Prometheus and the host collecting its data, for example, with an IPsec tunnel.
- Restrict access with ACLs
The default set of host ACLs denies access to the service, but take care when crafting rules to only permit access from authorized hosts or networks.
This example host ACL permits access to the Prometheus service from one IPv4 host,
tnsr(config)# host acl prometheus tnsr(config-host-acl)# sequence 10 tnsr(config-host-acl)# rule 10 tnsr(config-host-acl-rule)# action permit tnsr(config-host-acl-rule)# description Allow Prometheus tnsr(config-host-acl-rule)# match ip protocol tcp tnsr(config-host-acl-rule)# match ip port destination 9482 tnsr(config-host-acl-rule)# match ip version 4 tnsr(config-host-acl-rule)# match ip address source 198.51.100.244/32 tnsr(config-host-acl-rule)# exit tnsr(config-host-acl)# exit tnsr(config)#