feat(go.d/snmp): improve Fortinet FortiGate SNMP monitoring (#22192)
Costa Tsaousis committed
Apr 14, 2026 at 13:09 UTC
968844879dd3afd5b887b4be0ff614dfc4ac576a
7 files changed
+884
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_fortinet-fortigate-ha.yaml
new
+103
@@ -0,0 +1,103 @@
1
+# High Availability cluster monitoring for Fortinet FortiGate devices
2
+# fgHaInfo scalars: cluster mode, group, priority
3
+# fgHaStatsTable: per-node CPU, memory, network, sessions, security events, sync status
4
+
5
+metrics:
6
+ ### HA cluster scalars
7
+ - MIB: FORTINET-FORTIGATE-MIB
8
+ symbol:
9
+ OID: 1.3.6.1.4.1.12356.101.13.1.1.0
10
+ name: fgHaSystemMode
11
+ chart_meta:
12
+ description: HA system operating mode
13
+ family: 'System/HA/Cluster/Mode'
14
+ unit: "{status}"
15
+ mapping:
16
+ 1: standalone
17
+ 2: activeActive
18
+ 3: activePassive
19
+
20
+ ### HA per-node statistics table
21
+ - MIB: FORTINET-FORTIGATE-MIB
22
+ table:
23
+ OID: 1.3.6.1.4.1.12356.101.13.2.1
24
+ name: fgHaStatsTable
25
+ symbols:
26
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.3
27
+ name: fgHaStatsCpuUsage
28
+ chart_meta:
29
+ description: CPU usage of the HA cluster member
30
+ family: 'System/HA/Node/CPU/Usage'
31
+ unit: "%"
32
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.4
33
+ name: fgHaStatsMemUsage
34
+ chart_meta:
35
+ description: Memory usage of the HA cluster member
36
+ family: 'System/HA/Node/Memory/Usage'
37
+ unit: "%"
38
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.5
39
+ name: fgHaStatsNetUsage
40
+ scale_factor: 1000
41
+ chart_meta:
42
+ description: Network bandwidth usage of the HA cluster member
43
+ family: 'System/HA/Node/Network/Bandwidth'
44
+ unit: "bit/s"
45
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.6
46
+ name: fgHaStatsSesCount
47
+ chart_meta:
48
+ description: Active session count on the HA cluster member
49
+ family: 'System/HA/Node/Session/Count'
50
+ unit: "{session}"
51
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.7
52
+ name: fgHaStatsPktCount
53
+ chart_meta:
54
+ description: Packets processed by the HA cluster member
55
+ family: 'System/HA/Node/Traffic/Packets'
56
+ unit: "{packet}/s"
57
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.8
58
+ name: fgHaStatsByteCount
59
+ scale_factor: 8
60
+ chart_meta:
61
+ description: Network bandwidth processed by the HA cluster member
62
+ family: 'System/HA/Node/Traffic/Bandwidth'
63
+ unit: "bit/s"
64
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.9
65
+ name: fgHaStatsIdsCount
66
+ chart_meta:
67
+ description: IPS events detected by the HA cluster member
68
+ family: 'System/HA/Node/Security/IPS'
69
+ unit: "{event}/s"
70
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.10
71
+ name: fgHaStatsAvCount
72
+ chart_meta:
73
+ description: Antivirus events detected by the HA cluster member
74
+ family: 'System/HA/Node/Security/Antivirus'
75
+ unit: "{event}/s"
76
+ - OID: 1.3.6.1.4.1.12356.101.13.2.1.1.12
77
+ name: fgHaStatsSyncStatus
78
+ chart_meta:
79
+ description: Configuration sync status of the HA cluster member
80
+ family: 'System/HA/Node/Sync/Status'
81
+ unit: "{status}"
82
+ mapping:
83
+ 0: out_of_sync
84
+ 1: in_sync
85
+ metric_tags:
86
+ - tag: ha_node_index
87
+ symbol:
88
+ OID: 1.3.6.1.4.1.12356.101.13.2.1.1.1
89
+ name: fgHaStatsIndex
90
+ - tag: _ha_node_serial
91
+ symbol:
92
+ OID: 1.3.6.1.4.1.12356.101.13.2.1.1.2
93
+ name: fgHaStatsSerial
94
+ - tag: _ha_node_hostname
95
+ symbol:
96
+ OID: 1.3.6.1.4.1.12356.101.13.2.1.1.11
97
+ name: fgHaStatsHostname
98
+
99
+metric_tags:
100
+ - tag: _ha_group_name
101
+ symbol:
102
+ OID: 1.3.6.1.4.1.12356.101.13.1.7.0
103
+ name: fgHaGroupName
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_fortinet-fortigate-hardware.yaml
new
+67
@@ -0,0 +1,67 @@
1
+# Hardware sensor monitoring for Fortinet FortiGate devices
2
+# fgHwSensorTable: temperature, fan speed, voltage, and alarm status per sensor
3
+
4
+metrics:
5
+ # Sensor value — split by type using transform (same pattern as MikroTik/ENTITY-SENSOR-MIB)
6
+ - MIB: FORTINET-FORTIGATE-MIB
7
+ table:
8
+ OID: 1.3.6.1.4.1.12356.101.4.3.2
9
+ name: fgHwSensorTable
10
+ symbols:
11
