| 1 | # Health alerts for Fortinet FortiGate SNMP-monitored devices |
| 2 | |
| 3 | # Hardware sensor alarm |
| 4 | template: fortigate_hw_sensor_alarm |
| 5 | on: snmp.device_prof_fgHwSensorEntAlarmStatus |
| 6 | class: Errors |
| 7 | type: System |
| 8 | component: Hardware |
| 9 | lookup: average -1m unaligned percentage of ok |
| 10 | units: % |
| 11 | every: 10s |
| 12 | warn: $this < 100 |
| 13 | delay: down 5m multiplier 1.5 max 1h |
| 14 | summary: FortiGate sensor ${label:sensor_name} alarm |
| 15 | info: Hardware sensor ${label:sensor_name} on FortiGate device has triggered an alarm |
| 16 | to: sysadmin |
| 17 | |
| 18 | # HA node sync status |
| 19 | template: fortigate_ha_node_out_of_sync |
| 20 | on: snmp.device_prof_fgHaStatsSyncStatus |
| 21 | class: Errors |
| 22 | type: System |
| 23 | component: HA |
| 24 | lookup: average -1m unaligned percentage of in_sync |
| 25 | units: % |
| 26 | every: 10s |
| 27 | warn: $this < 100 |
| 28 | delay: down 2m multiplier 1.5 max 1h |
| 29 | summary: FortiGate HA node ${label:ha_node_hostname} sync |
| 30 | info: FortiGate HA cluster member ${label:ha_node_hostname} (${label:ha_node_serial}) is out of sync |
| 31 | to: sysadmin |
| 32 | |
| 33 | # HA node CPU usage |
| 34 | template: fortigate_ha_node_cpu_high |
| 35 | on: snmp.device_prof_fgHaStatsCpuUsage |
| 36 | class: Utilization |
| 37 | type: System |
| 38 | component: HA |
| 39 | lookup: average -5m unaligned |
| 40 | units: % |
| 41 | every: 1m |
| 42 | warn: $this > 75 |
| 43 | crit: $this > 90 |
| 44 | delay: down 5m multiplier 1.5 max 1h |
| 45 | summary: FortiGate HA node ${label:ha_node_hostname} CPU |
| 46 | info: CPU utilization on FortiGate HA cluster member ${label:ha_node_hostname} is high |
| 47 | to: sysadmin |
| 48 | |
| 49 | # HA node memory usage |
| 50 | template: fortigate_ha_node_memory_high |
| 51 | on: snmp.device_prof_fgHaStatsMemUsage |
| 52 | class: Utilization |
| 53 | type: System |
| 54 | component: HA |
| 55 | lookup: average -5m unaligned |
| 56 | units: % |
| 57 | every: 1m |
| 58 | warn: $this > 80 |
| 59 | crit: $this > 95 |
| 60 | delay: down 5m multiplier 1.5 max 1h |
| 61 | summary: FortiGate HA node ${label:ha_node_hostname} memory |
| 62 | info: Memory utilization on FortiGate HA cluster member ${label:ha_node_hostname} is high |
| 63 | to: sysadmin |
| 64 | |
| 65 | # SD-WAN link dead |
| 66 | template: fortigate_sdwan_link_dead |
| 67 | on: snmp.device_prof_fgVWLHealthCheckLinkState |
| 68 | class: Errors |
| 69 | type: System |
| 70 | component: Network |
| 71 | lookup: average -1m unaligned percentage of alive |
| 72 | units: % |
| 73 | every: 10s |
| 74 | crit: $this < 100 |
| 75 | delay: down 1m multiplier 1.5 max 1h |
| 76 | summary: FortiGate SD-WAN ${label:sdwan_healthcheck} link down |
| 77 | info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} reports link is dead |
| 78 | to: sysadmin |
| 79 | |
| 80 | # SD-WAN link high latency |
| 81 | template: fortigate_sdwan_link_latency_high |
| 82 | on: snmp.device_prof_fgVWLHealthCheckLinkLatency |
| 83 | class: Latency |
| 84 | type: System |
| 85 | component: Network |
| 86 | lookup: average -5m unaligned |
| 87 | units: ms |
| 88 | every: 1m |
| 89 | warn: $this > 300 |
| 90 | crit: $this > 500 |
| 91 | delay: down 5m multiplier 1.5 max 1h |
| 92 | summary: FortiGate SD-WAN ${label:sdwan_healthcheck} latency |
| 93 | info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} has high latency |
| 94 | to: sysadmin |
| 95 | |
| 96 | # SD-WAN link packet loss |
| 97 | template: fortigate_sdwan_link_packet_loss |
| 98 | on: snmp.device_prof_fgVWLHealthCheckLinkPacketLoss |
| 99 | class: Errors |
| 100 | type: System |
| 101 | component: Network |
| 102 | lookup: average -5m unaligned |
| 103 | units: % |
| 104 | every: 1m |
| 105 | warn: $this > 1 |
| 106 | crit: $this > 5 |
| 107 | delay: down 5m multiplier 1.5 max 1h |
| 108 | summary: FortiGate SD-WAN ${label:sdwan_healthcheck} packet loss |
| 109 | info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} has high packet loss |
| 110 | to: sysadmin |
| 111 | |
| 112 | # IPS critical severity events |
| 113 | template: fortigate_ips_critical_events |
| 114 | on: snmp.device_prof_fgIpsSeverity |
| 115 | class: Errors |
| 116 | type: System |
| 117 | component: Intrusion Prevention |
| 118 | lookup: average -5m unaligned of critical |
| 119 | units: {event}/s |
| 120 | every: 1m |
| 121 | warn: $this > 0 |
| 122 | crit: $this > 10 |
| 123 | delay: down 5m multiplier 1.5 max 1h |
| 124 | summary: FortiGate IPS critical events (VDOM ${label:vdom_name}) |
| 125 | info: Critical severity intrusions detected on FortiGate VDOM ${label:vdom_name} |
| 126 | to: sysadmin |
| 127 | |
| 128 | # Link monitor dead |
| 129 | template: fortigate_link_monitor_dead |
| 130 | on: snmp.device_prof_fgLinkMonitorState |
| 131 | class: Errors |
| 132 | type: System |
| 133 | component: Network |
| 134 | lookup: average -1m unaligned percentage of alive |
| 135 | units: % |
| 136 | every: 10s |
| 137 | crit: $this < 100 |
| 138 | delay: down 1m multiplier 1.5 max 1h |
| 139 | summary: FortiGate link monitor ${label:link_monitor} down |
| 140 | info: Link monitor ${label:link_monitor} reports gateway probe is dead |
| 141 | to: sysadmin |
| 142 | |
| 143 | # Wireless AP offline |
| 144 | template: fortigate_wireless_ap_offline |
| 145 | on: snmp.device_prof_fgWcWtpSessionConnectionState |
| 146 | class: Errors |
| 147 | type: System |
| 148 | component: Wireless |
| 149 | lookup: average -1m unaligned percentage of onLine |
| 150 | units: % |
| 151 | every: 10s |
| 152 | warn: $this < 100 |
| 153 | delay: down 5m multiplier 1.5 max 1h |
| 154 | summary: FortiGate wireless AP ${label:wtp_id} connection |
| 155 | info: Wireless access point ${label:wtp_id} (model ${label:wtp_model}) is not online |
| 156 | to: sysadmin |