Prometheus gives you a single, vendor-neutral way to collect, label, and query operational telemetry from anything that can expose an HTTP /metrics endpoint. Its pull model and PromQL make it easy to turn raw counters into rates, percentiles, and SLOs, while Alertmanager turns those signals into precise, low-noise alerts. That lets enterprises standardize on one time-series engine across hosts, containers, apps, and network gear (via exporters), without locking into a proprietary Network Monitoring System (NMS) or schema.
In a Netskope Private Access (NPA) deployment, Prometheus neatly covers the infrastructure you own side of the equation. The Publisher hosts the broker user-to-app connectivity to the Netskope cloud. By scraping host (node_exporter) and container (cAdvisor) metrics from each Netskope Publisher, which you can deploy on Ubuntu or cloud/virtual platforms, you gain real-time visibility into CPU, memory, disk, NIC errors/drops, and container health that directly impact ZTNA reliability and capacity.
Custom Variables
- Netskope Publisher (this host) IP:
$PUBLISHER_IP. (For example:10.0.0.21) - Prometheus NMS IP:
$NMS_IP. (For example:10.0.0.10)
Ports used:
- node_exporter:
9100/tcp - cAdvisor:
8080/tcp
Install node_exporter (host metrics)
Option A: Ubuntu package (fastest)
sudo apt update sudo apt install -y prometheus-node-exporter # Listens on :9100
Option B: Official binary (newer, common in prod)
VER="1.9.1"
cd /tmp
curl -LO https://github.com/prometheus/node_exporter/releases/download/v${VER}/node_exporter-${VER}.linux-amd64.tar.gz
tar xzf node_exporter-${VER}.linux-amd64.tar.gz
sudo mv node_exporter-${VER}.linux-amd64/node_exporter /usr/local/bin/
sudo useradd --no-create-home --shell /usr/sbin/nologin nodeexp || true
sudo tee /etc/systemd/system/node_exporter.service >/dev/null <<'EOF'
[Unit]
Description=Prometheus Node Exporter (Netskope Publisher)
Wants=network-online.target
After=network-online.target
[Service]
User=nodeexp
Group=nodeexp
ExecStart=/usr/local/bin/node_exporter \
--web.listen-address=":9100" \
--collector.systemd \
--collector.processes
# hardening
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
CapabilityBoundingSet=
LockPersonality=true
MemoryDenyWriteExecute=true
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now node_exporter
The two collector flags enable extra, useful host metrics (systemd + processes).
(Optional) Bind to the Publisher’s IP
If you don’t want :9100 on all interfaces, bind it:
- Package install:
sudo systemctl edit prometheus-node-exporter
- Paste:
[Service]
ExecStart=
ExecStart=/usr/bin/prometheus-node-exporter --web.listen-address="$PUBLISHER_IP:9100" --collector.systemd --collector.processes - Then:
sudo systemctl daemon-reload
sudo systemctl restart prometheus-node-exporter - Binary install: change
--web.listen-address=":9100"in the unit to"${PUBLISHER_IP}:9100"and restart.
Install cAdvisor (for Docker metrics)
cAdvisor exposes per-container CPU, memory, filesystem, and network I/O. It listens on :8080 and serves metrics at /metrics.
sudo docker run -d --name=cadvisor --restart=always -p 8080:8080 \ -v /:/rootfs:ro \ -v /var/run:/var/run:ro \ -v /sys:/sys:ro \ -v /var/lib/docker/:/var/lib/docker:ro \ gcr.io/cadvisor/cadvisor:latest
Optional: manage via systemd (Docker)
sudo tee /etc/systemd/system/cadvisor-docker.service >/dev/null <<'EOF' [Unit] Description=cAdvisor (Docker) - Netskope Publisher After=docker.service Requires=docker.service [Service] Restart=always ExecStartPre=-/usr/bin/docker rm -f cadvisor ExecStart=/usr/bin/docker run --name=cadvisor -p 8080:8080 \ -v /:/rootfs:ro -v /var/run:/var/run:ro -v /sys:/sys:ro \ -v /var/lib/docker/:/var/lib/docker:ro \ gcr.io/cadvisor/cadvisor:latest ExecStop=/usr/bin/docker rm -f cadvisor [Install] WantedBy=multi-user.target EOF sudo systemctl daemon-reload sudo systemctl enable --now cadvisor-docker
Secure the Firewall
Allow only the Prometheus Network Monitoring System (NMS) to scrape 9100 and 8080.
sudo apt -y install ufw sudo ufw allow from $NMS_IP to any port 9100 proto tcp sudo ufw allow from $NMS_IP to any port 8080 proto tcp sudo ufw enable sudo ufw status
Verify on the Netskope Publisher
# Host metrics curl -s http://$PUBLISHER_IP:9100/metrics | head # Container metrics curl -s http://$PUBLISHER_IP:8080/metrics | head
You should see metric names like node_cpu_seconds_total and container_cpu_usage_seconds_total.
Check services:
systemctl status prometheus-node-exporter || systemctl status node_exporter systemctl status cadvisor-docker
Configure the Prometheus NMS to scrape this Publisher
On the NMS, edit /etc/prometheus/prometheus.yml and add these jobs:
scrape_configs:
job_name: 'node'
static_configs:
targets: ['${PUBLISHER_IP}:9100'] # Netskope Publisher host metrics
job_name: 'cadvisor'
metrics_path: /metrics
static_configs:
targets: ['${PUBLISHER_IP}:8080'] # Netskope Publisher container metrics
Reload Prometheus on the NMS:
sudo systemctl reload prometheus || sudo systemctl restart prometheus
Quick check on the NMS (Prometheus web > Status > Targets should show both jobs UP). In Explore/Graph, try:
node_cpu_seconds_total{instance="${PUBLISHER_IP}:9100"}
container_memory_usage_bytes{instance="${PUBLISHER_IP}:8080"}
Alerts to Consider (defined on the NMS)
Create alert rules for:
- Node down:
up{job="node"} == 0 - High CPU (sustained)
- Low memory available
- Filesystem usage or inodes high
- Container restarts / OOM (via cAdvisor)
- Network errors/discards on host NICs
Place rules under /etc/prometheus/rules/*.yml and load them via rule_files: in the NMS config.
Troubleshooting Tips
- Target DOWN in Prometheus
From the NMS:curl -s http://$PUBLISHER_IP:9100/metrics | head
curl -s http://$PUBLISHER_IP:8080/metrics | head - If these fail: check UFW, service status, and the bind addresses.
- cAdvisor shows no containers. Ensure you used the Docker mount set correctly.
- High CPU/IO from cAdvisor
- Keep scrape interval at 15s initially; only lower if you truly need higher resolution.
- Avoid enabling container-level label explosions in downstream queries