+ # fgHwSensorEntValue is DisplayString — extract numeric part before transform
12
+ - OID: 1.3.6.1.4.1.12356.101.4.3.2.1.3
13
+ name: fgHwSensorEntValue
14
+ extract_value: '(\d+)'
15
+ chart_meta:
16
+ description: Hardware sensor reading
17
+ family: 'Hardware/Sensor'
18
+ unit: "1"
19
+ transform: |
20
+ {{- $name := index .Metric.Tags "rm:sensor_name" | default "" | lower -}}
21
+ {{- if or (contains "temp" $name) (contains "cpu" $name) (contains "thermal" $name) -}}
22
+ {{- setName .Metric "fgHwSensorEntValue_temperature" -}}
23
+ {{- setUnit .Metric "Cel" -}}
24
+ {{- setFamily .Metric "Hardware/Sensor/Temperature/Value" -}}
25
+ {{- setDesc .Metric "Temperature sensor reading" -}}
26
+ {{- else if or (contains "fan" $name) -}}
27
+ {{- setName .Metric "fgHwSensorEntValue_fan_speed" -}}
28
+ {{- setUnit .Metric "{revolution}/min" -}}
29
+ {{- setFamily .Metric "Hardware/Sensor/FanSpeed/Value" -}}
30
+ {{- setDesc .Metric "Fan rotation speed" -}}
31
+ {{- else if or (contains "vcc" $name) (contains "volt" $name) (hasSuffix "v" $name) -}}
32
+ {{- setName .Metric "fgHwSensorEntValue_voltage" -}}
33
+ {{- setUnit .Metric "V" -}}
34
+ {{- setFamily .Metric "Hardware/Sensor/Voltage/Value" -}}
35
+ {{- setDesc .Metric "Voltage sensor reading" -}}
36
+ {{- else if or (contains "power" $name) (contains "psu" $name) (contains "ps" $name) -}}
37
+ {{- setName .Metric "fgHwSensorEntValue_power" -}}
38
+ {{- setUnit .Metric "W" -}}
39
+ {{- setFamily .Metric "Hardware/Sensor/Power/Value" -}}
40
+ {{- setDesc .Metric "Power sensor reading" -}}
41
+ {{- else -}}
42
+ {{- setName .Metric "fgHwSensorEntValue_other" -}}
43
+ {{- setFamily .Metric "Hardware/Sensor/Other/Value" -}}
44
+ {{- setDesc .Metric "Unclassified sensor reading" -}}
45
+ {{- end -}}
46
+ - OID: 1.3.6.1.4.1.12356.101.4.3.2.1.4
47
+ name: fgHwSensorEntAlarmStatus
48
+ chart_meta:
49
+ description: Hardware sensor alarm status
50
+ family: 'Hardware/Sensor/Status'
51
+ unit: "{status}"
52
+ mapping:
53
+ 0: ok
54
+ 1: alarm
55
+ metric_tags:
56
+ - tag: sensor_index
57
+ symbol:
58
+ OID: 1.3.6.1.4.1.12356.101.4.3.2.1.1
59
+ name: fgHwSensorEntIndex
60
+ - tag: _sensor_name
61
+ symbol:
62
+ OID: 1.3.6.1.4.1.12356.101.4.3.2.1.2
63
+ name: fgHwSensorEntName
64
+ - tag: rm:sensor_name
65
+ symbol:
66
+ OID: 1.3.6.1.4.1.12356.101.4.3.2.1.2
67
+ name: fgHwSensorEntName
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_fortinet-fortigate-sdwan.yaml
new
+124
@@ -0,0 +1,124 @@
1
+# SD-WAN health-check and link monitor for Fortinet FortiGate devices
2
+# fgVWLHealthCheckLinkTable: per SD-WAN link state, latency, jitter, packet loss
3
+# fgLinkMonitorTable: per gateway-probe state, latency, jitter, packet loss
4
+
5
+metrics:
6
+ ### SD-WAN health-check table
7
+ - MIB: FORTINET-FORTIGATE-MIB
8
+ table:
9
+ OID: 1.3.6.1.4.1.12356.101.4.9.2
10
+ name: fgVWLHealthCheckLinkTable
11
+ symbols:
12
+ - OID: 1.3.6.1.4.1.12356.101.4.9.2.1.4
13
+ name: fgVWLHealthCheckLinkState
14
+ chart_meta:
15
+ description: SD-WAN health-check link state
16
+ family: 'Network/SD-WAN/Link/Status'
17
+ unit: "{status}"
18
+ mapping:
19
+ 0: alive
20
+ 1: dead
21
+ - OID: 1.3.6.1.4.1.12356.101.4.9.2.1.5
22
+ name: fgVWLHealthCheckLinkLatency
23
+ chart_meta:
24
+ description: Average latency of SD-WAN health-check link within last 30 probes
25
+ family: 'Network/SD-WAN/Link/Latency'
26
+ unit: "ms"
27
+ extract_value: '(\d+)'
28
+ - OID: 1.3.6.1.4.1.12356.101.4.9.2.1.6
29
+ name: fgVWLHealthCheckLinkJitter
30
+ chart_meta:
31
+ description: Average jitter of SD-WAN health-check link within last 30 probes
32
+ family: 'Network/SD-WAN/Link/Jitter'
33
+ unit: "ms"
34
+ extract_value: '(\d+)'
35
+ - OID: 1.3.6.1.4.1.12356.101.4.9.2.1.7
36
+ name: fgVWLHealthCheckLinkPacketSend
37
+ chart_meta:
38
+ description: Packets sent per second by SD-WAN health-check on this link
39
+ family: 'Network/SD-WAN/Link/Packets/Sent'
40
+ unit: "{packet}/s"
41
+ - OID: 1.3.6.1.4.1.12356.101.4.9.2.1.8
42
+ name: fgVWLHealthCheckLinkPacketRecv
43
+ chart_meta:
44
+ description: Packets received per second by SD-WAN health-check on this link
45
+ family: 'Network/SD-WAN/Link/Packets/Received'
46
+ unit: "{packet}/s"
47
+ - OID: 1.3.6.1.4.1.12356.101.4.9.2.1.9
48
