Palo Alto firewalls extension
- Latest Dynatrace
- Extension
- Published Oct 27, 2025
Monitor the health and performance of your Palo Alto firewalls.
Get started
Overview
This extension uses SNMP to monitor the health and performance of your Palo Alto firewalls.
- Unified analysis for Ops, DevOps and IT admins
- Complete configuration is provided out of the box
This extension is built on top of the Extension 2.0 Framework.
Use cases
- Monitor health state and performance of your Palo Alto firewalls and provide unified analysis for Ops, DevOps and IT Admins.
- Use included alerts for fan speed and temperature.
Requirements
- Palo Alto firewalls only
- SNMPv2c and SNMPv3 only
Activation and setup
Activate the extension in your environment using the in-product Hub, provide the device configuration, and you’re all set.
For details, see SNMP data source.
Details
The extension package contains:
- SNMP DataSource configuration
- Dashboard template
- Unified Analysis screen template
- Topology definition and entity extraction rules for Palo Alto firewalls, interfaces, and virtual systems
For more information, see the Simplified observability for your SNMP devices product news blog.
Licensing and cost
This extension ingests custom metrics that, depending on your licensing model, can either consume DDUs or metrics on your Dynatrace Platform Subscription.
A rough estimate of the number metric timeseries ingested by this extension is given by:
(number of devices * 24) + (number of interfaces * 10) + (number of virtual systems * 3) + (number of sensors across all devices) + (number of memory objects across all devices * 5)
where mem_objects includes disks and RAM slots and sensors corresponds to physical sensors like fan RPM and temperature.
An easier, rougher estimate is given by:
(number of devices * 33) + (number of interfaces * 10)
Feature sets
When activating your extension using monitoring configuration, you can limit monitoring to one of the feature sets. To work properly the extension has to collect at least one metric after the activation.
In highly segmented networks, feature sets can reflect the segments of your environment. Then, when you create a monitoring configuration, you can select a feature set and a corresponding ActiveGate group that can connect to this particular segment.
All metrics that aren't categorized into any feature set are considered to be the default and are always reported.
A metric inherits the feature set of a subgroup, which in turn inherits the feature set of a group. Also, the feature set defined on the metric level overrides the feature set defined on the subgroup level, which in turn overrides the feature set defined on the group level.
default
| Metric name | Metric key | Description |
|---|---|---|
| — | com.dynatrace.extension.network_device.if.bytes_in.count | — |
| — | com.dynatrace.extension.network_device.if.bytes_out.count | — |
| — | com.dynatrace.extension.network_device.if.in.errors.count | — |
| — | com.dynatrace.extension.network_device.if.out.errors.count | — |
| — | com.dynatrace.extension.network_device.if.in.discards.count | — |
| — | com.dynatrace.extension.network_device.if.out.discards.count | — |
| — | com.dynatrace.extension.network_device.if.status | — |
| — | com.dynatrace.extension.network_device.sysuptime | — |
| — | com.dynatrace.extension.network_device.cpu_usage | — |
| — | com.dynatrace.extension.network_device.memory_total | — |
| — | com.dynatrace.extension.network_device.memory_used | — |
virtualSystem
| Metric name | Metric key | Description |
|---|---|---|
| VSYS - Max Sessions | com.dynatrace.extension.palo-alto.generic.vsys.sessions.max | — |
| VSYS - Active Sessions | com.dynatrace.extension.palo-alto.generic.vsys.sessions.active | — |
| VSYS - Session Utilization | com.dynatrace.extension.palo-alto.generic.vsys.sessions.utilization | — |
control-plane
| Metric name | Metric key | Description |
|---|---|---|
| System uptime | com.dynatrace.extension.palo-alto.generic.sys.uptime | — |
| CPU Management Plane Utilization | com.dynatrace.extension.palo-alto.generic.cpu.management.utilization | — |
| CPU System Plane Utilization | com.dynatrace.extension.palo-alto.generic.cpu.system.utilization | — |
| Memory Allocation Units | com.dynatrace.extension.palo-alto.generic.mem.allocation.units | The size in bytes of the data objects allocated from this pool. |
| Memory Size | com.dynatrace.extension.palo-alto.generic.mem.size | — |
| Memory Used | com.dynatrace.extension.palo-alto.generic.mem.used | — |
| Memory Allocation Failures | com.dynatrace.extension.palo-alto.generic.mem.allocation.failures.count | The number of requests for storage represented by this entry that could not be honored due to not enough storage. |
interface
| Metric name | Metric key | Description |
|---|---|---|
| — | com.dynatrace.extension.palo-alto.generic.if.entity | — |
| Interface Incoming Octets Count | com.dynatrace.extension.palo-alto.generic.if.in.octets.count | — |
