Collect HA link counters and Advanced Routing Engine BGP and OSPF in Palo Alto Networks Firewall by lucia-sb · Pull Request #25806 · DataDog/integrations-core

lucia-sb · 2026-10-27T11:20:41Z

What does this PR do?

Adds two collections to the Palo Alto Networks Firewall check:

HA links: the six ha.interface.* counters for each configured HA link (HA1, HA2). When HA1 runs on the management port, PAN-OS reports the whole management interface's counters.
Advanced Routing Engine: BGP peer and OSPF neighbor metrics, one call per logical router, with the router in the vr tag. Previously this engine only produced a warning.

It also adds bgp.peer.prefixes.incoming.accepted on both routing engines, and computes bgp.peer.prefix_limit.utilization from accepted prefixes on both, so each metric means the same thing on either engine. The Advanced Routing Engine does not report received, rejected or total outgoing prefixes, so those metrics are legacy-only; bgp.peer.connections.* and ospf.neighbor.state_changes are Advanced-Routing-Engine-only.

A failing HA link or logical router is now skipped with a warning instead of dropping the collector's other samples, using the same helper as the rule hits collector. The NDM device vendor is now paloaltonetworks, matching the device_vendor tag and the SNMP profile.

Tested with unit tests on anonymized lab captures and a live run against the four lab firewalls on staging.

Motivation

Stacked on #25662, which is merged but not yet released. The NDM lab now has an HA pair and a firewall running the Advanced Routing Engine, so these product brief datapoints can be tested.

Checklist before requesting review

I self-reviewed the full diff, and this description matches the final change
Tests cover the change, or this description explains why none are needed
Automated review comments, including Codex review, were addressed or answered
I, the human author, understand this change, can explain it to reviewers, and believe it meets the repository standards

🤖 Generated with Claude Code

dd-octo-sts · 2026-10-27T11:22:30Z

✅ Dispatcher tests: passed

Dispatcher beta: informational only
Existing CI remains the merge signal.

2/2 jobs

✅ 2 passed · nothing failed

Batches · ✅ batch-01 2/2

_{Dispatcher finished on 1d23d40 — GitHub Run · Dispatcher Logs.}

cit-pr-commenter-54b7da · 2026-10-27T11:24:19Z

evalya-impact-summary

Evalya CI impact

Impact analysis: RUN-ALL — every test task will run
Trigger:         empty diff (default branch, scheduled run, or shallow-clone fallback)
Test tasks:      0 (all selected)
Publish tasks:   4 (always emitted)
Changed files:   0

Full impact report
Learn more about CI impact filtering

datadog-datadog-us1-prod · 2026-10-27T11:26:20Z

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 98.43%
• Overall Coverage: 97.31% (+7.63%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 0a2381a | Docs | View more details | Give us feedback!}

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dd-octo-sts · 2026-10-28T10:50:46Z

Disk usage change

Commit 0a2381a compared against 1825c97.

Uncompressed

linux-aarch64	linux-x86_64	macos-aarch64	macos-x86_64	windows-x86_64
🔺 +10.32 KiB	🔺 +10.32 KiB	🔺 +10.32 KiB	🔺 +10.32 KiB	🔺 +10.32 KiB

Details

Name	Version	Type	linux-aarch64	linux-x86_64	macos-aarch64	macos-x86_64	windows-x86_64
pan_firewall	3.3.0	Integration	🔺 +10.32 KiB	🔺 +10.32 KiB	🔺 +10.32 KiB	🔺 +10.32 KiB	🔺 +10.32 KiB

Compressed

linux-aarch64	linux-x86_64	macos-aarch64	macos-x86_64	windows-x86_64
🔺 +2.9 KiB	🔺 +2.9 KiB	🔺 +2.9 KiB	🔺 +2.9 KiB	🔺 +2.9 KiB

Details

Name	Version	Type	linux-aarch64	linux-x86_64	macos-aarch64	macos-x86_64	windows-x86_64
pan_firewall	3.3.0	Integration	🔺 +2.9 KiB	🔺 +2.9 KiB	🔺 +2.9 KiB	🔺 +2.9 KiB	🔺 +2.9 KiB