+ name: fgVWLHealthCheckLinkPacketLoss
49
+ chart_meta:
50
+ description: Packet loss percentage of SD-WAN health-check link within last 30 probes
51
+ family: 'Network/SD-WAN/Link/PacketLoss'
52
+ unit: "%"
53
+ extract_value: '(\d+)'
54
+ metric_tags:
55
+ - tag: sdwan_healthcheck
56
+ symbol:
57
+ OID: 1.3.6.1.4.1.12356.101.4.9.2.1.2
58
+ name: fgVWLHealthCheckLinkName
59
+ - tag: _sdwan_interface
60
+ symbol:
61
+ OID: 1.3.6.1.4.1.12356.101.4.9.2.1.14
62
+ name: fgVWLHealthCheckLinkIfName
63
+ - tag: _sdwan_vdom
64
+ symbol:
65
+ OID: 1.3.6.1.4.1.12356.101.4.9.2.1.10
66
+ name: fgVWLHealthCheckLinkVdom
67
+
68
+ ### Link monitor table (gateway health probes)
69
+ - MIB: FORTINET-FORTIGATE-MIB
70
+ table:
71
+ OID: 1.3.6.1.4.1.12356.101.4.8.2
72
+ name: fgLinkMonitorTable
73
+ symbols:
74
+ - OID: 1.3.6.1.4.1.12356.101.4.8.2.1.3
75
+ name: fgLinkMonitorState
76
+ chart_meta:
77
+ description: Link monitor gateway probe state
78
+ family: 'Network/LinkMonitor/Status'
79
+ unit: "{status}"
80
+ mapping:
81
+ 0: alive
82
+ 1: dead
83
+ - OID: 1.3.6.1.4.1.12356.101.4.8.2.1.4
84
+ name: fgLinkMonitorLatency
85
+ chart_meta:
86
+ description: Average latency of link monitor probe
87
+ family: 'Network/LinkMonitor/Latency'
88
+ unit: "ms"
89
+ extract_value: '(\d+)'
90
+ - OID: 1.3.6.1.4.1.12356.101.4.8.2.1.5
91
+ name: fgLinkMonitorJitter
92
+ chart_meta:
93
+ description: Average jitter of link monitor probe
94
+ family: 'Network/LinkMonitor/Jitter'
95
+ unit: "ms"
96
+ extract_value: '(\d+)'
97
+ - OID: 1.3.6.1.4.1.12356.101.4.8.2.1.6
98
+ name: fgLinkMonitorPacketSend
99
+ chart_meta:
100
+ description: Packets sent by link monitor probe
101
+ family: 'Network/LinkMonitor/Packets/Sent'
102
+ unit: "{packet}/s"
103
+ - OID: 1.3.6.1.4.1.12356.101.4.8.2.1.7
104
+ name: fgLinkMonitorPacketRecv
105
+ chart_meta:
106
+ description: Packets received by link monitor probe
107
+ family: 'Network/LinkMonitor/Packets/Received'
108
+ unit: "{packet}/s"
109
+ - OID: 1.3.6.1.4.1.12356.101.4.8.2.1.8
110
+ name: fgLinkMonitorPacketLoss
111
+ chart_meta:
112
+ description: Packet loss percentage of link monitor probe
113
+ family: 'Network/LinkMonitor/PacketLoss'
114
+ unit: "%"
115
+ extract_value: '(\d+)'
116
+ metric_tags:
117
+ - tag: link_monitor
118
+ symbol:
119
+ OID: 1.3.6.1.4.1.12356.101.4.8.2.1.2
120
+ name: fgLinkMonitorName
121
+ - tag: _link_monitor_vdom
122
+ symbol:
123
+ OID: 1.3.6.1.4.1.12356.101.4.8.2.1.9
124
+ name: fgLinkMonitorVdom
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_fortinet-fortigate-security.yaml
new
+196
@@ -0,0 +1,196 @@
1
+# Security telemetry for Fortinet FortiGate devices
2
+# IPS intrusion stats, antivirus stats, webfilter stats — all per VDOM
3
+# Metrics are collected as hidden inputs; virtual_metrics combine related
4
+# dimensions into meaningful multi-dimension charts.
5
+
6
+metrics:
7
+ ### IPS intrusion statistics (per VDOM) — hidden inputs for virtual_metrics
8
+ - MIB: FORTINET-FORTIGATE-MIB
9
+ table:
10
+ OID: 1.3.6.1.4.1.12356.101.9.2.1
11
+ name: fgIpsStatsTable
12
+ symbols:
13
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.1, name: _fgIpsIntrusionsDetected}
14
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.2, name: _fgIpsIntrusionsBlocked}
15
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.3, name: _fgIpsCritSevDetections}
16
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.4, name: _fgIpsHighSevDetections}
17
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.5, name: _fgIpsMedSevDetections}
18
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.6, name: _fgIpsLowSevDetections}
19
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.7, name: _fgIpsInfoSevDetections}
20
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.8, name: _fgIpsSignatureDetections}
21
+ - {OID: 1.3.6.1.4.1.12356.101.9.2.1.1.9, name: _fgIpsAnomalyDetections}
22
+ metric_tags:
23
+ - tag: vdom_index
24
+ index: 1
25
+ - tag: _vdom_name
26
+ table: fgVdTable
27
+ symbol:
28
+ OID: 1.3.6.1.4.1.12356.101.3.2.1.1.2
29
+ name: fgVdEntName
30
+
31
+ ### Antivirus statistics (per VDOM) — hidden inputs for virtual_metrics
32
+ - MIB: FORTINET-FORTIGATE-MIB
33
+ table:
34
+ OID: 1.3.6.1.4.1.12356.101.8.2.1
35
+ name: fgAvStatsTable
