Monitoring SAP Edge Integration Cell with OpenShift Observability

Updated

Part of: SAP Edge Integration Cell on Red Hat OpenShift

Table of Contents

Overview

This guide describes how to set up monitoring for SAP Edge Integration Cell (EIC) on Red Hat OpenShift. The approach uses two complementary platform capabilities:

  • User Workload Monitoring (UWM) — OpenShift's built-in Prometheus stack, extended to scrape metrics from user namespaces. EIC already deploys ServiceMonitors and PodMonitors that expose application metrics merged with Istio mesh metrics (via Istio metrics merging). Enabling UWM is all that is needed for metrics collection.
  • Cluster Observability Operator (COO) — Provides Perses, an open-source dashboarding tool integrated into the OpenShift console. Used here solely for visualization, not for metrics collection.

This separation means no dedicated Prometheus instance or monitoring namespace to manage — the platform handles collection, storage, and the Thanos Querier endpoint.

Already have monitoring in place? If your organization already operates a monitoring platform (e.g., Prometheus/Grafana, Datadog, Splunk, or similar), you do not need to deploy UWM or COO. EIC's ServiceMonitors and PodMonitors are standard Prometheus resources — point your existing scraper at the EIC namespaces and use the PromQL queries in this guide to build dashboards in your own tooling.

By the end of this guide, you will have:

  • User Workload Monitoring collecting EIC application metrics and Istio mesh metrics
  • Perses dashboards in the OpenShift console for metrics visualization

Note: For centralized log collection from EIC namespaces, see Collecting SAP Edge Integration Cell Logs with OpenShift Logging and LokiStack.

Note: For service mesh topology visualization and live traffic flow analysis, consider enabling Kiali. Kiali is not covered in this guide. See Red Hat OpenShift Service Mesh 3.3 Observability for setup details.

Intended Audience: This document is for Red Hat OpenShift Cluster Administrators who have already deployed EIC on OpenShift with Service Mesh 3.x and want to establish day-2 monitoring.

Prerequisites

Before beginning this setup, ensure you have completed the following requirements:

Required Access and Credentials

  • Cluster-admin privileges on the target OpenShift cluster
  • Authenticated oc CLI session to your OpenShift cluster

Existing EIC Deployment

  • Red Hat OpenShift Container Platform 4.14+
  • OpenShift Service Mesh 3.x configured for EIC (Istio CR and IstioCNI deployed)
  • SAP Edge Integration Cell deployed with all namespaces:
    • edgelm — Edge Lifecycle Management
    • edge-icell — Main application components
    • edge-icell-services — Supporting services
    • edge-icell-secrets — Secrets management
    • edge-icell-ela — Event Log Agent
    • istio-gateways — Service mesh gateway components
  • EIC ServiceMonitors and PodMonitors already deployed (these are created automatically by EIC)

Required Operators

Install the following operator from OperatorHub (Operators → OperatorHub) before proceeding:

OperatorRoleWhat it provides
Red Hat OpenShift Cluster Observability OperatorVisualizationUIPlugins, Perses dashboards

Step 1: Enable User Workload Monitoring

OpenShift ships a platform Prometheus stack managed by the Cluster Monitoring Operator (CMO). By default, it only monitors platform components. Enabling User Workload Monitoring extends it to discover ServiceMonitors and PodMonitors in user namespaces — including the ones EIC has already deployed.

Enable UWM:

oc apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-monitoring-config
  namespace: openshift-monitoring
data:
  config.yaml: |
    enableUserWorkload: true
EOF

Verify UWM is running:

oc get pods -n openshift-user-workload-monitoring

You should see prometheus-user-workload and thanos-ruler-user-workload pods in Running state. It may take a minute for the pods to appear.

Verify EIC metrics are being scraped:

Navigate to Observe → Targets in the OpenShift console. You should see the EIC ServiceMonitors listed with State: Up, including:

  • eec-servicemonitor (edge-icell)
  • esac (edge-icell)
  • worker-servicemonitor (edge-icell)
  • edc-service-monitor (edge-icell)
  • pe-servicemonitor (edge-icell)
  • mdc-servicemonitor (edge-icell)
  • auditlog-agent-servicemonitor (edge-icell)
  • vmr-service-monitor (edge-icell-services)
  • edge-monitoring-service-pr-lm-operator (edgelm)

How metrics merging works: EIC enables Istio metrics merging by default. This means each pod's sidecar proxy combines the application metrics with Istio mesh metrics (istio_requests_total, istio_request_duration_milliseconds_bucket, etc.) into a single scrape endpoint. The EIC ServiceMonitors scrape this merged endpoint, so UWM collects both application and mesh metrics automatically — no separate Istio PodMonitors are needed.

