Problem finding the metric used for data in device overview

IKL Development
#1

2 Issues:

  1. Metric time is correct on this metric but not on other metrics using an hours, minutes, seconds duration. The metric begins as an epoch value that isn’t translated correctly like this one is.
  2. Where is this CLI Idle Timeout metric even coming from?

The Device | Overview for a PAN device shows:
CLI Idle Timeout 0 days 01:00:00

However, I cannot find a metric that provides this information. I see in reserved metrics there is an ssh-timeout metric but searching all the IND scripts there isn’t a single script that writes that metric.

To find the CLI session timeout on a Palo Alto you run: show cli idle-timeout but that only shows your current session, not the setting for the firewall itself. To find that you have to parse the config file looking for " set deviceconfig setting management" then “idle-timeout”. I don’t see anywhere this is looked at.

I’m most curious about how this time is pulled from the Palo and entered as a metric since the default of 60 minutes is showing correctly here but metrics for Application update, schedule etc. are all displayed incorrectly.

#2

Can you post a screenshot?

#3

From my testing, the summary is this:

Indeni requires that Time metrics be in SECONDS but Duration metrics need to be in MILLISECONDS when written to the TSD.
Rules need to use (TimePeriod.MILLISECOND) for anything recorded to the database in milliseconds with duration based metrics vs (TimePeriod.SECOND) for time metrics.