No metrics in cloudwatch

[Muttley]

Hello,

I followed this guide https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-o...

for enabling the vm-serise custom metrics to cloudwatch.

But I am not seeing the VMserise category appear in cloudwatch. Also if I look at the access advisor for the role it says "Not accessed in the tracking period"

Any ideas what might be wrong or how I can diagnose?

I am allowing 443 out to any from management i/f
Nothing reported in the VM system log

TIA

[Muttley]

UPDATE:

The plugin does not seem to work with VPC endpoints. When I removed the endpoint and rebooted the VM-serise connects to CW public IP and works properly.

I believe this is because the metrics are sent using HTTP which is not supported on VPC monitoring enpoints. At least not in EU-west-1