Advanced: If your environment requires TLS encryption for metrics scraping or you need to separate application and Istio metrics into distinct endpoints, you can disable metrics merging and configure scraping individually. For details on the available scenarios (with/without TLS, with/without built-in ELM monitoring), see Content from help.sap.com is not included.Set Up External Prometheus Monitoring for Edge Integration Cell.

Optional — Monitor the Istio control plane:

If you also want to collect metrics from istiod itself (control plane health, xDS push latency, etc.), create a ServiceMonitor:

oc apply -f - <<EOF
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: istiod-monitor
  namespace: istio-system
spec:
  targetLabels:
  - app
  selector:
    matchLabels:
      istio: pilot
  endpoints:
  - port: http-monitoring
    interval: 30s
EOF

Step 2 (Optional): OpenShift Console Dashboards with COO and Perses

This step is optional. It adds Perses dashboards to the OpenShift console using the Cluster Observability Operator (COO). Perses is Red Hat's console-native dashboarding tool — there is no Grafana UIPlugin in COO. If your organization already uses Grafana or another visualization tool, you can skip this step and query the UWM Thanos Querier endpoint (https://thanos-querier.openshift-monitoring.svc.cluster.local:9091) directly using the PromQL queries listed in Create an EIC Overview Dashboard.

Technology Preview: Perses dashboards (UIPlugin with monitoring.perses.enabled) are a Technology Preview feature in COO 1.4+. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. For more information, see Technology Preview Features Support Scope.

Install COO

  1. Log in to the OpenShift web console.
  2. Navigate to Operators → OperatorHub.
  3. Search for Cluster Observability Operator.
  4. Click Install and accept the default settings.

Verify Installation:

oc get csv -n openshift-operators | grep cluster-observability-operator

You should see the operator with a Succeeded phase.

Enable the Perses UIPlugin

oc apply -f - <<EOF
apiVersion: observability.openshift.io/v1alpha1
kind: UIPlugin
metadata:
  name: monitoring
spec:
  type: Monitoring
  monitoring:
    perses:
      enabled: true
EOF

Wait for the UIPlugin to reconcile:

oc get uiplugin monitoring -o jsonpath='{range .status.conditions[*]}{.type}={.status}{"\n"}{end}'

You should see Reconciled and Available conditions. Once available, the Dashboards (Perses) option appears under Observe in the OpenShift console.

Configure Datasource

Create a PersesDatasource resource pointing to the platform Thanos Querier. This is the built-in query endpoint that aggregates metrics from both platform and user-workload Prometheus instances. The datasource must be named prometheus-datasource to match the name expected by the community Istio dashboards.

Create the namespace, a ServiceAccount for Thanos Querier access, and a secret with the bearer token:

oc new-project perses-dev

oc create serviceaccount perses-sa -n perses-dev
oc adm policy add-cluster-role-to-user cluster-monitoring-view -z perses-sa -n perses-dev

TOKEN=$(oc create token perses-sa -n perses-dev --duration=8760h)
oc create secret generic prometheus-datasource-secret -n perses-dev \
  --from-literal=Authorization="Bearer ${TOKEN}"

Create the datasource:

oc apply -f - <<EOF
apiVersion: perses.dev/v1alpha1
kind: PersesDatasource
metadata:
  name: prometheus-datasource
  namespace: perses-dev
spec:
  config:
    display:
      name: "Thanos Querier Datasource"
    default: true
    plugin:
      kind: "PrometheusDatasource"
      spec:
        proxy:
          kind: HTTPProxy
          spec:
            url: https://thanos-querier.openshift-monitoring.svc.cluster.local:9091
            secret: prometheus-datasource-secret
  client:
    tls:
      enable: true
      caCert:
        type: file
        certPath: /ca/service-ca.crt
EOF

Note: The ServiceAccount perses-sa is granted the cluster-monitoring-view ClusterRole, which permits read access to the platform Thanos Querier. The token is stored in a Secret and valid for one year (8760h). TLS uses the OpenShift service CA certificate mounted in the Perses backend pod. The perses-dev namespace hosts all Perses resources (datasource, community dashboards, and custom dashboards).