36
+ symbols:
37
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.1, name: _fgAvVirusDetected}
38
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.2, name: _fgAvVirusBlocked}
39
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.3, name: _fgAvHTTPVirusDetected}
40
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.4, name: _fgAvHTTPVirusBlocked}
41
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.5, name: _fgAvSMTPVirusDetected}
42
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.6, name: _fgAvSMTPVirusBlocked}
43
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.7, name: _fgAvPOP3VirusDetected}
44
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.8, name: _fgAvPOP3VirusBlocked}
45
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.9, name: _fgAvIMAPVirusDetected}
46
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.10, name: _fgAvIMAPVirusBlocked}
47
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.11, name: _fgAvFTPVirusDetected}
48
+ - {OID: 1.3.6.1.4.1.12356.101.8.2.1.1.12, name: _fgAvFTPVirusBlocked}
49
+ metric_tags:
50
+ - tag: vdom_index
51
+ index: 1
52
+ - tag: _vdom_name
53
+ table: fgVdTable
54
+ symbol:
55
+ OID: 1.3.6.1.4.1.12356.101.3.2.1.1.2
56
+ name: fgVdEntName
57
+
58
+ ### Webfilter statistics (per VDOM) — hidden inputs for virtual_metrics
59
+ - MIB: FORTINET-FORTIGATE-MIB
60
+ table:
61
+ OID: 1.3.6.1.4.1.12356.101.10.1.2.1
62
+ name: fgWebfilterStatsTable
63
+ symbols:
64
+ - {OID: 1.3.6.1.4.1.12356.101.10.1.2.1.1.1, name: _fgWfHTTPBlocked}
65
+ - {OID: 1.3.6.1.4.1.12356.101.10.1.2.1.1.2, name: _fgWfHTTPSBlocked}
66
+ - {OID: 1.3.6.1.4.1.12356.101.10.1.2.1.1.3, name: _fgWfHTTPURLBlocked}
67
+ - {OID: 1.3.6.1.4.1.12356.101.10.1.2.1.1.4, name: _fgWfHTTPSURLBlocked}
68
+ - {OID: 1.3.6.1.4.1.12356.101.10.1.2.1.1.5, name: _fgWfActiveXBlocked}
69
+ - {OID: 1.3.6.1.4.1.12356.101.10.1.2.1.1.6, name: _fgWfCookieBlocked}
70
+ - {OID: 1.3.6.1.4.1.12356.101.10.1.2.1.1.7, name: _fgWfAppletBlocked}
71
+ metric_tags:
72
+ - tag: vdom_index
73
+ index: 1
74
+ - tag: _vdom_name
75
+ table: fgVdTable
76
+ symbol:
77
+ OID: 1.3.6.1.4.1.12356.101.3.2.1.1.2
78
+ name: fgVdEntName
79
+
80
+virtual_metrics:
81
+ ### IPS — combined charts per VDOM
82
+ - name: fgIpsIntrusions
83
+ per_row: true
84
+ group_by: ["vdom_index"]
85
+ sources:
86
+ - {metric: _fgIpsIntrusionsDetected, table: fgIpsStatsTable, as: detected}
87
+ - {metric: _fgIpsIntrusionsBlocked, table: fgIpsStatsTable, as: blocked}
88
+ chart_meta:
89
+ description: IPS intrusions detected and blocked
90
+ family: 'Security/IPS/Events'
91
+ unit: "{event}/s"
92
+
93
+ - name: fgIpsSeverity
94
+ per_row: true
95
+ group_by: ["vdom_index"]
96
+ sources:
97
+ - {metric: _fgIpsCritSevDetections, table: fgIpsStatsTable, as: critical}
98
+ - {metric: _fgIpsHighSevDetections, table: fgIpsStatsTable, as: high}
99
+ - {metric: _fgIpsMedSevDetections, table: fgIpsStatsTable, as: medium}
100
+ - {metric: _fgIpsLowSevDetections, table: fgIpsStatsTable, as: low}
101
+ - {metric: _fgIpsInfoSevDetections, table: fgIpsStatsTable, as: info}
102
+ chart_meta:
103
+ description: IPS intrusion detections by severity
104
+ family: 'Security/IPS/Severity'
105
+ unit: "{event}/s"
106
+ type: stacked
107
+
108
+ - name: fgIpsMethod
109
+ per_row: true
110
+ group_by: ["vdom_index"]
111
+ sources:
112
+ - {metric: _fgIpsSignatureDetections, table: fgIpsStatsTable, as: signature}
113
+ - {metric: _fgIpsAnomalyDetections, table: fgIpsStatsTable, as: anomaly}
114
+ chart_meta:
115
+ description: IPS intrusion detections by method
116
+ family: 'Security/IPS/Method'
117
+ unit: "{event}/s"
118
+ type: stacked
119
+
120
+ ### Antivirus — detected vs blocked total, and by-protocol breakdowns
121
+ - name: fgAvVirusEvents
122
+ per_row: true
123
+ group_by: ["vdom_index"]
124
+ sources:
125
+ - {metric: _fgAvVirusDetected, table: fgAvStatsTable, as: detected}
126
+ - {metric: _fgAvVirusBlocked, table: fgAvStatsTable, as: blocked}
127
+ chart_meta:
128
+ description: Antivirus virus events detected and blocked
129
+ family: 'Security/Antivirus/Events'
130
+ unit: "{virus}/s"
131
+
132
+ - name: fgAvVirusDetectedByProtocol
133
+ per_row: true
134
+ group_by: ["vdom_index"]