| Interface Incoming Ucast Packets Count | com.dynatrace.extension.palo-alto.generic.if.in.ucast.packets.count | — |
| Interface Outgoing Octets Count | com.dynatrace.extension.palo-alto.generic.if.out.octets.count | — |
| Interface Outgoing Packets Count | com.dynatrace.extension.palo-alto.generic.if.out.ucast.packets.count | — |
| Interface Incoming Errors | com.dynatrace.extension.palo-alto.generic.if.in.err.count | — |
| Interface Outgoing Errors | com.dynatrace.extension.palo-alto.generic.if.out.err.count | — |
| Interface Incoming Discards | com.dynatrace.extension.palo-alto.generic.if.in.discards.count | — |
| Interface Outgoing Discards | com.dynatrace.extension.palo-alto.generic.if.out.discards.count | — |
device-logging
| Metric name | Metric key | Description |
|---|---|---|
| Incoming log rate | com.dynatrace.extension.palo-alto.generic.pandeviceincominglograte | The incoming rate in logs/s on the Device. PAN-COMMON-MIB |
| Write log rate | com.dynatrace.extension.palo-alto.generic.pandevicewritelograte | The write rate in logs/s on the Device. PAN-COMMON-MIB |
zone
| Metric name | Metric key | Description |
|---|---|---|
| Zone active TCP connections per second | com.dynatrace.extension.palo-alto.generic.zone.active.tcp.cps | Number of active TCP connections per second for this zone. panZoneActiveTcpCps - PAN-COMMON-MIB |
| Zone active UDP connections per second | com.dynatrace.extension.palo-alto.generic.zone.active.udp.cps | Number of active UDP connections per second for this zone. panZoneActiveUdpCps - PAN-COMMON-MIB |
| Zone Other IP connections per second | com.dynatrace.extension.palo-alto.generic.zone.active.otherip.cps | Number of active Other IP connections per second for this zone. panZoneActiveOtherIpCps - PAN-COMMON-MIB |
gateway
| Metric name | Metric key | Description |
|---|---|---|
| Active Tunnels | com.dynatrace.extension.palo-alto.generic.tunnels.active | — |
| Max Tunnels | com.dynatrace.extension.palo-alto.generic.tunnels.max | — |
| Gateway Utilization % | com.dynatrace.extension.palo-alto.generic.gateway.utilization | — |
| Active Sessions | com.dynatrace.extension.palo-alto.generic.sessions.active | — |
| Session utilization | com.dynatrace.extension.palo-alto.generic.sessions.utilization | Session table utilization percentage. |
| Max Sessions | com.dynatrace.extension.palo-alto.generic.sessions.max | — |
| Sessions - TCP | com.dynatrace.extension.palo-alto.generic.sessions.tcp | — |
| Sessions - UDP | com.dynatrace.extension.palo-alto.generic.sessions.udp | — |
| Sessions - ICMP | com.dynatrace.extension.palo-alto.generic.sessions.icmp | — |
| Sessions - SSL Proxy | com.dynatrace.extension.palo-alto.generic.sessions.proxy | — |
| Session SSL proxy utilization | com.dynatrace.extension.palo-alto.generic.sessions.proxy.util | SSL proxy Session utilization percentage. panSessionSslProxyUtilization PAN-COMMON-MIB |
log-collector
| Metric name | Metric key | Description |
|---|---|---|
| PAN LC Log Rate | com.dynatrace.extension.palo-alto.generic.lc.log_rate | The write rate in logs/s on the Log Collection. |
| PAN LC Disk Usage | com.dynatrace.extension.palo-alto.generic.lc.disk_usage | The Log disk usage for logical disks on the Log Collector |
| PAN LC Log Duration | com.dynatrace.extension.palo-alto.generic.lc.log_duration | The Log duration (in days) for the logs on the Log Collector |
host-system-usage
| Metric name | Metric key | Description |
|---|---|---|
| System Users | com.dynatrace.extension.palo-alto.generic.sys.host.num_users | The number of user sessions for which this host is storing state information. hrSystemNumUsers |
| System Processes | com.dynatrace.extension.palo-alto.generic.sys.host.num_processes | The number of process contexts currently loaded or running on this system. hrSystemProcesses |
| System Max Processes | com.dynatrace.extension.palo-alto.generic.sys.host.max_processes | The maximum number of process contexts this system can support. hrSystemMaxProcesses |
| Load Average 1min | com.dynatrace.extension.palo-alto.generic.sys.host.load_average | The 1 minute load average. laLoad |
pan-sys
| Metric name | Metric key | Description |
|---|---|---|
| Sys release date info | com.dynatrace.extension.palo-alto.generic.sys.release.dates | Dimensions: panSysSwVersion panSysAppVersion, panSysAppReleaseDate, panSysThreatVersion, panSysThreatReleaseDate, panSysAvVersion, panSysAvReleaseDate, panSysWildfireVersion, panSysWfReleaseDate, panSysUrlFilteringVersion, panSysHAState, panSysHAPeerState, chassis.type . PAN-COMMON-MIB |
hardware
| Metric name | Metric key | Description |
|---|---|---|
| Total Power Available (Watts) | com.dynatrace.extension.palo-alto.generic.power.available | — |
| Total Power Used (Watts) | com.dynatrace.extension.palo-alto.generic.power.used | — |
| Sensor Value | com.dynatrace.extension.palo-alto.generic.sensor.value | entPhySensorValue objects, represent fan speed and temperature. |
Troubleshooting
To troubleshoot this extension or get help from the experts, use the guides in the Dynatrace Community.