Send accepted prefixes as bgp.peer.prefixes.incoming.accepted on both routing engines and base prefix-limit utilization on it. Skip a failing logical router or HA link with a warning instead of dropping every sample. Note in metadata.csv which engine sends each routing metric. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The device record sent "Palo Alto Networks" while every metric carried device_vendor:paloaltonetworks, so NDM derived a second tag, device_vendor:palo_alto_networks. Use the tag constant for both, matching the SNMP Palo Alto profile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…d rule hit collectors The skip-one, fail-when-all-fail loop was written out in collect_ha, collect_are and collect_rule_hits, and the rule hits copy had already drifted (it caught only PanosApiError and re-raised only PanosAuthError). Move it to read_each in collectors/base.py so the three follow one rule: auth and connection errors propagate at once, any other PanosError skips the item with a warning, and the last error is raised when nothing answered. No behavior change: client.op raises nothing the old rule hits loop handled differently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chatgpt-codex-connector · 2026-10-29T10:09:45Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T10:14:09.421531Z	`fe5dde1`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe5dde1704

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…e unreleased fixed entry - Remove tests that repeat coverage: the ARE restart boundary (bgp_restart is tested on the legacy path), camel_afi_safi_tag and the logical router names (covered by the capture tests), the ARE OSPF empty answer, and the HA unknown-shape parse test (covered through collect_ha). - Test read_each in test_base.py instead of per collector: skip and report, raise the last error when nothing answered, propagate auth and connection errors. Each collector keeps one failing-item wiring test, and HA keeps the check that ha_state survives a failed run. - Drop changelog.d/25806.fixed: the NDM vendor value it describes was never released. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

datadog-datadog-us1-prod

More details

Fixture-based validation supports HA counter collection and Advanced Routing Engine BGP/OSPF parsing. Docker E2E and live-firewall behavior remain unverified.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit fe5dde1}

HadhemiDD · 2026-10-30T11:10:08Z

+    return [sample for router, data in answers for sample in parse(data, router)]


 def collect_bgp(ctx: CollectContext) -> list[Sample]:


Q: What does PAN-OS return for a logical router that has no BGP or OSPF configured? If it returns an API error, every router fails, and "collector bgp failed" is logged on every run for firewalls that don't use BGP.
The only Advanced Routing Engine captures (fw-b) come from a router that has both protocols configured.

I changed the ARE collectors so that when every logical router answers with an API error, they warn once per router and send nothing, instead of failing and retrying on every run. Auth and connection errors still fail the collector. The tests cover the empty answer and the all-routers-error case.

… API error A logical router without BGP or OSPF may answer with an error rather than empty JSON; failing the collector would log and retry it on every run on firewalls that do not run the protocol. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dd-octo-sts · 2026-10-30T11:56:36Z

Validation Report

All 22 validations passed.

Show details

Validation	Description	Status
`agent-reqs`	Verify check versions match the Agent requirements file	✅
`ci`	Validate CI configuration and code coverage settings	✅
`codeowners`	Validate every integration has a CODEOWNERS entry	✅
`config`	Validate default configuration files against spec.yaml	✅
`dep`	Verify dependency pins are consistent and Agent-compatible	✅
`http`	Validate integrations use the HTTP wrapper correctly	✅
`imports`	Validate check imports do not use deprecated modules	✅
`integration-style`	Validate check code style conventions	✅
`jmx-metrics`	Validate JMX metrics definition files and config	✅
`labeler`	Validate PR labeler config matches integration directories	✅
`legacy-signature`	Validate no integration uses the legacy Agent check signature	✅
`license-headers`	Validate Python files have proper license headers	✅
`licenses`	Validate third-party license attribution list	✅
`metadata`	Validate metadata.csv metric definitions	✅
`models`	Validate configuration data models match spec.yaml	✅
`openmetrics`	Validate OpenMetrics integrations disable the metric limit	✅
`package`	Validate Python package metadata, naming, and wheel contents	✅
`pr-description`	Validate the pull request checklist and visible description length	✅
`qa-label`	Validate the pull request declares whether it needs QA for the next Agent release	✅
`readmes`	Validate README files have required sections	✅
`saved-views`	Validate saved view JSON file structure and fields	✅
`version`	Validate version consistency between package and changelog	✅