135
+ sources:
136
+ - {metric: _fgAvHTTPVirusDetected, table: fgAvStatsTable, as: http}
137
+ - {metric: _fgAvSMTPVirusDetected, table: fgAvStatsTable, as: smtp}
138
+ - {metric: _fgAvPOP3VirusDetected, table: fgAvStatsTable, as: pop3}
139
+ - {metric: _fgAvIMAPVirusDetected, table: fgAvStatsTable, as: imap}
140
+ - {metric: _fgAvFTPVirusDetected, table: fgAvStatsTable, as: ftp}
141
+ chart_meta:
142
+ description: Antivirus virus detections by protocol
143
+ family: 'Security/Antivirus/Detected/Protocol'
144
+ unit: "{virus}/s"
145
+ type: stacked
146
+
147
+ - name: fgAvVirusBlockedByProtocol
148
+ per_row: true
149
+ group_by: ["vdom_index"]
150
+ sources:
151
+ - {metric: _fgAvHTTPVirusBlocked, table: fgAvStatsTable, as: http}
152
+ - {metric: _fgAvSMTPVirusBlocked, table: fgAvStatsTable, as: smtp}
153
+ - {metric: _fgAvPOP3VirusBlocked, table: fgAvStatsTable, as: pop3}
154
+ - {metric: _fgAvIMAPVirusBlocked, table: fgAvStatsTable, as: imap}
155
+ - {metric: _fgAvFTPVirusBlocked, table: fgAvStatsTable, as: ftp}
156
+ chart_meta:
157
+ description: Antivirus virus blocks by protocol
158
+ family: 'Security/Antivirus/Blocked/Protocol'
159
+ unit: "{virus}/s"
160
+ type: stacked
161
+
162
+ ### Webfilter — grouped by related dimensions
163
+ - name: fgWfSessionBlocked
164
+ per_row: true
165
+ group_by: ["vdom_index"]
166
+ sources:
167
+ - {metric: _fgWfHTTPBlocked, table: fgWebfilterStatsTable, as: http}
168
+ - {metric: _fgWfHTTPSBlocked, table: fgWebfilterStatsTable, as: https}
169
+ chart_meta:
170
+ description: Web filter sessions blocked by protocol
171
+ family: 'Security/Webfilter/Session/Blocked'
172
+ unit: "{session}/s"
173
+
174
+ - name: fgWfURLBlocked
175
+ per_row: true
176
+ group_by: ["vdom_index"]
177
+ sources:
178
+ - {metric: _fgWfHTTPURLBlocked, table: fgWebfilterStatsTable, as: http}
179
+ - {metric: _fgWfHTTPSURLBlocked, table: fgWebfilterStatsTable, as: https}
180
+ chart_meta:
181
+ description: Web filter URLs blocked by protocol
182
+ family: 'Security/Webfilter/URL/Blocked'
183
+ unit: "{url}/s"
184
+
185
+ - name: fgWfContentBlocked
186
+ per_row: true
187
+ group_by: ["vdom_index"]
188
+ sources:
189
+ - {metric: _fgWfActiveXBlocked, table: fgWebfilterStatsTable, as: activex}
190
+ - {metric: _fgWfCookieBlocked, table: fgWebfilterStatsTable, as: cookie}
191
+ - {metric: _fgWfAppletBlocked, table: fgWebfilterStatsTable, as: applet}
192
+ chart_meta:
193
+ description: Web filter content blocks by type
194
+ family: 'Security/Webfilter/Content/Blocked'
195
+ unit: "{block}/s"
196
+ type: stacked
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_fortinet-fortigate-wireless.yaml
new
+128
@@ -0,0 +1,128 @@
1
+# Wireless controller and access point monitoring for Fortinet FortiGate devices
2
+# fgWcInfo scalars: controller summary (AP count, station count, capacity)
3
+# fgWcWtpSessionTable: per-AP connection state, uptime, CPU, memory, stations, traffic
4
+
5
+metrics:
6
+ ### Wireless controller summary scalars
7
+ - MIB: FORTINET-FORTIGATE-MIB
8
+ symbol:
9
+ OID: 1.3.6.1.4.1.12356.101.14.2.4.0
10
+ name: fgWcInfoWtpManaged
11
+ chart_meta:
12
+ description: Number of wireless access points managed by this controller
13
+ family: 'Network/Wireless/Controller/AccessPoints/Managed'
14
+ unit: "{ap}"
15
+ - MIB: FORTINET-FORTIGATE-MIB
16
+ symbol:
17
+ OID: 1.3.6.1.4.1.12356.101.14.2.3.0
18
+ name: fgWcInfoWtpCapacity
19
+ chart_meta:
20
+ description: Maximum number of wireless access points this controller can manage
21
+ family: 'Network/Wireless/Controller/AccessPoints/Capacity'
22
+ unit: "{ap}"
23
+ - MIB: FORTINET-FORTIGATE-MIB
24
+ symbol:
25
+ OID: 1.3.6.1.4.1.12356.101.14.2.5.0
26
+ name: fgWcInfoWtpSessions
27
+ chart_meta:
28
+ description: Number of wireless access points currently connecting to this controller
29
+ family: 'Network/Wireless/Controller/AccessPoints/Connecting'
30
+ unit: "{ap}"
31
+ - MIB: FORTINET-FORTIGATE-MIB
32
+ symbol:
33
+ OID: 1.3.6.1.4.1.12356.101.14.2.7.0
34
+ name: fgWcInfoStationCount
35
+ chart_meta:
36
+ description: Number of wireless client stations currently connected
37
+ family: 'Network/Wireless/Controller/Stations/Active'
38
+ unit: "{station}"
39
+ - MIB: FORTINET-FORTIGATE-MIB
40
+ symbol:
41
+ OID: 1.3.6.1.4.1.12356.101.14.2.6.0
42
+ name: fgWcInfoStationCapacity
43
+ chart_meta:
44
+ description: Maximum number of wireless client stations supported
45
+ family: 'Network/Wireless/Controller/Stations/Capacity'
46
+ unit: "{station}"
47
+
48
+ ### Per-AP session table
49
+ - MIB: FORTINET-FORTIGATE-MIB
50
+ table:
51
+ OID: 1.3.6.1.4.1.12356.101.14.4.4
52
+ name: fgWcWtpSessionTable
53
+ symbols:
54
+ - OID: 1.3.6.1.4.1.12356.101.14.4.4.1.7
55
+ name: fgWcWtpSessionConnectionState
56
+ chart_meta:
57
+ description: Wireless access point connection state to controller
58
+ family: 'Network/Wireless/AccessPoint/Status/Connection'
59
+ unit: "{status}"
60
+ mapping:
61
+ 0: other
62
+ 1: offLine
63
+ 2: onLine
64
+ 3: downloadingImage
65
+ 4: connectedImage
66
+ 5: other2
67
+ - OID: 1.3.6.1.4.1.12356.101.14.4.4.1.8
68
+ name: fgWcWtpSessionWtpUpTime
69
+ scale_factor: 0.01
70
+ chart_meta:
71
+ description: Time since the wireless access point last booted
72
+ family: 'Network/Wireless/AccessPoint/Uptime'
73
+ unit: "s"
74
+ - OID: 1.3.6.1.4.1.12356.101.14.4.4.1.17
75
+ name: fgWcWtpSessionWtpStationCount
76
+ chart_meta:
77
+ description: Number of client stations currently connected to this access point
78
+ family: 'Network/Wireless/AccessPoint/Clients/Active'
79
+ unit: "{station}"
80
+ - OID: 1.3.6.1.4.1.12356.101.14.4.4.1.18
81
+ name: fgWcWtpSessionWtpByteRxCount
82
+ scale_factor: 8
83
+ chart_meta:
84
+ description: Traffic received by this wireless access point
85
+ family: 'Network/Wireless/AccessPoint/Traffic/In'
86
+ unit: "bit/s"
87
+ - OID: 1.3.6.1.4.1.12356.101.14.4.4.1.19
88
+ name: fgWcWtpSessionWtpByteTxCount
89
+ scale_factor: 8
90
+ chart_meta:
91
+ description: Traffic transmitted by this wireless access point
92
+ family: 'Network/Wireless/AccessPoint/Traffic/Out'
93
+ unit: "bit/s"
94
+ - OID: 1.3.6.1.4.1.12356.101.14.4.4.1.20
95
+ name: fgWcWtpSessionWtpCpuUsage
96
+ chart_meta:
97
+ description: Current CPU usage of the wireless access point
98
+ family: 'Network/Wireless/AccessPoint/CPU/Usage'
99
+ unit: "%"
100
+ - OID: 1.3.6.1.4.1.12356.101.14.4.4.1.21
101
+ name: fgWcWtpSessionWtpMemoryUsage
102
+ chart_meta:
103
+ description: Current memory usage of the wireless access point
104
+ family: 'Network/Wireless/AccessPoint/Memory/Usage'
105
+ unit: "%"
106
+ - OID: 1.3.6.1.4.1.12356.101.14.4.4.1.22
107
+ name: fgWcWtpSessionWtpMemoryCapacity
108
+ scale_factor: 1024
109
+ chart_meta:
110
+ description: Total physical memory installed on the wireless access point
111
+ family: 'Network/Wireless/AccessPoint/Memory/Total'
112
+ unit: "By"
113
+ metric_tags:
114
+ - tag: wtp_id
115
+ index: 1
116
+ - tag: _wtp_model
117
+ symbol:
118
+ OID: 1.3.6.1.4.1.12356.101.14.4.4.1.12
119
+ name: fgWcWtpSessionWtpModelNumber
120
+ - tag: _wtp_profile
121
+ symbol:
122
+ OID: 1.3.6.1.4.1.12356.101.14.4.4.1.11
123
+ name: fgWcWtpSessionWtpProfileName
124
+ - tag: _wtp_ip
125
+ symbol:
126
+ OID: 1.3.6.1.4.1.12356.101.14.4.4.1.3
127
+ name: fgWcWtpSessionWtpIpAddress
128
+ format: ip_address
src/go/plugin/go.d/config/go.d/snmp.profiles/default/fortinet-fortigate.yaml
+110
@@ -6,6 +6,11 @@ extends:
6
- _system-base.yaml
7
- _std-if-mib.yaml
8
- _fortinet-fortigate-vpn-tunnel.yaml
9
+ - _fortinet-fortigate-hardware.yaml
10
+ - _fortinet-fortigate-ha.yaml
11
+ - _fortinet-fortigate-sdwan.yaml
12
+ - _fortinet-fortigate-security.yaml
13
+ - _fortinet-fortigate-wireless.yaml
14
15
# All fortinet devices have sysObjectID starting with `1.3.6.1.4.1.12356.101.1` (fgModel)
16
# We only target Fortinet Fortigate devices (1.3.6.1.4.1.12356.101/fnFortiGateMib)
@@ -137,6 +142,20 @@ metrics:
142
description: Processor CPU system space usage averaged over last minute
143
family: 'System/Processor/Usage/System'
144
unit: "%"
145
+ # The processor's CPU user space usage, which is an average calculated over the last minute.
146
+ - OID: 1.3.6.1.4.1.12356.101.4.4.2.1.9
147
+ name: fgProcessorUserUsage
148
+ chart_meta:
149
+ description: Processor CPU user space usage averaged over last minute
150
+ family: 'System/Processor/Usage/User'
151
+ unit: "%"
152
+ # The processor's CPU usage (percentage), which is a 5-second average.
153
+ - OID: 1.3.6.1.4.1.12356.101.4.4.2.1.3
154
+ name: fgProcessorUsage5sec
155
+ chart_meta:
156
+ description: Processor CPU usage 5-second average
157
+ family: 'System/Processor/Usage/5sec'
158
+ unit: "%"
159
metric_tags:
160
# A unique identifier within the fgProcessorTable.
161
- tag: processor_index
@@ -328,6 +347,56 @@ metrics:
347
description: Average IPv6 session setup rate over the past minute
348
family: 'Security/Session/IPv6/Rate/Average'
349
unit: "{session}/s"
350
+ # Session rate trend scalars (10/30/60 minute averages)
351
+ - MIB: FORTINET-FORTIGATE-MIB
352
+ symbol:
353
+ OID: 1.3.6.1.4.1.12356.101.4.1.12.0
354
+ name: fgSysSesRate10
355
+ chart_meta:
356
+ description: Average session setup rate over the past 10 minutes
357
+ family: 'Security/Session/Rate/10min'
358
+ unit: "{session}/s"
359
+ - MIB: FORTINET-FORTIGATE-MIB
360
+ symbol:
361
+ OID: 1.3.6.1.4.1.12356.101.4.1.13.0
362
+ name: fgSysSesRate30
363
+ chart_meta:
364
+ description: Average session setup rate over the past 30 minutes
365
+ family: 'Security/Session/Rate/30min'
366
+ unit: "{session}/s"
367
+ - MIB: FORTINET-FORTIGATE-MIB
368
+ symbol:
369
+ OID: 1.3.6.1.4.1.12356.101.4.1.14.0
370
+ name: fgSysSesRate60
371
+ chart_meta:
372
+ description: Average session setup rate over the past 60 minutes
373
+ family: 'Security/Session/Rate/60min'
374
+ unit: "{session}/s"
375
+ - MIB: FORTINET-FORTIGATE-MIB
376
+ symbol:
377
+ OID: 1.3.6.1.4.1.12356.101.4.1.17.0
378
+ name: fgSysSes6Rate10
379
+ chart_meta:
380
+ description: Average IPv6 session setup rate over the past 10 minutes
381
+ family: 'Security/Session/IPv6/Rate/10min'
382
+ unit: "{session}/s"
383
+ - MIB: FORTINET-FORTIGATE-MIB
384
+ symbol:
385
+ OID: 1.3.6.1.4.1.12356.101.4.1.18.0
386
+ name: fgSysSes6Rate30
387
+ chart_meta:
388
+ description: Average IPv6 session setup rate over the past 30 minutes
389
+ family: 'Security/Session/IPv6/Rate/30min'
390
+ unit: "{session}/s"
391
+ - MIB: FORTINET-FORTIGATE-MIB
392
+ symbol:
393
+ OID: 1.3.6.1.4.1.12356.101.4.1.19.0
394
+ name: fgSysSes6Rate60
395
+ chart_meta:
396
+ description: Average IPv6 session setup rate over the past 60 minutes
397
+ family: 'Security/Session/IPv6/Rate/60min'
398
+ unit: "{session}/s"
399
+
400
- MIB: FORTINET-FORTIGATE-MIB
401
symbol:
402
# HTTP proxy current connections.
@@ -347,6 +416,10 @@ metrics:
416
family: 'Security/Proxy/HTTP/Connection/Maximum'
417
unit: "{connection}"
418
419
+ # NOTE: interface-to-VDOM binding (fgIntfEntVdom from fgIntfTable) is deferred.
420
+ # Requires engine support for adding tags to inherited table metrics.
421
+ # Per-VDOM monitoring is available via fgVdTable (session/CPU/memory per VDOM).
422
+
423
### Firewall
424
# Firewall policy statistics table.
425
- MIB: FORTINET-FORTIGATE-MIB
@@ -403,3 +476,40 @@ metrics:
476
# Firewall policy6 ID. Only enabled policies are present in this table. Policy IDs are only unique within a virtual domain.
477
- tag: policy6_index
478
index: 2
479
+
480
+virtual_metrics:
481
+ ### Session rate trend — combined 1/10/30/60 min averages per IP version
482
+ - name: fgSysSesRateTrend
483
+ sources:
484
+ - {metric: fgSysSesRate1, as: 1m}
485
+ - {metric: fgSysSesRate10, as: 10m}
486
+ - {metric: fgSysSesRate30, as: 30m}
487
+ - {metric: fgSysSesRate60, as: 60m}
488
+ chart_meta:
489
+ description: Session setup rate trend (IPv4)
490
+ family: 'Security/Session/Rate/Trend'
491
+ unit: "{session}/s"
492
+
493
+ - name: fgSysSes6RateTrend
494
+ sources:
495
+ - {metric: fgSysSes6Rate1, as: 1m}
496
+ - {metric: fgSysSes6Rate10, as: 10m}
497
+ - {metric: fgSysSes6Rate30, as: 30m}
498
+ - {metric: fgSysSes6Rate60, as: 60m}
499
+ chart_meta:
500
+ description: Session setup rate trend (IPv6)
501
+ family: 'Security/Session/IPv6/Rate/Trend'
502
+ unit: "{session}/s"
503
+
504
+ ### Processor usage breakdown — user + system combined per processor
505
+ - name: fgProcessorUsageBreakdown
506
+ per_row: true
507
+ group_by: ["processor_index"]
508
+ sources:
509
+ - {metric: fgProcessorUserUsage, table: fgProcessorTable, as: user}
510
+ - {metric: fgProcessorSysUsage, table: fgProcessorTable, as: system}
511
+ chart_meta:
512
+ description: Processor CPU usage breakdown by user and system space
513
+ family: 'System/Processor/Usage/Breakdown'
514
+ unit: "%"
515
+ type: stacked
src/health/health.d/snmp_fortigate.conf
new
+156
@@ -0,0 +1,156 @@
1
+# Health alerts for Fortinet FortiGate SNMP-monitored devices
2
+
3
+# Hardware sensor alarm
4
+ template: fortigate_hw_sensor_alarm
5
+ on: snmp.device_prof_fgHwSensorEntAlarmStatus
6
+ class: Errors
7
+ type: System
8
+component: Hardware
9
+ lookup: average -1m unaligned percentage of ok
10
+ units: %
11
+ every: 10s
12
+ warn: $this < 100
13
+ delay: down 5m multiplier 1.5 max 1h
14
+ summary: FortiGate sensor ${label:sensor_name} alarm
15
+ info: Hardware sensor ${label:sensor_name} on FortiGate device has triggered an alarm
16
+ to: sysadmin
17
+
18
+# HA node sync status
19
+ template: fortigate_ha_node_out_of_sync
20
+ on: snmp.device_prof_fgHaStatsSyncStatus
21
+ class: Errors
22
+ type: System
23
+component: HA
24
+ lookup: average -1m unaligned percentage of in_sync
25
+ units: %
26
+ every: 10s
27
+ warn: $this < 100
28
+ delay: down 2m multiplier 1.5 max 1h
29
+ summary: FortiGate HA node ${label:ha_node_hostname} sync
30
+ info: FortiGate HA cluster member ${label:ha_node_hostname} (${label:ha_node_serial}) is out of sync
31
+ to: sysadmin
32
+
33
+# HA node CPU usage
34
+ template: fortigate_ha_node_cpu_high
35
+ on: snmp.device_prof_fgHaStatsCpuUsage
36
+ class: Utilization
37
+ type: System
38
+component: HA
39
+ lookup: average -5m unaligned
40
+ units: %
41
+ every: 1m
42
+ warn: $this > 75
43
+ crit: $this > 90
44
+ delay: down 5m multiplier 1.5 max 1h
45
+ summary: FortiGate HA node ${label:ha_node_hostname} CPU
46
+ info: CPU utilization on FortiGate HA cluster member ${label:ha_node_hostname} is high
47
+ to: sysadmin
48
+
49
+# HA node memory usage
50
+ template: fortigate_ha_node_memory_high
51
+ on: snmp.device_prof_fgHaStatsMemUsage
52
+ class: Utilization
53
+ type: System
54
+component: HA
55
+ lookup: average -5m unaligned
56
+ units: %
57
+ every: 1m
58
+ warn: $this > 80
59
+ crit: $this > 95
60
+ delay: down 5m multiplier 1.5 max 1h
61
+ summary: FortiGate HA node ${label:ha_node_hostname} memory
62
+ info: Memory utilization on FortiGate HA cluster member ${label:ha_node_hostname} is high
63
+ to: sysadmin
64
+
65
+# SD-WAN link dead
66
+ template: fortigate_sdwan_link_dead
67
+ on: snmp.device_prof_fgVWLHealthCheckLinkState
68
+ class: Errors
69
+ type: System
70
+component: Network
71
+ lookup: average -1m unaligned percentage of alive
72
+ units: %
73
+ every: 10s
74
+ crit: $this < 100
75
+ delay: down 1m multiplier 1.5 max 1h
76
+ summary: FortiGate SD-WAN ${label:sdwan_healthcheck} link down
77
+ info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} reports link is dead
78
+ to: sysadmin
79
+
80
+# SD-WAN link high latency
81
+ template: fortigate_sdwan_link_latency_high
82
+ on: snmp.device_prof_fgVWLHealthCheckLinkLatency
83
+ class: Latency
84
+ type: System
85
+component: Network
86
+ lookup: average -5m unaligned
87
+ units: ms
88
+ every: 1m
89
+ warn: $this > 300
90
+ crit: $this > 500
91
+ delay: down 5m multiplier 1.5 max 1h
92
+ summary: FortiGate SD-WAN ${label:sdwan_healthcheck} latency
93
+ info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} has high latency
94
+ to: sysadmin
95
+
96
+# SD-WAN link packet loss
97
+ template: fortigate_sdwan_link_packet_loss
98
+ on: snmp.device_prof_fgVWLHealthCheckLinkPacketLoss
99
+ class: Errors
100
+ type: System
101
+component: Network
102
+ lookup: average -5m unaligned
103
+ units: %
104
+ every: 1m
105
+ warn: $this > 1
106
+ crit: $this > 5
107
+ delay: down 5m multiplier 1.5 max 1h
108
+ summary: FortiGate SD-WAN ${label:sdwan_healthcheck} packet loss
109
+ info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} has high packet loss
110
+ to: sysadmin
111
+
112
+# IPS critical severity events
113
+ template: fortigate_ips_critical_events
114
+ on: snmp.device_prof_fgIpsSeverity
115
+ class: Errors
116
+ type: System
117
+component: Intrusion Prevention
118
+ lookup: average -5m unaligned of critical
119
+ units: {event}/s
120
+ every: 1m
121
+ warn: $this > 0
122
+ crit: $this > 10
123
+ delay: down 5m multiplier 1.5 max 1h
124
+ summary: FortiGate IPS critical events (VDOM ${label:vdom_name})
125
+ info: Critical severity intrusions detected on FortiGate VDOM ${label:vdom_name}
126
+ to: sysadmin
127
+
128
+# Link monitor dead
129
+ template: fortigate_link_monitor_dead
130
+ on: snmp.device_prof_fgLinkMonitorState
131
+ class: Errors
132
+ type: System
133
+component: Network
134
+ lookup: average -1m unaligned percentage of alive
135
+ units: %
136
+ every: 10s
137
+ crit: $this < 100
138
+ delay: down 1m multiplier 1.5 max 1h
139
+ summary: FortiGate link monitor ${label:link_monitor} down
140
+ info: Link monitor ${label:link_monitor} reports gateway probe is dead
141
+ to: sysadmin
142
+
143
+# Wireless AP offline
144
+ template: fortigate_wireless_ap_offline
145
+ on: snmp.device_prof_fgWcWtpSessionConnectionState
146
+ class: Errors
147
+ type: System
148
+component: Wireless
149
+ lookup: average -1m unaligned percentage of onLine
150
+ units: %
151
+ every: 10s
152
+ warn: $this < 100
153
+ delay: down 5m multiplier 1.5 max 1h
154
+ summary: FortiGate wireless AP ${label:wtp_id} connection
155
+ info: Wireless access point ${label:wtp_id} (model ${label:wtp_model}) is not online
156
+ to: sysadmin