Optional: Apply Community Istio Dashboards

The Content from github.com is not included.Perses community-mixins project provides pre-built Istio dashboards that can be applied directly as PersesDashboard resources:

MIXIN_BASE=https://raw.githubusercontent.com/perses/community-mixins/refs/heads/main/examples/dashboards/operator/istio

oc apply -f ${MIXIN_BASE}/istio-mesh.yaml
oc apply -f ${MIXIN_BASE}/istio-service-dashboard.yaml
oc apply -f ${MIXIN_BASE}/istio-workload-dashboard.yaml
oc apply -f ${MIXIN_BASE}/istio-control-plane.yaml
oc apply -f ${MIXIN_BASE}/istio-performance.yaml
oc apply -f ${MIXIN_BASE}/istio-ztunnel-dashboard.yaml

Note: The community dashboard YAML files have namespace: perses-dev hardcoded, which is why all Perses resources are consolidated in this namespace.

These dashboards will appear under Observe → Dashboards (Perses) in the OpenShift console.

Create an EIC Overview Dashboard

You can create dashboards interactively in the OpenShift console (Observe → Dashboards (Perses) → Create) or by applying a PersesDashboard YAML resource. Below are recommended panels and the PromQL queries for each.

Recommended panels:

PanelTypeQuery
EIC Component HealthStatup{namespace=~"edge-icell\|edge-icell-services\|edgelm"}
Request Rate by ServiceTime seriessum(rate(istio_requests_total{destination_service_namespace=~"edge-icell\|edge-icell-services"}[5m])) by (destination_service_name)
Request Latency (p99)Time serieshistogram_quantile(0.99, sum(rate(istio_request_duration_milliseconds_bucket{destination_service_namespace=~"edge-icell\|edge-icell-services"}[5m])) by (destination_service_name, le))
Error RateTime seriessum(rate(istio_requests_total{destination_service_namespace=~"edge-icell\|edge-icell-services", response_code=~"5.."}[5m])) by (destination_service_name) / sum(rate(istio_requests_total{destination_service_namespace=~"edge-icell\|edge-icell-services"}[5m])) by (destination_service_name)
Pod CPU Usage by NamespaceTime seriessum(rate(container_cpu_usage_seconds_total{namespace=~"edge-icell\|edge-icell-services\|edgelm"}[5m])) by (namespace)
Pod Memory Usage by NamespaceTime seriessum(container_memory_working_set_bytes{namespace=~"edge-icell\|edge-icell-services\|edgelm"}) by (namespace)

To create the dashboard interactively:

  1. Navigate to Observe → Dashboards (Perses).
  2. Click Create and name the dashboard EIC Overview.
  3. Select the perses-dev project for the PersesDashboard resource.
  4. Click Edit, then Panel to add each panel using the queries above.
  5. Select the Platform Prometheus datasource for each panel.
  6. Click Add to place each panel on the dashboard, then Save.

Verification Checklist

Use this checklist to confirm the monitoring stack is operational:

User Workload Monitoring:

# UWM pods are running
oc get pods -n openshift-user-workload-monitoring

# EIC ServiceMonitors are discovered
oc get servicemonitors -n edge-icell
oc get servicemonitors -n edge-icell-services
oc get servicemonitors -n edgelm

Metrics:

Navigate to Observe → Metrics and query istio_requests_total to confirm Istio mesh metrics are available.

COO and Dashboards:

# COO operator should show Succeeded
oc get csv -n openshift-operators | grep cluster-observability-operator

# UIPlugin is reconciled
oc get uiplugin monitoring -o jsonpath='{range .status.conditions[*]}{.type}={.status}{"\n"}{end}'

# Datasources are created
oc get persesdatasource -n perses-dev

Navigate to Observe → Dashboards (Perses) in the OpenShift console and confirm the dashboards load with live data.

References

SBR
Tags
Article Type