View full run

temporal-github-worker-1 · 2026-10-30T12:00:04Z

Backport evaluation: View Slack thread

lucia-sb added the qa/skip-qa Automatically skip this PR for the next QA label Oct 27, 2026

dd-octo-sts Bot added the integration/pan_firewall label Oct 27, 2026

dd-octo-sts Bot added the internal Identify a non-fork PR label Oct 27, 2026

Base automatically changed from lucia-sb/pan-firewall-agent-check to master October 27, 2026 16:53

lucia-sb and others added 6 commits October 28, 2026 11:36

[pan_firewall] Collect the HA link counters

0342a2c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

[pan_firewall] Collect BGP peers on the Advanced Routing Engine

8a7512f

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

[pan_firewall] Anonymize the fw-c HA fixtures

d68ca55

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

[pan_firewall] Collect OSPF neighbors on the Advanced Routing Engine

3e6a2ef

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

[pan_firewall] Add the changelog entry

fa01ace

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

[pan_firewall] Compare the whole ARE BGP capture in one assertion

f31f2eb

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lucia-sb force-pushed the lucia-sb/pan-firewall-ha-are branch from 1f160a3 to f31f2eb Compare October 28, 2026 10:37

lucia-sb and others added 4 commits October 28, 2026 15:09

[pan_firewall] Drop the read_each docstring

fe5dde1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lucia-sb marked this pull request as ready for review October 29, 2026 10:09

lucia-sb requested review from a team as code owners October 29, 2026 10:09

dd-octo-sts Bot added team/agent-integrations team/ndm-integrations labels Oct 29, 2026

chatgpt-codex-connector Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread pan_firewall/datadog_checks/pan_firewall/collectors/ha.py Resolved

datadog-datadog-us1-prod Bot reviewed Oct 29, 2026

View reviewed changes

lucia-sb added the backport/master label Oct 29, 2026

lucia-sb mentioned this pull request Oct 30, 2026

Remove threat log counts from Palo Alto Networks Firewall #25866

Draft

2 of 4 tasks

HadhemiDD requested changes Oct 30, 2026

View reviewed changes

HadhemiDD approved these changes Oct 30, 2026

View reviewed changes

lucia-sb added backport/7.86.x and removed backport/master labels Oct 30, 2026

lucia-sb added this pull request to the merge queue Oct 30, 2026

Merged via the queue into master with commit 10bf230 Oct 30, 2026
74 of 77 checks passed

lucia-sb deleted the lucia-sb/pan-firewall-ha-are branch October 30, 2026 11:59

dd-octo-sts Bot added this to the 7.87.0 milestone Oct 30, 2026

dd-octo-sts Bot mentioned this pull request Oct 30, 2026

[Backport 7.86.x] Collect HA link counters and Advanced Routing Engine BGP and OSPF in Palo Alto Networks Firewall #25868

Open

4 tasks done

Navigation Menu

Repository navigation

Collect HA link counters and Advanced Routing Engine BGP and OSPF in Palo Alto Networks Firewall - #25806

Collect HA link counters and Advanced Routing Engine BGP and OSPF in Palo Alto Networks Firewall#25806
lucia-sb merged 12 commits into
masterfrom
lucia-sb/pan-firewall-ha-are

lucia-sb commented Oct 27, 2026 •

edited

Loading

Uh oh!

dd-octo-sts Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

cit-pr-commenter-54b7da Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

datadog-datadog-us1-prod Bot commented Oct 27, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

Uh oh!

dd-octo-sts Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

datadog-datadog-us1-prod Bot left a comment

Uh oh!

HadhemiDD Oct 30, 2026

Uh oh!

lucia-sb Oct 30, 2026

Uh oh!

dd-octo-sts Bot commented Oct 30, 2026

Uh oh!

Uh oh!

temporal-github-worker-1 Bot commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		return [sample for router, data in answers for sample in parse(data, router)]


		def collect_bgp(ctx: CollectContext) -> list[Sample]:

Conversation

lucia-sb commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Checklist before requesting review

Uh oh!

dd-octo-sts Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Dispatcher tests: passed

Uh oh!

cit-pr-commenter-54b7da Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

evalya-impact-summary

Evalya CI impact

Uh oh!

datadog-datadog-us1-prod Bot commented Oct 27, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Disk usage change

Uncompressed

Compressed

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

datadog-datadog-us1-prod Bot left a comment

Choose a reason for hiding this comment

Uh oh!

HadhemiDD Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

lucia-sb Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

dd-octo-sts Bot commented Oct 30, 2026

Validation Report

Uh oh!

Uh oh!

temporal-github-worker-1 Bot commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lucia-sb commented Oct 27, 2026 •

edited

Loading

dd-octo-sts Bot commented Oct 27, 2026 •

edited

Loading

cit-pr-commenter-54b7da Bot commented Oct 27, 2026 •

edited

Loading

datadog-datadog-us1-prod Bot commented Oct 27, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

dd-octo-sts Bot commented Oct 28, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading