| 1 | # you can disable an alarm notification by setting the 'to' line to: silent |
| 2 | |
| 3 | # --- Availability: BGP Peer State --- |
| 4 | |
| 5 | template: panos_bgp_peer_not_established |
| 6 | on: panos.bgp.peer.state |
| 7 | class: Availability |
| 8 | type: Network |
| 9 | component: Palo Alto Networks NGFW |
| 10 | lookup: min -5m unaligned of established |
| 11 | units: state |
| 12 | every: 1m |
| 13 | crit: $this != nan AND $this < 1 |
| 14 | delay: down 5m multiplier 1.5 max 1h |
| 15 | summary: PAN-OS BGP peer ${label:peer_address} is not established |
| 16 | info: BGP peer ${label:peer_address} in virtual router or logical router ${label:vr} \ |
| 17 | has not been established for the last 5 minutes |
| 18 | to: sysadmin |
| 19 | |
| 20 | # --- System: Device Certificate --- |
| 21 | |
| 22 | template: panos_device_certificate_invalid |
| 23 | on: panos.system.device_certificate_status |
| 24 | class: Errors |
| 25 | type: Network |
| 26 | component: Palo Alto Networks NGFW |
| 27 | lookup: max -5m unaligned of invalid |
| 28 | units: status |
| 29 | every: 1m |
| 30 | crit: $this != nan AND $this > 0 |
| 31 | summary: PAN-OS device certificate is not valid |
| 32 | info: PAN-OS reports the device certificate status as invalid |
| 33 | to: sysadmin |
| 34 | |
| 35 | # --- Availability: HA --- |
| 36 | |
| 37 | template: panos_ha_peer_connection_down |
| 38 | on: panos.ha.peer.connection_status |
| 39 | class: Availability |
| 40 | type: Network |
| 41 | component: Palo Alto Networks NGFW |
| 42 | lookup: min -5m unaligned of up |
| 43 | units: status |
| 44 | every: 1m |
| 45 | crit: $this != nan AND $this < 1 |
| 46 | delay: down 5m multiplier 1.5 max 1h |
| 47 | summary: PAN-OS HA peer connection is down |
| 48 | info: PAN-OS HA peer connection has not been up for the last 5 minutes |
| 49 | to: sysadmin |
| 50 | |
| 51 | # --- Hardware: Environment Sensors --- |
| 52 | |
| 53 | template: panos_environment_sensor_alarm |
| 54 | on: panos.environment.sensor_alarm_status |
| 55 | class: Errors |
| 56 | type: Network |
| 57 | component: Palo Alto Networks NGFW |
| 58 | lookup: max -5m unaligned of alarm |
| 59 | units: status |
| 60 | every: 1m |
| 61 | crit: $this != nan AND $this > 0 |
| 62 | summary: PAN-OS environment sensor ${label:sensor} is in alarm |
| 63 | info: PAN-OS reports an environment alarm for ${label:sensor_type} sensor ${label:sensor} in slot ${label:slot} |
| 64 | to: sysadmin |
| 65 | |
| 66 | # --- Licensing --- |
| 67 | |
| 68 | template: panos_license_expired |
| 69 | on: panos.license.status |
| 70 | class: Errors |
| 71 | type: Network |
| 72 | component: Palo Alto Networks NGFW |
| 73 | lookup: max -5m unaligned of expired |
| 74 | units: status |
| 75 | every: 1m |
| 76 | crit: $this != nan AND $this > 0 |
| 77 | summary: PAN-OS license ${label:feature} is expired |
| 78 | info: PAN-OS reports license ${label:feature} as expired |
| 79 | to: sysadmin |
| 80 | |
| 81 | template: panos_license_expires_soon |
| 82 | on: panos.license.time_until_expiration |
| 83 | class: Errors |
| 84 | type: Network |
| 85 | component: Palo Alto Networks NGFW |
| 86 | lookup: min -1h unaligned of time_until_expiration |
| 87 | units: days |
| 88 | every: 10m |
| 89 | warn: $this != nan AND $this >= 0 AND $this < 30 |
| 90 | crit: $this != nan AND $this >= 0 AND $this < 7 |
| 91 | summary: PAN-OS license ${label:feature} expires soon |
| 92 | info: PAN-OS license ${label:feature} has less than 30 days before expiration; expired licenses trigger panos_license_expired |
| 93 | to: sysadmin |